Re: [Cfrg] Re: [saag] Algorithm upgrades

[Jari Arkko <jari.arkko at piuha.net>]

Eric Rescorla wrote:

> > Statements like "not really noticeable" and "work well operationally"
> > are absurdly out of touch with typical IPsec VPN users. Even the best
> > UIs for gateways force low-ability admins and lower-ability end users
> > to make multiple selections of things that they don't (and shouldn't
> > need to!) understand.
>
> Maybe so, but why blame algorithm negotiation for this? Both SSH 
> and TLS have algorithm negotiation and in practice noone even
> notices. 

I agree that the algorithm negotiation is not the reason.
If you look at the difference between the SSL and IPsec
models, I think the difficulties come from two areas:

o  Separation of the application and the security layer. In
   SSL, applications are in direct control of the security
   layer and the configuration of the security layer also
   goes through the application's user interface. Given
   that the application knows its security requirements
   and its traffic flows, it knows what traffic needs to
   be protected and how. So you can skip, for instance,
   port number and address pattern specifications. Personally,
   I like entering IPv6 addresses in hex to configuration
   files, but I'm not quite sure most people on the planet
   agree with me.

o  Harder requirements. For instance, IPsec applications
   typically require all parties to be provisioned with
   keys and configuration, whereas in SSL some applications
   work with just server-side keys.

--Jari


_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg