Subject: [IPsec] Some comments to the draft-sheffer-ipsecme-pake-criteria-00.txt

From: Tero Kivinen <[email-masked]>
Date: Mon, 22 Mar 2010 00:20:35 +0200

The document should list more of the engineering considerations too in
addition to the IPR and security. The Security requirement is
mandatory (how that is show is completely different matter). The IPR
issue would be nice to have. So I expect we end up looking other
properties too.

The other considerations section is quite short, and for example I do
not really care whether the protocol was specified in standards
document or scientific paper, as in any case we are going to make sure
our document describes the protocol in a way that alows
interoperability. Also in some cases the standards document are WAY
too hard to read to be able to provide interoperability... :-)

Also the second point of having protocol already integrated into IKE
does not really matter, as the only thing it does is to save us some
time. If the protocol is good and suitable to be integrated to IKE, I
do not really think we should leave it out just because someone has
not yet done the work to actually write the document telling how they
are integrated. This is the document we are going to be writing here
anyways. More suitable criteria would be to say it must be something
that can be easily integrated to the IKE.

I think this section should also include more concrete engineering
criteria lists, like:

  - Number of round trips
  - Cost of cryptographic processing
  - Does it share same cryptograhic blocks already used in IKE (I.e.
    it would be better to have protocol using MODP+SHA1, than some
    polynominal shares plush some hash function not used in IKE).
  - Does it share for example the Diffie-Hellman groups already used
    in the IKE.
  - Does it fit to the IKE PSK model (i.e for example it should not
    rely on trusted third party)

Most likely we are going to be using those engineering criteria to
select the final protocol, as I do not expect there be that much
difference (that we can agree on) on other security and IPR.
-- 
[email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 22 Mar 2010 01:06:52 +0200

Hi Tero,

thanks for your comments. Please note that some of them have already 
been addressed in -01, which at the moment is only available on 
http://trac.tools.ietf.org/wg/ipsecme/trac/wiki/TempDocs.

While not disputing the importance of the engineering criteria, I think 
there's quite a bit of differentiation between the various options on 
security and IPR.

Thanks,
	Yaron