RE: Last ditch proposal for crypto suites

[Paul Koning <pkoning@equallogic.com>]

If I heard Charlie right, the ability to handle a la carte negotiation
would be optional, so if it turns out to be necessary after all, there
would have to be a mad scramble to implement in in all the
implementations that had left it out at first.

Ok, so be it.

One data point: in a past life when I implemented IPsec, we
effectively implemented suites.  The management interface had a MIB
table of "crypto profiles" -- table rows with a name and a choice for
each of the transforms.  We supplied a default set of profiles, the
obvious suspects: default-auth (md5 only); default-weak (md5 and des);
default-strong (md5 and 3des).  I don't remember anyone ever adding
profiles to that list, unless they were testing oddball setups at
bakeoff meetings...

So I would argue that the suite approach is the best way to meet
customer needs.

	 paul