Subject: [mobile-ip] Re: [email-masked]: RE: mobile-ip] Re: mobile-ip] RFC2002bis]

From: Read Bell <[email-masked]>
Date: Mon, 20 Aug 2001 10:22:40 -0700

Hello,

I want to add my concerns about mandating the use of HMAC-MD5 to RFC2002bis.

I don't think the use of SHOULD for MD5 usage is strong enough. Please take 
a look at this from the customers' perspective. There are currently several 
large networks with almost 2 million subscribers using Mobile IP with MD5 
as specified in RFC2002. The fact that RFC2002 has been on the standards 
track for almost 5 years has resulted in production implementations 
requiring Mobile IP functionality based on non-standard specifications.

While I understand the desire to make the final specification for Mobile IP 
as complete and robust as possible, the existence of a large deployment of 
RFC2002 based systems requires inter-operability with RFC2002. Please 
consider making MD5 a MUST in the spec.

Thanks,
--Read