Re: suites vs. a la carte and IPcomp in IKEv2-05

[Tero Kivinen <kivinen@iki.fi>]

ekr@rtfm.com (Eric Rescorla) writes:
> Say, for the sake of argument that you have a piece of hardware
> that processes single IPsec records and supports 3DES and SHA.
> You then add another CSP that supports AES and MD5. You can't

Then the IKE must select one of those and offer only that. If the
negotiation fails it can try the other. As told earlier in this thread
most of the IPsec initiators are configured to only send one offer
anyways, so I don't really think this is very big issue. 
-- 
kivinen@ssh.fi
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/