Subject: [anonsec] details of IKE/IPsec channel binding

From: mcr at sandelman.ottawa.on.ca (Michael Richardson)
Date: Sun, 01 Apr 2007 17:41:48 -0400

>>>>> "Francis" == Francis Dupont <Francis.Dupont at fdupont.fr> writes:
    Francis> => what about to use the INTEG (integrity algorithm) in
    Francis> place of the PRF (pseudo-random function) with the same
    Francis> arguments?  (IMHO this is more appropriate to the intended
    Francis> usage.)

  If I understand you, that's a phase 2/CHILD-SA thing that is
negotiated, and perhaps not every phase 2 has an integrity algorithm.
  It might also be that the negotiated phase 2 algorithm is only
implemented/available in a line card the implements the phase 2, and has
no software implementation in the "host".
  (Consider some kind of patented algorithm)

- -- 
]            Bear: "Me, I'm just the shape of a bear."          |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr at xelerance.com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [