Subject: Re: Position statement on IKE development

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 03 Aug 2001 17:45:05 -0400

> Let's hold an international design competition to select a key 
> management protocol for IPSec in a manner similar to how NIST did
> the AES selection (although I hope it takes less than 5 years).
> Once we get to a final 5, then let's cryptanalyze them and select
> the best one.  In this manner hopefully we can avoid a 2nd debacle.

the worst of IKE's problems are not in the cryptography.

Besides the general complexity of encoding, there's also the matter of
robustness in the face of retransmissions, as well as loss of peer
state.  Not to mention flash crowds and flooding attacks..

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 3 Aug 2001 23:01:44 -0700 (PDT)

> the best one.  In this manner hopefully we can avoid a 2nd debacle.

In practice, such a competition is being held every day in the offices of
customers. The problem is that the contenders are proprietary versions of
IKE (IKE's evil sisters), that there is no cryptanalysis available, and
that the decision criteria and selection are not openly discussed. 

I can state from experience that the "Cinderella IKE" that we now seek to
shelter rarely wins these private beauty contests against the evil
sisters. This is in part, because it is not a good match to customer
requirements such as the need for NAT friendliness and a viable
shared-secret authentication mode. 

It seems to me that unless we can find a "glass slipper" for Cinderella
IKE, that it will languish as the evil sisters grow stronger and more
popular. While we might not like this outcome, or feel that it is "right",
the evidence is to strong to ignore. Cinderella IKE just isn't being
invited to the ball.