Re: suites vs. a la carte and IPcomp in IKEv2-05

[Eric Rescorla <ekr@rtfm.com>]

Paul Koning <pkoning@equallogic.com> writes:
> I wonder: is this still a real issue today?   It would be good not to
> add messes to the protocol to support strange hardware architectures
> that are long obsolete.  Certainly this issue doesn't appear in any
> hardware I have ever seen.  (Come to think of it, if I saw this when
> doing device selection, I'd be very tempted to exclude such a device.)

It's generally not an issue of individual pieces of hardware but
of what happens when you have an implementation based on
multiple CSP-like modules.

Say, for the sake of argument that you have a piece of hardware
that processes single IPsec records and supports 3DES and SHA.
You then add another CSP that supports AES and MD5. You can't
necessarily mix and match here, so you need to provide profiles.

-Ekr

-- 
[Eric Rescorla                                   ekr@rtfm.com]
                http://www.rtfm.com/