Re: New extension: CRYPT target

[Gervasio Bernal <gervasiobernal@speedy.com.ar>]

Michael Richardson wrote:
> 
> 
>>>>>>>"Gervasio" == Gervasio Bernal <gervasiobernal@speedy.com.ar> writes:
> 
>     Gervasio> Carl-Daniel Hailfinger wrote:
>     >> Gervasio Bernal wrote:
>     >> 
>     >>> (on host A, 1.2.3.4, FTP client) # iptables -t mangle -A
>     >>> POSTROUTING -d 1.2.3.5 -p tcp --dport 20:21 -j CRYPT --cipher
>     >>> blowfish --key topsecret --mode ecb --direction encrypt
>     >> 
>     >> 
>     >> Ouch. If anybody runs ps while this iptables command is running,
>     >> he has your top secret key.
>     >> 
>     >> Does this provide any benefit over IPSEC?
>     Gervasio> IPSEC/OpenSwan is complicated to use and quite heavy.
>   
>   Have you tried?
>   It is not heavy. Your solution is generally rather incomplete, since
> it seems to lack any configuration file, policy system, or automatic key
> management. 

The idea behind CRYPT extension is not to replace IPSEC absolutely, but
to be a simple alternative of use for encryption/decryption and packet
authentication using Iptables. It could be useful for somebody.

We have also developed a module in Python that use the CRYPT extension,
configuration files, has automatic key management and user
authentication using certificates. But we need that someone else can
test first the extension alone, and comments its experience to us.

> 
>   It is only complicated if you have been mislead into assuming that you
> need a certificate. (ipsec-tools' racoon is guilty in that regard)
> 
>     Gervasio> CRYPT is truely peer-to-peer. It is compatible with
>     Gervasio> routing daemons. It allows you to encrypt all the traffic
>     Gervasio> between two endpoints or only certain type of traffic (ej:
>     Gervasio> only TCP connections). It is extremely easy to use for an
> 
>   I do exactly that regularly.
> 
>     Gervasio> administrator familiarized with Linux firewalling since it
>     Gervasio> uses Iptables and it does not make any modification to the
>     Gervasio> normal routing behavior. CRYPT is considerably light and
> 
>   We have patches that permit you to decide what to encrypt using
> iptables. 
>