[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Fw: IPSec vs. SSL




> SSL is dynamic wheras IPSec needs setup and maintenance.

Why?

Depends upon the implementation of the software, as to this setup and
maintenance requirement.





From: Henry Spencer <henry@spsystems.net> on 18/12/2000 20:21 EST

To:   Paul Heber <pheber@qantas.com.au>
cc:   ipsec@lists.tislabs.com
Subject:  Re: Fw: IPSec vs. SSL


On Tue, 19 Dec 2000, Paul Heber wrote:
>> I agree that n*n-1 gets troublesome if there needs to be explicit
>> per-tunnel management or configuration, but there is no fundamental
>> requirement for that.
>
> You are right there is no fundamental need unless the business requires
it.

I didn't say "unless the business requires it".  I said "no fundamental
requirement", and I meant it.  There is no reason why a human should have
to configure all those tunnels by hand, any more than he would have to
configure the corresponding set of TCP connections by hand.  Think
abstraction, mechanization, lazy evaluation:  say in general terms what is
permitted, and let the software set up the details as required, perhaps
only when needed.

(I'm not saying that current software *supports* this well yet, but that
can be fixed.)

> SSL is dynamic wheras IPSec needs setup and maintenance.

Why?

                                                          Henry Spencer
                                                       henry@spsystems.net