Re: [saag] Additions to RFC 3631?

[Jeffrey Hutzelman <[e-mail]>]

On Fri, 2012-05-18 at 23:31 -0400, Mouse wrote:
> >    nor is it ever transmitted over the network.
> 
> Again, this depends on the OTP scheme; indeed, most OTP schemes I am
> aware of do indeed transmit the passwords used for authentication.

In fact, IMHO this has always been one of the main advantages of OTP
schemes -- passwords can be disclosed during authentication, because
they cannot be reused.


> > 3.3.  IPsec
> 
> >    The key management for IPsec can use either certificates or shared
> >    secrets.  For all the obvious reasons, certificates are preferred;
> >    however, they may present more of a headache for the system manager.
> 
> The statement that certificates "are preferred" is either false or
> incomplete, because certs are preferred only for certain classes of
> uses.  For others, a shared secret is better - different uses,
> different tradeoffs.

Agreed.  And in fact, the statement that certificates or preshared
secrets are the only available options is also false.  Last I checked,
it was also possible to use Kerberos (KINK, RFC4430) or any EAP method
(IKEv2, RFC5996).


-- Jeff