Re: New extension: CRYPT target

[Michael Richardson <mcr@sandelman.ottawa.on.ca>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


>>>>> "Gervasio" == Gervasio Bernal <gervasiobernal@speedy.com.ar> writes:
    Gervasio> The idea behind CRYPT extension is not to replace IPSEC
    Gervasio> absolutely, but to be a simple alternative of use for
    Gervasio> encryption/decryption and packet authentication using
    Gervasio> Iptables. It could be useful for somebody.

  Tell me the threat model.

  Under what circumstances is it better than:
	a) IPsec with OE (with is dirty simple to configure)
	b) TLS/SSL LD_PRELOAD wrapper
	c) using SCP instead of FTP (or rsync over SSH)
	d) OpenVPN or SSH port forwarding
	e) HIP

    Gervasio> We have also developed a module in Python that use the
    Gervasio> CRYPT extension, configuration files, has automatic key
    Gervasio> management and user authentication using certificates. But
    Gervasio> we need that someone else can test first the extension
    Gervasio> alone, and comments its experience to us.

  Why in the world would you build such a complicated system? 
  You just told us that you wanted something simpler than IPsec.

  It seems like vanity crypto to me.

- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr@xelerance.com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

    "The Microsoft _Get the Facts CD_ does not work on Linux." - orospakr

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Finger me for keys

iQEVAwUBRHMJYICLcPvd0N1lAQIdDAf/bMGdfP6zIJ39lGgduUbfYmx7QEX5EwC7
4tK+Px3Lk4z8P1nowLyCLHUL11YXn6t+WfaPGc/Gp9jvVd0r1R0UXOSuiQ4b3bSy
kcdalGLMAe9XEusecIfEqdhHm+xu8311eGSN1Q2fJbajPy0D1w9dATSY51BWgKU6
0+Pm6YHTQzYOYZOMTzlx4BYZbanrpYXgS+klm3liE10VcB4JtOD4/w9D69kYEm6R
ajDacRC8Hjp068JeKEbr/DJegxBLf/Rkt/GepRoiwQea2kYN8/E8ZAMuYjqafL2b
S49KUwjIHVac+Gad9Y0MJquVvdp+QmST/o/JWcCVJoyLB1yL2znDMw==
=lCRN
-----END PGP SIGNATURE-----