[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Granularity of authentication in swIPe
> I think the best approach is to let sequence numbers be
>sequence numbers, and not try to load other requirements on them. As
>you observed, different encryption algorithms and modes of use have
>different requirements for IVs and IPSP should be algorithm independent.
Steve, I think there may be some confusion about the meaning of an
"IV". Part of my problem is not knowing exactly how they work in
Skipjack implementations. But isn't it true that Skipjack itself is a
64-bit block cipher just like DES for which all the usual DES modes of
operation are usable, including CBC?
Seems to me that if I were so stupid as to actually want to use
Skipjack for IP packet encryption, I could program the chip to operate
in ECB mode and do my own cipher block chaining in software. In this case
the IPSEC sequence field automatically acts as an IV.
Now if my understanding is correct that it takes 50ms to initialize
the IV in a Capstone chip just so I can have it do CBC in hardware,
then I couldn't handle more than 20 packets per second, which is
pretty abysmal.
Phil
Follow-Ups:
References: