[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Bruce Schneier on IPsec

> POP and IMAP servers are one place to apply IPSEC. Instead of having
> to create special SSLized POP/IMAP/etc clients, one could have
> machines running the servers require IPSEC for accessing the
> services. This is just another form of end-to-end application.

Unfortunately for IPSEC, this is an area where SSL has taken hold - it's fast becoming the perceived standard for secure connections. To be honest, I personally had always just seen IPSEC as something for VPN use. (ie: if you want everything encrypted, use IPSEC, if you want one or two occasional things encrypted, use SSL.)

> Actually HTTPS could also be similarly replaced with IPSEC + HTTP?
> 
> This way the client applications can be used unchanged, when the
> client host has IPSEC. The servers admin would also be its own CA, and
> thus having the full control of the certificates being used to access.

In this case (https) I see even less reason to switch to IPSEC. SSL has already become the standard for secure web communications, and comes build into Netscape and IE, and is supported by Apache-SSL and several commercial web servers. Why would anyone want to change it to IPSEC now?

--
Michael

Michael Owen
IT Security Engineer
NET-TEL Computer Systems Ltd
Michael.Owen@net-tel.co.uk
References: