Subject: uncomfortable with two MAY solutions for clients

From: [email-masked] (Sam Hartman)
Date: Tue, 3 Dec 2002 22:52:16 -0500 (EST)

I'm not comfortable with DH and DCE RFC 26 both being MAY for clients.

It seems that you're fairly likely to set a realm policy (or at least
want to set a realm policy) for which mechanism is used.  So if we
have two MAY for client preauth then you could get into a situation
where you don't have strong interoperability.

I think I'm considering two SHOULDs as a better option or a SHOULD and
MAY.

--Sam

---

From: Michael Thomas <[email-masked]>
Date: Wed, 4 Dec 2002 07:00:16 -0800 (PST)

> I think I'm considering two SHOULDs as a better option or a SHOULD and

   This seems pretty reasonable to me. Even for embedded
   devices, the footprint for DH alone is not very much
   (unlike, oh say, PKINIT which is rather large). It's
   really a security vs. performance issue at its heart.

	  Mike