Re: The remaining IKEv2 issues

[Uri Blumenthal <uri@lucent.com>]

On 8/21/2003 3:04 PM, Paul Hoffman / VPNC wrote:
>>If we are expecting that people are going to implement these methods and
>>customer are going to make use of these methods, I would much rather see
>>a standards-based way of doing so, and have this method be tested at
>>bakeoffs.
> 
> Fully agree.........
> Saying "'MUST NOT' or 'SHOULD NOT' do the things
> that your customers are demanding" is a really good way to cripple
> IKEv2 deployment.

Well yes, I agree too. What I don't understand if why we
cannot create kg methods using the same credentials? It
seems to be the only way to satisfy both the customers
who need to use devices like SecureID (hey, I'm one
of those), and the security requirements.

> One of the main goals of IKEv2 was to avoid re-creating
> the XAUTH fiasco.

Please educate me - I didn't keep track of XAUTH. Why did
it fail? What was wrong with it?

Thanks!