On 3/24/21 3:23 PM, Keith Moore wrote:
On 3/24/21 5:36 PM, Michael Thomas wrote:
IPsec certainly suffered this fate, though with filtering I'm not
sure if it would have the right security properties for tunnel mode.
Certainly had we used transport mode IPsec instead of SSL we wouldn't
be coming back 25 years later worried about the TCP checksum.
IMO IPsec was DOA because it didn't actually consider the needs of
applications.
Well there's no actual reason why IPsec needs to be run in the kernel
except for maybe some issues with IP protocol numbers (can't remember if
they could be exposed up at that time). Beyond that IPsec in transport
mode doesn't seem to be much different than TLS other than covering the
transport headers too. IKE v1 was messy, but IKE v2 fixed a bunch of
that though both could have worked for web stuff and they both run in
user land anyway.
Mike
