Re: Suggestion for SOI wrt PFS

[Jan Vilhuber <vilhuber@cisco.com>]

On Mon, 1 Apr 2002, Bill Sommerfeld wrote:

> > Generally, people do NOT want to be reprompted for passwords in the
> > middle of a session, though...
>
> this is no doubt one of the reasons why PIC does legacy authentication
> and issues certs prior to kicking off IKE.
>

Agreed. But note there hasn't been agreement (see Cheryl's
requirements document) on whether we want to punt all remote access to
IPSRA (thus using PIC), or not.

If we use PIC for all legacy authentication (aside: why is it called
legacy, when it's still being used extensively?), then the discussion
degrades into 'is rsa cheap'...

jan
 --
Jan Vilhuber                                            vilhuber@cisco.com
Cisco Systems, San Jose                                     (408) 527-0847