[Ipsec] Key length attribute (was: Important changes in draft-hoffman-rfc3664bis; please review)

Pasi.Eronen@nokia.com writes:
> Yes, I think the intention was not to prohibit variable-length
> keys with e.g. Blowfish. Here's proposed text for the clarifications
> document:
> 
>    Section 3.3.5 says that "The only algorithms defined in this
>    document that accept attributes are the AES based encryption,
>    integrity, and pseudo-random functions, which require a single
>    attribute specifying key width."
> 
>    This is incorrect. The AES-based integrity and pseudo-random
>    functions defined in this document always use a 128-bit key.  In
>    fact, there are currently no integrity or PRF algorithms that use
>    the key length attribute (and we recommend that they should not
>    be defined in the future either).
> 
>    For encryption algorithms, the situation is slightly more complex
>    since there are three different types of algorithms:
> 
>    o  The key length attribute is never used with algorithms that 
>       use a fixed length key, such as DES, 3DES and IDEA.
>  
>    o  The key length attribute is always included for the currently
>       defined AES-based algorithms (CBC, CTR, CCM and GCM).  Omitting
>       the key length attribute is not allowed; if the proposal does
>       not contain it, it has to be rejected.
> 
>    o  For other algorithms, the key length attribute can be included
>       but is not mandatory. These algorithms include, e.g., RC5, CAST
>       and BLOWFISH.  If the key length attribute is not included, the 
>       default value specified in [RFC2451] is used.
> 
> Does this look right to you?

Looks perfect for me.
-- 
kivinen@safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec