[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bellovin's attack and others like it
Perry, we have similar experience. I think if decison-making is done at IP
layer, then most likely there will be some layer mixing (i.e., IP looks at
the transport layer.). Our code uses UDP and it does not cause any difficulty.
I think this little layer mixing is a common practice on firewall/packet-filter
already.
Using a new transport procotol may be conceptually cleaner and make IPSP policy
simpler (no need for exemptions), though.
If we put key mgmt engine is the user space, then my feeling is that there
is no big difference in coding effort/complexity between the two approaches.
Regards, Pau-Chen
>
> "Avi Rubin" says:
> > It look like there are two approaches out there, using a UDP
> > port for key management, or having separate layers for key mgmt
> > vs. data packets.
> >
> > I'd like to see a constructive discussion of the tradeoffs using
> > each technique from Pau-Chen, Hilarie and others.
>
> I'd say that there isn't much of a good reason not to use a UDP
> port. I've heard arguments to the effect that this somehow causes
> layer mixing but my design doesn't seem to suffer when things are done
> this way.
>
> Perry
References: