Re: SOI QUESTIONS: 2.3 Authentication styles

[Gary Grebus USG <grebus@fddimax.zk3.dec.com>]

> 
> 2.3.A.)  Does SOI need to natively support "legacy authentication
> systems"?

As a requirement, absolutely not.

The question is what is the appropriate key exchange protocol to support the 
security that should be present in every IP stack on every device that 
support IP.  Implementations that need to support external authentication 
protocols should do so a modular, external protocol. 

> 
> 2.3.B.)  Does SOI need to natively support some kind of "shared
> secret" scheme?  (Or just certificates-only?)
> 

While I don't see anything wrong with shared secrets for authentication,
requiring support for public-key based authentication seems like an
acceptable compromise between requiring shared secrets and requiring full certificates
(even self-signed).

The requirement to replace pre-shared secrets used with IKEv1 with simply generated 
public-keys for IKEv2 doesn't seem like a major hurdle in an upgrade path.

-- 
Gary Grebus			
Hewlett-Packard Company		
Tru64 UNIX Base OS Networking
Gary.Grebus@hp.com