Re: [IPsec] Avoiding Authentication Header (AH)

[Nico Williams <[e-mail]>]

On Tue, Jan 3, 2012 at 9:02 PM, Jack Kohn <[e-mail]> wrote:
>> Unfortunately, the IETF has long-standing challenges with
>> getting users/operators, especially enterprise/academic/
>> government users, to participate in its WGs.
>
> The problem is not this.
>
> The problem is that a few loud people (in some occasions, just one)
> can filibuster good ideas over long held antiquated views on how
> technology is (or should be) used. In a few cases, its got little to
> do with the technology really ..

Advising (and updating said advice as circumstances change) use-IPsec
protocol designers as to when to use ESP and/or AH is something we
should do.  Deprecating AH seems like a nice idea, but if there's good
reasons to still use it, then maybe not.

In 2012 the use of manually keyed unicast SAs with group shared keys
is not exactly impressive (because not scalable).  We could reach
consensus to ignore such usage of IPsec.  Or not -- hardly a big deal
if not, eh?

Nico
--