RE: FIPS-140 required?

[dan_york@xxxxxxxxx]

Dan,

Thanks for the reply.  You've addressed
my issue with this:

>   A solution SHOULD use algorithms that
allow FIPS 140-2
>   certification.

My point was that I didn't want to see
a MUST in there.  I didn't want to see the FIPS requirement used as
an excuse by any company as to why they could NOT use SRTP.  (i.e.
"We haven't implemented it because the work required to have a FIPS-compliant
algorithm is too much.")

However, I also further understand that
you are working on the requirements for the keying algorithm and I do agree...
any keying algorithm used for SRTP *should* allow for the potential of
FIPS 140-2 certification should the vendor/manufacturer wish to pursue
that for their implementation of SRTP.

Thanks,
Dan

-- 
Dan York, CISSP
Dir of IP Technology, Office of the CTO
Mitel Corp.     http://www.mitel.com
dan_york@xxxxxxxxx +1-613-592-2122
PGP key (F7E3C3B4) available for 
secure communication