Subject: KINK draft wrap-up

From: Derek Atkins <[email-masked]>
Date: 11 Feb 2002 17:48:14 -0500

Sorry for the (extremely) late wrapup.  There were very few comments
about the KINK draft during WG last call, and all of them said "let's
move forward".

The only thing that I noticed personally in a final reading is that
the draft does not discuss a reachability test before actually
processing the AP_REQ (Create) message.  I don't recall if we decided
that we don't need one, of this was an oversight.  Mike?

Other than that issue, I think we're ready to move forward.  Mike,
what's your plan with regards to reachability?

-derek
-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: Michael Thomas <[email-masked]>
Date: Fri, 15 Feb 2002 13:50:04 -0800 (PST)

> that we don't need one, of this was an oversight.  Mike?

   No, I don't think we need one. The reason is because
   the ap-req is directly verifiable and thus state is
   not installed unless it authenticates correctly. This
   is in contrast to IKE which needs to create state 
   before the cert exchange happens which can lead to
   a DoS attack via expensive DH exponentiation from
   an unauthenticated initiator.

      Mike

---

From: Derek Atkins <[email-masked]>
Date: 15 Feb 2002 17:05:24 -0500

Ok..  I suppose people don't think that a DES/3DES decrypt is high
overhead.

In that case, I'll contact Marcus and ask to move KINK to IETF
last-call.

-derek