Re: Any other security other than IPSec?

On 8/4/2003 8:25 PM, Tan, Tat Kin wrote:
>> IPsec provides two things:
>> 
>> 1. Establishes session keys for the traffic.
>> 2. Authenticates and/or encrypts every traffic packet.
>> 
>> First - what makes you think that performance on a per-packet basis
>> will suffer by "a huge factor"? Do you have any numbers...?
> 
> Correct me if i m wrong, that IPSec is more like a combination of
> encryptions methods

OK, correcting.

IPsec consists of two parts.

Part One - ascertaining that the other party is who it claims it is,
and then agreeing upon what (if any) authentication and encryption
algorithm will be used. And deriving the keys for them.

Part Two - encrypting and/or authenticating the actual IP traffic.

> and both parties that wants to use IPSec
> will have to talk to each other to negotiate a set or a few and
> depends on the priority.

The parties don't HAVE to negotiate - it can be preconfigured,
or simply forced by the security policy at both ends. They CAN
negotiate, if it's allowed. In the end there's only one crypto
algorithm for each crypto function.

Anything wrong with the ABILITY to negotiate?

>  Every MN/CN would have different IPSec's combinations.

First - there are only a few possible algorithms to choose from.
Second - it is up to the administrator to allow all of them, one
of them or none of them. How is it a problem?

> Would that be extra overhead to process?

In what sense? An extra overhead to negotiate what algorithms to
use? Not really - done ONCE in the beginning of the session. A
couple of extra packets to cross the wire. Peanuts.

>  would there be other alternative solution?

Like what? You can either negotiate what algorithm to use, or
pre-configure (force) the algorithm.  What other alternatives
can there possibly be?!

>> Second - if you abolish IPsec but decide you still need security,
>> you will have to perform both of the above steps. Please tell me
>> what makes you think that doing those things by other-than-IPsec
>> tool is any faster or easier on performance. (A hint: crypto
>> operations are the same, crypto algorithms are the same.)
> 
> Again alternative solution might be available.

Alternative in what sense? Are you planning to perform encryption
and/or authentication on a per-packet basis, or not? If you are,
then there's no reason to expect that you can do it with fewer
expenses than IPsec.  If you do have reasons to expect better
performance from "alternative" crypto - please share those
reasons with us here and now.

> one question everyone is interested in knowing is that, will
> the alternative solution provide better security system or
> worst?

Considering the security expertise of those who seem to be
searching for an "alternative solution" I don't expect it
to be better. Not to mention that you don't seem to offer
a clue regarding what component(s) of IPsec you're seeking
an alternative for. What do you want to change and why?


> I will let you know when i have a solution. Hint : They all
> laugh at christopher columbus when he says the world is round ...
> :)

Excessive modesty doesn't seem to be the problem here. :-)

Anyway, reinventing the wheel is much more common in the
history of science than successful circumnavigation, and
people laugh at it [the re-invented wheel] much harder.