Re: is manual keying mandatory (fwd)

["Daniel C. Fox" <[e-mail]>]

>From a practical standpoint, Diffie-Hellman is extremely expensive in
lessor-powered CPU's, and in an environment where IP interfaces are
coming up and down in a dynamic environment (say PPP over demand-dial
ISDN lines), doing Diffie-Hellman again and again may be more taxing on
the CPU than Triple DES encryption on full throughput.

In such an environment, one can use a different KMP than ISAKMP/Oakley. 
But it would be beneficial to know that a completely inexpensive key
management system (manual keying) is universally supported in all IP
Security implementations.  My customers would then be able to make the
choice themselves whether to go with (relatively expensive) automated
keying or (relatively inexpensive) manual keying, regardless of the
IPSec-capable devices they were interfacing with.

For this reason, I feel it is necessary to keep manual keying support a
MUST.

-- 

Daniel C. Fox                  <[e-mail]>
Software Project Leader        Tel:  [phone]
Remote Access Server Division  Fax:  [phone]
Bay Networks, Inc.             <http://www.baynetworks.com>