[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: transport-friendly ESP

To: Alex Alten <Alten@home.com>, Steve Bellovin <smb@research.att.com>, ipsec@tis.com, end2end-interest@isi.edu, tsv@ee.lbl.gov, diff-serv@BayNetworks.COM, ecn-interest@research.att.com, red-impl@lbl.gov
Subject: Re: transport-friendly ESP
From: Frank Kastenholz <kasten@argon.com>
Date: Thu, 28 Jan 1999 08:52:07 -0500
Cc: jis@MIT.EDU, mleech@nortel.ca
In-Reply-To: <3.0.3.32.19990127200721.00b553e0@mail>
References: <199901280234.VAA03373@smb.research.att.com>
Sender: owner-ipsec@ex.tis.com

At 08:07 PM 1/27/99 -0800, Alex Alten wrote:

>Wouldn't
>it make more sense to let ESP secure per hop IP links?  

No, No, No, and I say again, No.
You don't want to have to distribute that keying information
to routers that you may not trust. You don't want to have high
speed-silicon-based-lifeforms in the core of the Internet have
to grok the latest-encryption-algorithm-du-jour, process
entire packets with said algorithm (including looking up
more stuff to determine _which_ key to use) and have to
be updated with new hardware every time a hyperadenoidal
teenager cracks the l.e.a.d.j. 

Frank Kastenholz
Silicon-Based-Lifeform-Foozler
Argon Networks

References:

transport-friendly ESP

From: Steve Bellovin <smb@research.att.com>

Re: transport-friendly ESP

From: Alex Alten <Alten@home.com>

Prev by Date: RE: New IPSec Monitoring MIB draft
Next by Date: Re: transport-friendly ESP
Prev by thread: Re: transport-friendly ESP
Next by thread: Re: transport-friendly ESP
Index(es):
- Main
- Thread