[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
On shared keys (was RE: SOI: identity protection and DOS)
Hugo Krawczyk writes:
> Everyone agrees that public key is the ONLY way to a scalable
> Internet-wide protocol. No question about it. In particular,
> any key-exchange protocol for IPsec MUST provide a PK-based exchange.
I don't think I agree if by Internet-wide you mean
any-any scaling. I frankly don't think that such a
thing exists, or is likely to exist. Thus while PK
exchanges give many useful properties, enrollment,
compromise, and administration are still problems
for both. Indeed, the only thing in existence
right now that scales to any appreciable degree is
*not* based on asymmetric keys (GSM). It seems to
scale well enough for its application and
acceptible risk parameters.
Mike
Follow-Ups:
References: