[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: transport-friendly ESP
In message <87vhhmb36d.fsf@jekyll.piermont.com>, "Perry E. Metzger" writes:
>
> Alex Alten <Alten@home.com> writes:
> > Thank you for your detailed analysis about why a block
> > cipher like DES will not work for a core router. It's a
> > bit like saying why a 2400 baud modem won't work either.
> >
> > Why can't we design, implement and verify a cipher that can
> > meet these constraints you point out in such detail?
>
> Security has to be end to end. You can't trust the operators of every
> router on the internet. There is NOT ANY POINT in designing such a
> thing, even if one could, and one can't.
Oh, it can and does exist, and it's useful in some contexts. But
it's then called link encryption, not network layer encryption,
and it has very different security properties. For most of the
threat models that ipsec is intended to deal with, link encryption
is quite useless.
Follow-Ups: