Re: Last ditch proposal for crypto suites

[Henry Spencer <henry@spsystems.net>]

On Thu, 29 Aug 2002, Dan Harkins wrote:
> >                                                         Almost no one 
> > in their right mind would really mean that Phase 1 be protected with 
> > DES and Phase 2 be protected with TripleDES...
> 
>  ...We're talking about two different proposals (whether it's suites or
> a la carte). One to protect the IKE traffic and another to protect the 
> bulk data. Those two traffic flows are quite different and their
> security needs are different as well.

Yes, but under what circumstances would that particular combination make
sense?  If 3DES is fast enough to be used for bulk data, it is fast enough
to be used for IKE traffic.  Given that IKE traffic is such a tiny fraction
of the normal traffic flow, there is just no sense in not using the best
crypto algorithm you've got to protect it.

                                                          Henry Spencer
                                                       henry@spsystems.net