Response to China NB ballot comment on the 802.1AEcg 60-day pre-ballot: Comment: 1. The default cryptographic algorithm of the standard is AES (chapter 14), however, policy and regulation limitations on application of cryptographic algorithm differ from countries and regions. Therefore, it is improper to specify AES algorithm as the default one. It is recommended to clearly state that AES is an example for cryptographic algorithms, so that countries and regions may replace it with a similar and regulation-compliant algorithm during implementation. Response: It is still believed that the goal of maximum interoperability is very important, and specification of a default Cipher Suite is an important part of meeting that goal. The selection of GCM-AES-128 was based on its applicability across the entire range of applicability of 802.1AE. It was not within the scope of the 802.1AEcg project to change the Cipher Suites, and no such changes were made. However 802.1AE was explicitly designed to accomodate advances in cryptography. Additions to the Cipher Suites can be made through the established IEEE amendment process. Comment: 2. The hop-by-hop encryption mechanism specified in the standard has the issues of high-delay and high calculating cost, etc., especially between nodes that require multi hops to accomplish communication. Response: The encryption mechanism used is fully capable of being implemented in 802.3 interface chips (and chips providing a similar transmission capability for other media), and this is in practice how it is done. This requires no additional bandwidth on main system memory and is generally done in a pipelined fashion with a few minimum packet size delays in the pipeline. At the relevant speeds this is equivalent to a very modest increase in the length of the attached physical medium (wire, fiber or other) and has been available in multiple commercial implementations at full wire speed for over a decade. This point has been made in response to prior comments. However it should be noted that the 802.1AEcg, the amendment that is the subject of this ballot, specifically provides for the use of a single encryption protection/verification operation to protect a frame in transit over an entire provider network, a multi-hop scenario.