RE: is manual keying mandatory

bede@mitre.org (Bede McCall) Mon, 23 March 1998 22:28 UTC

Received: (from majordom@localhost) by portal.ex.tis.com (8.8.2/8.8.2) id RAA26555 for ipsec-outgoing; Mon, 23 Mar 1998 17:28:22 -0500 (EST)
Date: Mon, 23 Mar 1998 17:42:01 -0500
From: bede@mitre.org
Message-Id: <199803232242.RAA19845@zorch.mitre.org>
To: sned@cisco.com
CC: tytso@MIT.EDU, ipsec@tis.com
In-reply-to: <2.2.32.19980323193903.006e5768@trix.cisco.com> (message from Steve Sneddon on Mon, 23 Mar 1998 11:39:03 -0800)
Subject: RE: is manual keying mandatory
Sender: owner-ipsec@ex.tis.com
Precedence: bulk

Maybe I'm missing something, but I can't understand the reason for
such dogged insistence on eliminating manual keying as a "MUST" at
this late date.  The specs don't mandate that manual keying be the
only kind of keying, and it's a given that manual keying won't scale
(a scalable manual keying implementation never having been part of the
mandate in any case :-).

Given that manual keying is perhaps the simplest and first part of the
specs to be implemented by most companies, I can't imagine how it
could require any extra effort to code or support in fielded products.
You'll undoubtedly want to discourage its use in fielded products
outside of a small number of cases (e.g., for debugging or very small
collections of hosts) which reduces your product support obligation
for manual keying to a little extra ink on paper --- if even that
much, assuming your documentation is online.

Lastly, merely stating that there is a cogent case for not requiring
such a basic feature is a far cry from presenting a cogent case ---
and in any event this case, cogent or otherwise, should have been
presented long ago.  At this point, this issue with manual keying is
just a red herring.

-- 
  Bede McCall   <bede@mitre.org>
  The MITRE Corporation                    Tel: (781) 271-2839
  202 Burlington Road                      FAX: (781) 271-2423
  Bedford, Massachusetts  01730-1420