RE: Security Use Requirements

[Michael Eisler <mre@zambeel.com>]

> My comment was not a veiled argument for no security but rather an open
> question.  I would wish to argue for only mandating authentication and
> integrity and make privacy an option.  If to follow NFS and use of GSS-API
> (http://www.ietf.org/rfc/rfc1961.txt) as mentioned by David Robinson, with
> recommend (Kerberos V5) (http://web.mit.edu/kerberos/www/) and Internet size
> security (Lipkey) (http://www.ietf.org/rfc/rfc2847.txt for authentication
> and integrity where perhaps just the dynamic portion of the PDU headers are
> encrypted as a type of checksum.  Privacy seems like an expensive
> proposition to make mandatory for the entire data payload.

Why not allow the customer to make the tradeoff between security and
performance?

	-mre