RE: Reminder: last call for PIC in the IPSRA WG

[Bernard Aboba <aboba@xxxxxxxxxxxxx>]

> Regarding fragmentation, I share your concern. It is an issue for PIC, just
> as it is for IKE. As an anecdote, *TCP* port 500 is reserved for ISAKMP.
> Maybe that's the way to go...
> 

The IKE fragmentation problem is in practice a *major* issue -- because
long cert chains cause IKE to frag and most routers can't properly filter
the frags. 

The reason that this hasn't gotten more visiblity is that the vast
majority of IPsec implementations use shared secrets. But of course, the
whole point of PIC is to enable cert enrollment, so we cannot avoid it. 

For my two cents, I believe that PIC should run over TCP by default.