Subject: Re: 10 years and no ubiquitous security

From: "The Purple Streak (Hilarie Orman)" <[email-masked]>
Date: Fri, 15 Mar 2002 12:58:18 -0700

The IETF falls into comicbook mode as April 1 approaches.

Mild-mannered S. Kent is in reality SuperNoSecMan.  He adds
the essential anti-replay counter to IPsec protocols and, ...
causes people to NOT adopt them?  He is a superb document
editor and reviewer, and this makes security worse?  He has
demonstrated years of dedication to the IETF security area,
develops BGP security methods, and this is only fuel to
fire of his evil?  He has such power over time and space
that he alone creates security vacuums, causing 30 years
of computer and network security research and development
to be abandoned (except for this one tiny corner he
inexplicably missed in SSL).  There's not a single other
relevant factor in this whole story, only SuperNoSecMan
and his long shadow.  But for the fact that Bill Simpson
fancies himself a piece of kryptonite, Kent would reign
supreme.

Next week: Kent reverses HMAC by causing the earth to
rotate backwards.

Hilarie

---

From: William Allen Simpson <[email-masked]>
Date: Sat, 16 Mar 2002 20:17:32 -0500

"The Purple Streak (Hilarie Orman)" wrote:
> causes people to NOT adopt them? 

Actually, of course, Steve Kent did not add the counter.  It was in 
swIPe, from the beginning.  It was in my drafts, from the beginning.

It was certain members of the WG who insisted we didn't need the 
counter.  At least one has admitted he was wrong.  Are you ever going to 
admit you were?

Anyway, when we published the first set of RFCs, I carefully documented 
the need for a Replay Protection sequence number in 1995:
  "Internet Security Transform Enhancements"

This was in the old IETF tradition of posting minority positions when 
the main WG disagrees.

Perhaps you missed reading it?

-- 
William Allen Simpson
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32