Re: [IPsec] Comments to draft-corcoran-cnsa-ipsec-profile-05

2022-01-04 Thread RFC ISE (Adrian Farrel)
Thanks Tero, much appreciated. I will discuss this with the authors. It is sometimes the case that this type of document (i.e. an NSA profile), tightens the 2119 language from the referenced RFCs or removes options. The argument in the past has been that, while the base spec gives some degree of

Re: [IPsec] Comments to draft-corcoran-cnsa-ipsec-profile-05

2022-01-04 Thread RFC ISE (Adrian Farrel)
Resend with corrected email alias Adrian RFC ISE (Adrian Farrel) wrote: > Thanks Tero, much appreciated. > > I will discuss this with the authors. > > It is sometimes the case that this type of document (i.e. an NSA profile), > tightens the 2119 language from the referenced RFCs or removes option

Re: [IPsec] Comments to draft-corcoran-cnsa-ipsec-profile-05

2022-01-04 Thread Dan Harkins
  Hello,   I agree with Tero here. This "tightening" is not necessary. There's no security benefit by disallowing the RFC 7296 RECOMMENDED method of treating AEAD ciphers. The only thing this will do is require pointless changes to existing RFC 7296 compliant implementations.   regards,