Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

A very real use case is OSPFv3 authentication (RFC 4552), all major router vendor supports OSPFv3 implement that, and it is deployed around world;
Plus I don't see any realistic alternative for the use case

> -----Original Message-----
> From: IPsec [mailto:ipsec-bounces@ietf.org] On Behalf Of
> Paul.Koning@dell.com
> Sent: Thursday, March 23, 2017 6:05 AM
> To: kivinen@iki.fi
> Cc: draft-ietf-ipsecme-rfc7321bis@ietf.org; ben@nostrum.com; ipsecme-
> chairs@ietf.org; ipsec@ietf.org; iesg@ietf.org; paul@nohats.ca;
> david.waltermire@nist.gov
> Subject: Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05:
> (with COMMENT)
> 
> 
> > On Mar 23, 2017, at 5:37 AM, Tero Kivinen <kivinen@iki.fi> wrote:
> >
> > Paul Wouters writes:
> >>> -3: I wonder why "... is not to be used..." is not "... MUST NOT be
> >>> used...". But the section goes on to say if you do it anyway, you
> >>> MUST NOT use certain cryptosuites. So, does "... is not to be
> >>> used..." mean "SHOULD NOT"? Or is this one of those "MUST NOT BUT WE
> KNOW YOU WILL"
> >>> sort of requirements?
> >>
> >> It is indeed. I think a SHOULD NOT would actually be appropriate ?
> >
> > We do not want to make the implementation of the manual keying MUST
> > NOT, as it is still useful in testing and similar situations, but we
> > do not want anybody using it in any real world use cases. As this
> > document is mostly about the implementation and tries to stay out from
> > the issues about what should be used (as explained in the 2nd
> > paragraph of the section 1.3).
> 
> The problem is that currently USGv6 mandates support for manual keying
> based on earlier RFC text.  I wonder if the proposed text is strong enough to
> make them understand this is wrong.  This is why I was pushing for MUST NOT.
> 
> Exotic test scenarios aren't all that good an argument, for those you can hack
> the code and ignore the RFC.
> 
> 	paul
> 
> _______________________________________________
> IPsec mailing list
> IPsec@ietf.org
> https://www.ietf.org/mailman/listinfo/ipsec