Re: Moving PIC forwards

["Scott G. Kelly" <skelly@xxxxxxxxxxxx>]

I agree with both points below. I think UDP should be a MUST, implying
that we need a cert continuation mechanism of some sort. I also think we
should make TCP a MAY, and reserve a port for it.

Scott

Bernard Aboba wrote:
> 
> > fragmentation is obviously a serious issue. However, I'm worried that moving
> > PIC to TCP could mean the death of this protocol, at least in the VPN space.
> > Hardware VPN vendors don't trust TCP, because of the amount of state
> > involved and the associated DOS exposure. And until PIC is "re-purposed",
> > this is an important deployment segment.
> 
> OK. So what about a "cert continuation" payload? I'd note that PIC already
> supports multiple round-trips, and EAP methods can already support such
> continuations (see RFC 2716).