[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: The CR payload still

To: Brian Korver <briank@briank.com>, <Charlie_Kaufman@notesdev.ibm.com>
Subject: Re: The CR payload still
From: Paul Hoffman / VPNC <paul.hoffman@vpnc.org>
Date: Wed, 5 Mar 2003 13:31:48 -0800
Cc: <ipsec@lists.tislabs.com>
In-Reply-To: <BA8B8AD8.4389%briank@briank.com>
References: <BA8B8AD8.4389%briank@briank.com>
Sender: owner-ipsec@lists.tislabs.com

At 11:07 AM -0800 3/5/03, Brian Korver wrote:
>Except for the case of opportunistic IPsec, I don't see the point
>of telling your peer "I don't care".

There are other meanings than "I don't care". We need to be able to 
say "send me a cert of type other than 4", namely types 11, 12, and 
13. Currently, we can't specify that.

>   Therefore, I agree that an empty
>CERTREQ should be prohibited in IKEv2, especially because it creates an
>interoperability rat hole.

It won't do that if we scope it correctly.

--Paul Hoffman, Director
--VPN Consortium

Follow-Ups:
- Re: The CR payload still
  - From: "Valery Smyslov" <svan@trustworks.com>
- Re: The CR payload still
  - From: Pekka Riikonen <priikone@iki.fi>
- Re: The CR payload still
  - From: Brian Korver <briank@briank.com>

References:
- Re: The CR payload still
  - From: Brian Korver <briank@briank.com>

Prev by Date: Re: Re: bidding down attach on NAT-T
Next by Date: Re: suites vs. a la carte and IPcomp in IKEv2-05
Prev by thread: Re: The CR payload still
Next by thread: Re: The CR payload still
Index(es):
- Date
- Thread