Re: Do ipsec vendors care about privacy?

[Russ Housley <housley@vigilsec.com>]

Hugo:


I wrote:
>Hugo, in my view it is too late to be raising a question that will cause
>major surgery on the document.  It is time to fix things that are broken,
>make the document internally consistent, and publish it.  I do not think it
>is time to raise new requirements.


You replied:
>This response really sounds as coming from the area director :)
>ANyway, I'd agree with you that this is too late if the change I proposed
>required "major surgery on the document". But it doesn't.
>Any of the proposed solutions takes a 1 minute editorial work,
>just moving one or two fields from one message to the other in section
>2.16 (and has no influence on other partts of the document).
>
>The question is not specification complexity which is null for this
>changes. ALso, it is not a performance issue. None of the proposed changes
>add round trips or computation (a message to the list from
>Antonio Forzieri might have given that impression but his
>modification of my proposal was unnecessary as he later stated himself).
>
>The only question is operational: can the responder (server) send the
>first EAP message before getting IDi? If this is the case (as it was in
>PIC and seems tobe agreed in some responses to my message) then we are
>done at no cost at all (solution 1). If not, we may need to go to
>solution 2 (in which the responder authenticates in message 2). Here the
>main operational issue, pointed out by Antonio, is that you need to have a
>way for the initiator to signal that he is requiring legacy
>authentication.
>
>So all we need is some feedback on the above operational issues, and then
>make a definitive decision about the right design/privacy trade-off.
>It should not put any delay on the closure of ikev2.

The working group co-chairs in combination with the document editor need to 
make a decision concerning the magnitude of the changes.  If it is the 
least bit onerous, then this should not be done.  It is not a requirement, 
and we are already overdue on delivery.

It is time to warp this effort up.  Fix anything that fails to meet the 
requirements that have already been set by the working group. then make the 
document internally consistent.  Additional stuff can be dealt with by a 
subsequent working group.

Ted got it right at the beginning of the meeting.  He said, "It is time to 
shoot the engineers and ship the product."

Russ