Subject: [Ipsec] draft-ietf-ipsec-esp-ah-algorithms-02.txt

From: "Vishwas Manral" <[email-masked]>
Date: Wed, 29 Dec 2004 22:13:53 -0800

Hi Donald,
 
I have some minor comments: -
 
1. For ESP we state that "MUST    NULL"(must support NULL authentication). However 
http://www.ietf.org/internet-drafts/draft-ietf-ipsec-esp-v3-09.txt <http://www.ietf.org/internet-drafts/draft-ietf-ipsec-esp-v3-09.txt>  very clearly seems to state "However, this standard does not require ESP implementations to offer an encryption-only service."
 
We may want to change the MUST to SHOULD. Steve?
 
2. A more general comment, what about all the algorithm's that are specified by IETF but not in the document or a different key size, e.g. "SHOULD+    AES-CBC with 128-bit keys" what about other key sizes. I understand it is stated that: -
  "To ensure interoperability between disparate implementations it is necessary to
   specify a set of mandatory-to-implement algorithms to ensure at least one algorithm
   that all implementations will have available." however SHOULD's(I guess not mandatory) are specified.
 
Thanks,
Vishwas
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Thu, 30 Dec 2004 09:50:55 -0500

At 10:13 PM -0800 12/29/04, Vishwas Manral wrote:
>Content-class: urn:content-classes:message
>Content-Type: multipart/alternative;
>	boundary="----_=_NextPart_001_01C4EE36.BC7E3950"
>
>Hi Donald,
>
><http://www.ietf.org/internet-drafts/draft-ietf-ipsec-esp-v3-09.txt>http://www.ietf.org/internet-drafts/draft-ietf-ipsec-esp-v3-09.txt very 
>clearly seems to state "However, this standard does not require ESP 
>implementations to offer an encryption-only service."
>

Good point. since we changed the requirements for encryption-only 
support in this round of document revisions, I think a SHOULD here is 
correct.

Steve