[Ipsec] RE: draft-ietf-ipsec-esp-ah-algorithms-02.txt

Hi Donald,

@@@ I think draft-ietf-ipsec-esp-v3-09 should be changed.
I don't agree the draft draft-ietf-ipsec-esp-v3-09 should be changed.
The ESP document no longer requires the ESP only service to be there. As
Steve said, we should have change to SHOULD or even a MAY (conforming to
the ESP document). From the ESP document: -
            "
            - confidentiality-only (MAY be supported)
            - integrity-only (MUST be supported)
            - confidentiality and integrity (MUST be supported)"

@@@ I don't see why this document needs to list every algorithm/key-size
mentioned in any other IETF document. If there is consensus for
additional entries, I'd be happy to start a successor document.
I see no reason why we should not. Also if we do not want to keep
(MAY's) in the document, you may have to remove (NULL AUTH) from the
document altogether for ESP.

A very happy and fruitful new year to you!!

Thanks again,
Vishwas

-----Original Message-----
From: Eastlake III Donald-LDE008 [mailto:Donald.Eastlake@motorola.com] 
Sent: Thursday, December 30, 2004 8:33 PM
To: Vishwas Manral
Cc: ipsec@ietf.org
Subject: RE: draft-ietf-ipsec-esp-ah-algorithms-02.txt

See below at @@@

-----Original Message-----
From: Vishwas Manral [mailto:Vishwas@sinett.com] 
Sent: Thursday, December 30, 2004 1:14 AM
To: ipsec@ietf.org
Cc: Eastlake III Donald-LDE008
Subject: draft-ietf-ipsec-esp-ah-algorithms-02.txt

Hi Donald,

I have some minor comments: -

1. For ESP we state that "MUST    NULL"(must support NULL
authentication). However 
http://www.ietf.org/internet-drafts/draft-ietf-ipsec-esp-v3-09.txt very
clearly seems to state "However, this standard does not require ESP
implementations to offer an encryption-only service."

We may want to change the MUST to SHOULD. Steve?

@@@ I think draft-ietf-ipsec-esp-v3-09 should be changed.

2. A more general comment, what about all the algorithm's that are
specified by IETF but not in the document or a different key size, e.g.
"SHOULD+    AES-CBC with 128-bit keys" what about other key sizes. I
understand it is stated that: -
  "To ensure interoperability between disparate implementations it is
necessary to
   specify a set of mandatory-to-implement algorithms to ensure at least
one algorithm
   that all implementations will have available." however SHOULD's(I
guess not mandatory) are specified.

@@@ I don't see why this document needs to list every algorithm/key-size
mentioned in any other IETF document. If there is consensus for
additional entries, I'd be happy to start a successor document. The
document's MUSTs are the most important part and are a complete list of
what the IETF process has yielded as the mandatory-to-implement
algorithms. But I don't see what the problem is with the document
containing SHOULDs or other levels of implementation advice and hints as
to how that advice might change.

@@@ While the sentence you quote above is obviously true, that sentence
does not deny that there are recommendations other than
mandatory-to-implement in the document. Does every sentence in a
document have to include every nuance from all of the rest of the
material in a document?

Thanks,
Vishwas

@@@ Thanks,
@@@ Donald
 =========================================================
 Donald E. Eastlake III       Donald.Eastlake@Motorola.com
 Motorola Laboratories               1-508-786-7554 (work)
 111 Locke Drive                     1-508-634-2066 (home)
 Marlboro, MA 01752

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec