Re: What is the standardization status of AES in IPSec?

["Jari Arkko" <jari.arkko@kolumbus.fi>]

> I'm curious as to how many people believe that a MUST for a 128-bit AES
> key means a MUST for 128 bits of entropy in the key.

I don't. While I believe we should move to AES as soon as possible, I
don't necessarily believe in the statement that all components of the
protocol set must be equally strong; you should be able to take advantage
of a new good algorithm even if you can't for e.g. computational reasons
increase Diffie-Hellman key lengths quite as much.

Thus, I believe we should standardize groups matching AES strength,
but not make them mandatory. And we need to explain the strength
issues somewhere.

Jari