Re: [IPsec] RFC4869 bis submitted

[Paul Hoffman <[e-mail]>]

At 3:45 PM -0800 11/19/09, Bill Sommerfeld wrote:
>On Thu, 2009-11-19 at 15:08 -0800, Paul Hoffman wrote:
>> The text says:
>>   IKEv1 implementations MUST
>>   support pre-shared key authentication [RFC2409] for interoperability.
>>   The authentication method used with IKEv1 MUST be either pre-shared
>>   key [RFC2409] or ECDSA-256 [RFC4754].
>> To me, that sounds like preshared keys are just fine for IKEv1 in this
>> profile, but I might be misunderstanding what you mean by "usefully".
>
>I make a distinction between "optional to use" and "optional to
>implement".  There are many things which are optional to use but
>effectively mandatory to implement -- an implementation is not viewed as
>complete unless it allows the use of the option.

Given that this is IKEv1, where both parties must authenticate using the same authentication mechanism, I have assumed that this text means that ECDSA is not mandatory to implement in IKEv1 for this profile.

>As you pointed out earlier in this thread, this profile is an individual
>submission describing a particular organization's requirements.  I'm
>reluctant to guess or rely on the guess of someone who isn't part of
>this organization when the document itself could be clarified.

Given that this is a revision to an existing RFC, the authors may not know the words that would make this clear to you. Suggested wording for them?

>There is a large gap between "can deliver next week" and "impossible".

RFC 4869 was published more than a week ago. :-)

--Paul Hoffman, Director
--VPN Consortium