[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Bruce Schneier on IPsec
>I don't understand what the big fuss is about two modes. In my
>implementation the core IPSEC code implements only TRANSPORT MODE! The
>tunnel mode is achieved simply by slapping IP tunnel on a packet and
>THEN applying the transport mode transformation. Seems to work fine
>and is very simple.
Exactly. I could never figure it out either.
I read the Counterpane paper, and I strongly agreed with almost
everything they said. About the only exception was their proposal to
do away with transport mode, which is exactly opposite of what should
be done. As you say, tunnel mode should be eliminated in favor of
standard tunneling techniques (IP in IP, GRE, etc) before the packet
is handed to IPSec.
Their complaints about the extreme complexity of IPSEC really
resonated with me. I've watched the IPSec specifications grow
seemingly without bound or discipline in the 8 years since I held the
BoF in San Diego that led to the IPSec working group. Indeed, the most
important thing that can be done to the IPSec specs now is to go at
them with a meat cleaver, removing all the superflouous modes (e.g.,
AH) and whittling the remainder down to something that is both
implementable and analyzable from a security point of view.
Phil
Follow-Ups: