RE: Last ditch proposal for crypto suites

[Paul Koning <pkoning@equallogic.com>]

>>>>> "Marc" == Marc Desrosiers <mdesros@nortelnetworks.com> writes:

 Marc> Yes but now you have to create a new suite because the bundle
 Marc> that also contained RSA and AES (as an example) has been
 Marc> deprecated. If you now want to support AES or RSA you have to
 Marc> point to a new suite. How do you maintain interoperability
 Marc> during the transition period?

I don't understand.

Start with a suite: ESP: DES and SHA-1.

Discover that DES is no good (ok, that's very old news).

Define a new suite: ESP: AES and SHA-1.  Relabel that one mandatory,
the DES suite deprecated.

You can now use the new suite with new implementations, and you're
stuck with the old crufty suite with implementations that offer
nothing better.

That works just fine.  It works at least as well as the current
situation with DES.

	  paul