[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IVs and IDENTs
>I've been wondering if there isn't some way we could put in header
>compression in such instances -- after all, the two ends of the
>encrypting tunnel are effectively a point to point link.
Not really. Tunneled packets are susceptible to out of order delivery
or outright loss when they are carried over the Internet. VJ header
compression can tolerate a little of the latter, but it breaks
completely when it encounters the former.
And yes, you could tunnel across a TCP connection. But now that TCP
connection is vulnerable to all sorts of active attacks that we're
trying to guard against with IPSEC in the first place.
Phil
References: