RE: Requirements for IKEv2 implementations

[Paul Hoffman / VPNC <paul.hoffman@vpnc.org>]

At 4:20 PM -0700 4/29/03, Gregory Lebovitz wrote:
>MY WG and Security Area member perspective:
>Certificates are good security and we should try as much as we can to help
>implementations adopt them.

That's what SHOULD is for. The current text says MUST.

>  Any worthwhile IKEv1 implementation today can
>handle certs.

Sorry, but that is just plain wrong. There are many "worthwhile" 
implementations that don't do certs. There are plenty of "worthwhile" 
implementations that do certs wrong, such as doing things with certs 
that the IKEv1 specs say they SHOULD NOT do.

>Market observer perspective:
>PKI has been a royal pain for many interested in IPsec VPNs. Just ask the
>PKI vendors. They have abandoned the application as a focus for their
>development, marketing and sales. At an absolute minimum, PSS is a MUST.

Exactly right. But there is no reason for two MUSTs for authentication.

--Paul Hoffman, Director
--VPN Consortium