Re: Do ipsec vendors care about privacy?

[Derek Atkins <derek@ihtfp.com>]

Antonio Forzieri <antonio.forzieri@cefriel.it> writes:

> It disappoints me too.
> 
> I think that we have to ask to ourselves what price we can pay to
> obtain IDi protection.

Remember that IPsec is a peer-to-peer protocol and can always be
reversed.  So the 'client' of one protocol can be turned into the
'server' in another context.  The protection we're talking about here
is against _ACTIVE_ attacks -- we're already protected against passive
attacks.

The concern is that an attacker sees an IKE connection from 1.2.3.4
and wants to figure out who 1.2.3.4 is, so they initiate an IKE to
1.2.3.4 (they can't just watch the existing session -- IKE is
protected against passive eavesdropping).  If the responder just gives
up it's identity, then you've just lost!

-derek

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       derek@ihtfp.com             www.ihtfp.com