Protection against DoS attack

["David Faucher" <dfaucher@lucent.com>]

Section 4.4 of draft-ietf-ipsec-ikev2-03.txt states
that there is a denial of service attack on the initiator
that can be avoided if the initiator takes proper care.

Is it worth the added complexity of having the initiator
accept multiple responses to its first message and are we
just trading one DoS for another?

Since there is a significant amount of processing associated 
with creating message 3, an implementation would presumably
limit the number of responses it is willing to accept. An attacker
could flood the initiator with enough bogus responses to still 
poison the connection setup.

David