What in practice, for an implementer and/or his marketing manager, is the difference between "MAY" for algorithm and not listing it at all?
I would understand if we had "MAY+", but really, that is what "SHOULD" means. Could there implications on UIs, such that things listed SHOULD/MUST are listed in the first page, things listed MAY are on the "Advanced options" page, and whatever country-specific vanity ciphers that might get included are under some even more obscure button. Or is the intent of MAY to give a clue to cryptoanalysis people as to what things to focus on? Or for people GREP'ing the RFC archives as a result of an attack will come up with IPsec as a user/ -- Michael Richardson -on the road- _______________________________________________ IPsec mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipsec
