RE: Moving PIC forwards

[Bernard Aboba <aboba@xxxxxxxxxxxxx>]

> fragmentation is obviously a serious issue. However, I'm worried that moving
> PIC to TCP could mean the death of this protocol, at least in the VPN space.
> Hardware VPN vendors don't trust TCP, because of the amount of state
> involved and the associated DOS exposure. And until PIC is "re-purposed",
> this is an important deployment segment.

OK. So what about a "cert continuation" payload? I'd note that PIC already
supports multiple round-trips, and EAP methods can already support such
continuations (see RFC 2716).