From: Erland Sommarskog (sommar-usefor@algonet.se)
Date: Tue Aug 29 2000 - 16:48:10 CDT
Russ Allbery <rra@stanford.edu> writes:
> At this stage, I'd tend strongly that direction myself, although it would
> be difficult to word the draft in such a way as to make it clear that
> authentication is vital but will be added later. :/
If we go for the two-step process, I don't see why authentication would
be mentioned in our first RFC at all. Of course we would mention it
when we present to the public and explain our strategy.
And I have no problem explaining with a straight face that there is so
much work left with authentication that it will have to wait until later.
We could however leak Charles's draft as a experimental RFC or some such,
in hope that someone will make attempts to implement it - or some other
scheme. Because we can't just mandate a scheme with such far-reaching
consequences only by swimming on dry land, can we?
-- Erland Sommarskog, Stockholm, sommar@algonet.se