|
![](/i/fill.gif) |
Orchid XP v8 wrote:
>>> The document claims this is because "IPSec is too complicated to be
>>> secure", and that "TSL is mature and battle-tested".
>>
>> I like how they make this assertion, then later on say "you might need
>> the load balancing that IPsec does, but you can get that with OpenVPN
>> by running this other complicated program on a spare machine." It
>> sounds like a lot of the complication is stuff that OpenVPN basically
>> leaves out.
>
> Well, is that a protocol feature or a software feature?
I'm saying that they mock IPsec for solving problems *they* don't have,
because it was "designed by a committee". I suspect the people on the
"committee" actually *did* have those problems, so incorporated
solutions to them into the standard, instead of making everyone solve it
themselves with ad hoc solutions consisting of interacting layers which
could easily introduce a security hole if you don't know what you're doing.
> I was more amused by the statement that key size has any relationship to
> complexity class.
Yes, I understood the WTF. :-) Of course, if it's running over TLS, you
can put whatever cipher both sides agree on in there.
And actually, key size *can* have a relationship to complexity class,
perhaps. If you can pre-compute something that lets you look up in
polynomial time the key that someone is using, except that the key is
too long to store the precomputed somethings for every key, I can see
where that can happen. (Technically, the same complexity class, but in
practice, you can break something in polynomial time if you discount the
precomputation, perhaps.)
But yeah, the whole discussion was full of WTFs like that. Plus, they
say basically "IPSec is too complicated to deploy, OpenVPN does the same
thing only its easy to deploy", without giving any evidence at all of
either. Most of the paper is a description of SSL, and I'm pretty sure
there aren't fundamental security problems with IPSec that aren't in SSL.
(And apparently the authors don't know that actual difference between
SSL and TLS. Hint: OpenVPN seems to use SSL.)
--
Darren New / San Diego, CA, USA (PST)
Helpful housekeeping hints:
Check your feather pillows for holes
before putting them in the washing machine.
Post a reply to this message
|
![](/i/fill.gif) |