Re: [IPsec] Updating IPsec algorithm requirements

[Paul Hoffman <paul.hoffman at vpnc.org>]

At 2:07 PM -0500 11/6/09, Paul Koning wrote:
>I agree.  For the reasons you gave, and also to remove the temptation
>to run AES-CTR without authentication for performance reasons, even
>though the standard says not to do this.

It is usually not temptation, but by mistake, aided by poor UI practice on the parts of >90% of VPN vendors. That is, I have found few vendors in the VPNC lab that *prevent* you from running with null authentication. Having a combined mode in the mix, particularly if it is the required algorithm, would reduce the prevalence of this kind of mistake.

--Paul Hoffman, Director
--VPN Consortium