RE: SOI QUESTIONS: 2.3 Authentication styles

["Childs, Jonathan (Jonathan)" <jonchilds@lucent.com>]

I couldn't agree more with  Dan's assertion.  We were more or less forced to
add Xauth to support customer needs. After some interop problems they are
finally happy using it as is.  To remove something that they count on rather
heavily would make IKEv2 a non starter for them.  If we don't support some
kind of built in legacy auth I have a feeling I will be implementing some
non-standard Xauthv2 draft in the future.

To answer Ted's question though I think this is absolutely necessary.
Lots of problems with IKEv1 had to do with the fact that we ignored this
subject and people attempted to add it in various ways after the fact,
some more clumsily than others. That tends to work against interoperability
and for single vendor solutions. 

We made a mistake by ignoring this the first time and it would be a mistake
to do so again. PIC is not a solution to this problem.

  Dan.