[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: transport-friendly ESP [hop-by-hop encryption ]
I've some difficulty in seeing what significant advantage would blind
hop-by-hop IPSEC encryption of transit traffic serve (co-operating
SG's are also end-to-end in a way). Without end-to-end IPSEC, an
eavesdropper would only need to find one weak router on the path to
break the security. So why waste resources for something that doesn't
provide much utility? Am I missing something?
However, I suppose every additional security does not hurt either, if
someone wants to assign the resources.
It would protect one link, but would anyone trust that their packets
always take a route where all hops are protected and routers secure?
If I have sensitive data, I would use end-to-end protection.
Of course, for connecting to the router box for maintenance and other
similar purposes, IPSEC is the right thing again.
(As to transport-friendly ESP, I feel kind of "violated" if some
random router peeks inside my packets, so I prefer ESP as is :-)
--
Markku Savela (msa@hemuli.tte.vtt.fi), Technical Research Centre of Finland
Multimedia Systems, P.O.Box 1203,FIN-02044 VTT,http://www.vtt.fi/tte/staff/msa/
References: