Re: A problem with public key encrption in IKE

[Stephen Kent <kent@xxxxxxx>]

Francisco,

Whether a signature provides a basis for non-repudiation depends on 
the details of the generation process.  Note that in the case of 
IPsec, at most one might be able to prove that a peer initiated an 
SA, but the signature applied during the IKE exchange would not say 
anything about what data was sent on the SAs later.  So, while I like 
the use of signatures for IKE authentication, I would not argue too 
strongly for them based on any non-repudiation basis.

Steve