Re: [IPsec] Matching certificates in IKEv2

2013-09-24 Thread Yoav Nir
Still might be worth a document proposing some profile, even if it does not match current practice. On Sep 24, 2013, at 9:12 PM, Yaron Sheffer wrote: > I'll defer to Paul on this one. > > Thanks, > Yaron > > On 09/24/2013 05:00 PM, Paul Hoffman wrote: >> >> >> On Sep 24, 2013, at 4:21

Re: [IPsec] Matching certificates in IKEv2

2013-09-24 Thread Yaron Sheffer
I'll defer to Paul on this one. Thanks, Yaron On 09/24/2013 05:00 PM, Paul Hoffman wrote: On Sep 24, 2013, at 4:21 AM, Tero Kivinen wrote: Yaron Sheffer writes: I just reread the introduction of RFC 4945 and I don't understand its purpose. So I'm not sure it should be referenced f

Re: [IPsec] Matching certificates in IKEv2

2013-09-24 Thread Paul Hoffman
On Sep 24, 2013, at 4:21 AM, Tero Kivinen wrote: > Yaron Sheffer writes: >> I just reread the introduction of RFC 4945 and I don't understand its >> purpose. So I'm not sure it should be referenced from 5996bis. > > Ok, if there is any disagreement about it, then I think it is better > to lea

Re: [IPsec] Matching certificates in IKEv2

2013-09-24 Thread Yoav Nir
On Sep 24, 2013, at 3:04 PM, Valery Smyslov wrote: >>> I just reread the introduction of RFC 4945 and I don't understand its >>> purpose. So I'm not sure it should be referenced from 5996bis. >> >> Ok, if there is any disagreement about it, then I think it is better >> to leave it out from 5996

Re: [IPsec] Matching certificates in IKEv2

2013-09-24 Thread Valery Smyslov
I just reread the introduction of RFC 4945 and I don't understand its purpose. So I'm not sure it should be referenced from 5996bis. Ok, if there is any disagreement about it, then I think it is better to leave it out from 5996bis. If we leave it out, than original Yoav's question "is there an

Re: [IPsec] Matching certificates in IKEv2

2013-09-24 Thread Tero Kivinen
Yaron Sheffer writes: > I just reread the introduction of RFC 4945 and I don't understand its > purpose. So I'm not sure it should be referenced from 5996bis. Ok, if there is any disagreement about it, then I think it is better to leave it out from 5996bis. > It is definitely not a "profile" in