Subject: [Ipsec] draft-solinas-ui-suites-00.txt

From: Russ Housley <[email-masked]>
Date: Fri, 08 Dec 2006 15:30:21 -0500

The members of this mail list will probably find this new 
Internet-Draft interesting.

http://www.ietf.org/internet-drafts/draft-solinas-ui-suites-00.txt

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Sun, 17 Dec 2006 10:32:41 +0200

I think that in RFC 4308 they intentionally used names that do not  
name specific algorithms. This is for having a uniform name across  
VPN devices and to allow users with no background in cryptography  
(and those who don't read the IPsec list) to configure VPN devices  
without confusing terms.  That's why the names defined there are VPN- 
A and VPN-B.

I suggest that "Suite-B-GCM-128" goes against that.  I think better  
names would be VPN-C, VPN-D etc.

If it's really important to include the SuiteB name, I'd still go  
with SuiteB-1, SuiteB-2 etc.

On Dec 8, 2006, at 10:30 PM, Russ Housley wrote:

> The members of this mail list will probably find this new Internet- 
> Draft interesting.
>

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 17 Dec 2006 08:59:31 -0800

At 10:32 AM +0200 12/17/06, Yoav Nir wrote:
>without confusing terms.  That's why the names defined there are 
>VPN-A and VPN-B.
>

I disagree here. The names are not important as long as there is no 
obvious clash. As the draft shows, the name "Suite B" is already in 
widespread use within the community of interest, as well as with 
IPsec vendors who want to participate in that community in the future.

>with SuiteB-1, SuiteB-2 etc.

I disagree again. It is up to the community to decide how much or 
little specificity should be included in the names. When we came up 
with VPN-A and VPN-B, that's what the general IPsec population of the 
time wanted, although we could have chosen VPN-TripleDES and 
VPN-AES12 or somesuch.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Mon, 18 Dec 2006 10:25:54 +0200

If that were true, than VPN-A and VPN-B would be called VPN-3DES and  
VPN-AES.

These names are not for the "community", they're for people who buy  
and install VPN devices. I think only a small fraction of these has  
ever heard of Suite B.

On Dec 17, 2006, at 6:59 PM, Paul Hoffman wrote:

>> I suggest that "Suite-B-GCM-128" goes against that.  I think  
>> better names would be VPN-C, VPN-D etc.
>
> with VPN-A and VPN-B, that's what the general IPsec population of  
> the time wanted, although we could have chosen VPN-TripleDES and  
> VPN-AES12 or somesuch.
>
> --Paul Hoffman, Director
> --VPN Consortium
>

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 18 Dec 2006 14:16:18 +0200

> and install VPN devices. I think only a small fraction of these has  

And half of those who had heard about the Suite B probably belives it
is same thing than VPN-B UI suite. 
-- 
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 18 Dec 2006 06:41:40 -0800

At 10:25 AM +0200 12/18/06, Yoav Nir wrote:
>If that were true, than VPN-A and VPN-B would be called VPN-3DES and VPN-AES.

That was discussed. However, people preferred VPN-A and VPN-B. If you 
feel strongly about this, feel free to create a new document with 
those names.

>and install VPN devices. I think only a small fraction of these has 

Fully agree. But it is not expected that the new algorithms will be 
installed in all devices, only in those who care about using these 
algorithms. Thus, it seems sensible to let those people choose its 
names.

>is same thing than VPN-B UI suite.

All the more reason to make these new names as explicit as possible.

Before we get upset about the new names, please understand that there 
has been almost no uptake on the current VPN-A and VPN-B names 
(including from either Yoav's or Tero's companies, I believe). The 
idea of UI suites is still sound, but it is not like we can say how 
any changes will affect users, given that virtually no users have 
seen the current suites in use.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Tue, 19 Dec 2006 09:43:54 +0200

On Dec 18, 2006, at 4:41 PM, Paul Hoffman wrote:
<snip>
>
> Before we get upset about the new names, please understand that  
> there has been almost no uptake on the current VPN-A and VPN-B  
> names (including from either Yoav's or Tero's companies, I  
> believe). The idea of UI suites is still sound, but it is not like  
> we can say how any changes will affect users, given that virtually  
> no users have seen the current suites in use.

Actually, we do use them in our GUI. and the following is one ugly,  
inconsistent UI:

+------------------------------------+
| Choose cryptographic suite:        |
|   o VPN-A                          |
|   o VPN-B                          |
|   o Suite-B-GCM-128                |
|   o Suite-B-GCM-256                |
|   o Custom            |Define...|  |
+------------------------------------+