Re: The CR payload still

[Michael Richardson <mcr@sandelman.ottawa.on.ca>]

>>>>> "Charlie" == Charlie Kaufman <Charlie_Kaufman@notesdev.ibm.com> writes:
    Charlie> An empty CERTREQ payload is requesting any certificate or
    Charlie> certificate chain the other side has without giving any hints as
    Charlie> to what certificates are preferred.

    Charlie> A missing CERTREQ payload is requesting that the other side not
    Charlie> bother sending any certificates.

    Charlie> When would an IKE implementation want to express the second
    Charlie> request? I had assumed that if CERTREQ was missing that the

  1) when it isn't using certificates
  2) when it already has, preconfigured the right things

    Charlie> If someone has a use for requesting no certificates, I think
    Charlie> this is a fine way to encode it. But I'm reluctant to add a
    Charlie> feature unless someone thinks they need it.

  Charlie, you seem to have fallen into the trap of making IKEv2 depend
way too heavily upon PKIX. 

  There is significant deployment of RSA keys that does not use that stuff.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] mcr@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [