> There is at 
>least an alternative proposal, submitted by Joe Touch (which I have not 
>read, though).
>You can find Joe's draft at: 
>http://www.isi.edu/touch/pubs/draft-touch-anonsec-00.txt
>You should be able to find it in the drafts directory, too.
>
>...
>
>BTW, I have read there's a different fix to this vulnerability, which was 
>designed/implemented by the OpenBSD guys. Does anyone have any pointers to it?
>

A very important reminder:  until we know what is in the Cisco patent 
application -- I've seen no pointers to that informatio -- we don't 
know precisely what it covers.  It's well within the realm of 
possibility that it covers the Touch draft and the OpenBSD solutions as 
well.  We just don't know.  (Considerations like this, especially as 
they involve IPR belonging to non-IETF participants, were a major 
reason the IETF declined to insist on unencumbered technology: you 
*can't* know what's unencumbered.)

		--Steve Bellovin, http://www.research.att.com/~smb