[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Position statement on IKE development
Alex Alten wrote:
>If IKE is no longer considered viable because of it's complexity, then
>I am concerned that the other protocols of IPsec are also at risk.
Why? The packet-level parts of IPsec are much less complex
(and, partially as a result, have received more scrutiny, as
far as I can tell).
>At this point, to restore confidence in the security of the design I
>would hope that the IETF will retain the services of a quality
>cryptanalysis consulting firm and publish the results. To do otherwise
>will be to risk the discrediting of the entire IPsec standard.
I think this is probably unnecessary. The main thing that deters
analysis from the academics (from the anecdotes I've heard) is the
complexity of IKE. If this improves, my guess is that you're likely
to receive better cryptanalysis from the community as a whole than
you'd get from a consulting firm.
Follow-Ups:
References: