Re: Position statement on IKE development

[Henry Spencer <henry@xxxxxxxxxxxxx>]

On Tue, 7 Aug 2001, Scott G. Kelly wrote:
> > 1. "Doesn't this require me to install root certs on all the clients, just
> > as if I were moving to PKI?"
> 
> All clients are required to have root certs (or access to some
> equivalent verification mechanism) if they are to use anything other
> than preshared keys for phase 1 authentication anyway...

We haven't found it so.  Of course, we have to explain to people over and
over again that using RSA public keys does not imply using certificates.
(Do certificates scale better than plain public keys?  Yeah, probably...
but either one is so superior to preshared secrets that the difference is
second-order for most users, and public keys are much simpler.)

                                                          Henry Spencer
                                                       henry@xxxxxxxxxxxxx