Re: speaking of keys

[Derrell Piper <ddp@electric-loft.org>]

On Thursday, December 12, 2002, at 06:25 PM, Bob Doud wrote:

> Excellent suggestion.  I agree.
>
> Bob

So do I.  Require support for 1024, 1536, and 2048.  And forbid 
anything less than 1024.  This gives us maximal interoperability and 
good security when you want to pay the price.

Derrell

> Paul Hoffman / VPNC writes:
>>
>> Whatever we put for MUST will be the default for the UIs. Over half
>> of the VPN boxes in our interop lab, all of which shipped this year,
>> default to DES and MD5, not because any of the manufacturers think
>> those are good ideas, but because those are the MUSTs in IKEv1.
>>
>> If we pick too big of a single MUST, we will make IKEv2 look slow.
>>
>> It sounds like most people who want a large value for MUST mean that
>> they want to guarantee that large values can be used interoperably by
>> people who can afford the CPU and/or accelerator time. To do that, we
>> could say "MUST support key sizes of 1024, 1536, and 2048." That gets
>> us the guarantee of interop, and forces the manufacturers to actually
>> think about what they want their default values to be.
>>
>> --Paul Hoffman, Director
>> --VPN Consortium
>>