Subject: Re: Results of protocol straw poll

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 07 May 2001 11:48:36 -0400

In message <[email-masked]>, "Scott Fanning" writes:
>I thought IKE (ISAKMP) was a framework?
>
>>From RFC 2408
>
>  "ISAKMP is designed to provide a
>   flexible and extensible framework for establishing and managing
>   Security Associations and cryptographic keys.  The framework provided
>   by ISAKMP consists of header and payload definitions, exchange types
>   for guiding message and payload exchanges, and general processing
>   guidelines.  ISAKMP does not define the mechanisms that will be used
>   to establish and manage Security Associations and cryptographic keys
>   in an authenticated and confidential manner.  The definition of
>   mechanisms and their application is the purview of individual Domains
>   of Interpretation (DOIs)."
>
>Notice the word "extensible".
>
Of course, even back in the days of the Photuris/SKIP/ISAKMP stand-off 
(and before Oakley) there were those who warned of the complexity of 
ISAKMP.  I was one of them; I was hardly the only one.

Should IKE/ISAKMP have become an RFC?  That's water over the dam at 
this point; we have it.  The question is what to do now.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: "Scott Fanning" <[email-masked]>
Date: Mon, 7 May 2001 10:42:16 -0700

Well, I would be interested in seeing the Son-of-IKE progress. I think there
has been many lessons learned. If there is some forum we could all
brainstorm some of the issues we have had with IKE (Maybe some sort of IETF
IPSec WG sub-committee), and work together, then I think that would be the
way to go.

Scott
----- Original Message -----
From: "Steven M. Bellovin" <[email-masked]>
To: "Scott Fanning" <[email-masked]>
Cc: "Mason, David" <[email-masked]>; "'Ari Huttunen'"
<[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Monday, May 07, 2001 8:48 AM
Subject: Re: Results of protocol straw poll