Subject: RE: suites vs. a la carte and IPcomp in IKEv2-05

From: "Jayant Shukla" <[email-masked]>
Date: Sun, 2 Mar 2003 07:37:44 -0800

> -----Original Message-----
> From: Andrew Krywaniuk [mailto:[email-masked]]
> Sent: Sunday, March 02, 2003 1:58 AM
> To: [email-masked]; [email-masked]
> Subject: RE: suites vs. a la carte and IPcomp in IKEv2-05
> 
> >Cipher suites are important if you want security according to your
> >needs/requirements and a la carte proposals are important for
interop.
> 
> Well actually I waws thinking pretty much the opposite. Cipher suites
are
> important for interop and a la carte proposals are important if you
want
> security according to your needs/requirements
> 

Never mind, it was my mistake! I swapped the two and ended up saying
exactly opposite of what I meant. It was getting late last night. :-)

Regards,
Jayant
www.trlokom.com 

> Andrew
> --------------------------------------
> The odd thing about fairness is when
> we strive so hard to be equitable
> that we forget to be correct.
> 
> 
> 
> 
> _________________________________________________________________
> Protect your PC - get McAfee.com VirusScan Online
> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Sun, 2 Mar 2003 09:16:24 -0800

Just a small point of clarification. The original proposal was for 
*UI* suites, not *GUI* suites. You don't need a dialog box to type in 
the number "12" (which could be one type of suite identifier) or to 
type in the name "Suite C".

Saying "GUI suites" makes it sound like you would have a bunch of 
radio buttons, check boxes, and drop-down lists, which is exactly 
what UI suites avoids. Maybe you have a single drop-down list with 
the supported suite numbers or names, but that's pretty much it.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Andrew Krywaniuk" <[email-masked]>
Date: Sun, 02 Mar 2003 04:57:37 -0500

>needs/requirements and a la carte proposals are important for interop.

Well actually I waws thinking pretty much the opposite. Cipher suites are 
important for interop and a la carte proposals are important if you want 
security according to your needs/requirements

Andrew

---

From: Henry Spencer <[email-masked]>
Date: Mon, 3 Mar 2003 12:01:14 -0500 (EST)

> security according to your needs/requirements

I think the missing word that explains this difference in outlook is
"standardized".  *In the absence* of *standardized* suites, flexibility is
important for successful interop.  However, clearly the right way to do
interop-with-the-world is to have a standardized suite, or at most a few
such suites, so everybody knows what to do to interoperate.

The current a la carte world has widespread interop capability mostly
because there is wide implicit agreement on one or two suites.  The IPsec
specifications themselves have far too much unnecessary flexibility and
provide far too little guidance about preferred choices.  (Back when I was
with the FreeS/WAN project, we made a first attempt at remedying this with
our "IKE Implementation Issues" informational-RFC draft, but the draft 
appears to have fallen down the crack caused by my departure.)

                                                          Henry Spencer
                                                       [email-masked]

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Mon, 3 Mar 2003 09:46:32 -0800

At 4:57 AM -0500 3/2/03, Andrew Krywaniuk wrote:
>Cipher suites are important for interop

Exactly.

>  and a la carte proposals are important if you want security 
>according to your needs/requirements

Note that a la carte is only needed if no suites cover your 
needs/requirements. If a reasonable set of suites is chosen, fewer 
than 5% of users would ever actually need a la carte.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Koning <[email-masked]>
Date: Mon, 3 Mar 2003 13:28:57 -0500

>>>>> "Andrew" == Andrew Krywaniuk <[email-masked]> writes:

 >> needs/requirements and a la carte proposals are important for

 Andrew> Well actually I waws thinking pretty much the
 Andrew> opposite. Cipher suites are important for interop and a la
 Andrew> carte proposals are important if you want security according
 Andrew> to your needs/requirements

Maybe, maybe not.  I once implemented IPsec for a router; it offered
suites at the UI level.  It came standard with 3 suites
(authentication only; auth + encrypt DES, auth + encrypt 3DES).  The
only reason it was 3 and not 2 is because of the mistaken insistence
in the existing specs that DES is required.  There was also an ability
to add suites; I don't think this was ever used by customers.  We told
them "use the auth + 3DES suite" and that was the end of the
discussion.

So I think a small number of suites, perhaps more than the number of
thumbs on your hand but fewer than your fingers, is ample for
"security according to your needs/requirements".  The standards have
WAY too much flexibility to no practical benefit.

	paul