Re: IPsec and RSVP

[Derek Atkins <derek@ihtfp.com>]

"Hannes Tschofenig" <Hannes.Tschofenig@mchp.siemens.de> writes:

> hi
> 
> what speaks against applying ipsec hop-by-hop (whereby a hop is a rsvp
> capable router)?

You lose the authentication of the end-point requesting the
reservation.  If you use ipsec in this way, then each router
knows its peer, but you have no transitive authentication.
The only protection you get is protection of on-the-wire
request.  You have no protection against a corrupt router
along the path, or indeed no way to know what the actual
original request was.

> ciao
> hannes

-derek

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       derek@ihtfp.com             www.ihtfp.com