Re: Remaining open issues for RFC-2401bis

[Tero Kivinen <kivinen@iki.fi>]

Stephen Kent writes:
> I can't comment on what most vendors do in the 
> shared secret case for IPsec implementations. I 
> just cited my bad experience in a different but 
> equivalent context, and it was not good.

All of my bad experiences are because someone thought to be user
friendly and only created text input box where the password can be
written. It is extremly hard (or impossible) to write binary key
0x44f7ba0052dc29b4812d2e9b165b410d to that box, thus that laptop user
who have only text input box will not be able to use system at all.
Most of those who provided the hex-input also provided a way to type
the key in as string.

Thus, saying it is binary string, and you MUST offer way to put in any
binary string (up to certain length) works better, as it will always
offer interoperability (I agree it might not be that user friendly,
but that is something that the vendor can fix if they feel like making
it user friendly).
-- 
kivinen@safenet-inc.com