Re: New extension: CRYPT target

[Gervasio Bernal <gervasiobernal@speedy.com.ar>]

Michael Richardson wrote:
> 
> 
>>>>>>>"Gervasio" == Gervasio Bernal <gervasiobernal@speedy.com.ar> writes:
> 
>     Gervasio> The idea behind CRYPT extension is not to replace IPSEC
>     Gervasio> absolutely, but to be a simple alternative of use for
>     Gervasio> encryption/decryption and packet authentication using
>     Gervasio> Iptables. It could be useful for somebody.
> 
>   Tell me the threat model.
> 
>   Under what circumstances is it better than:
> 	a) IPsec with OE (with is dirty simple to configure)
> 	b) TLS/SSL LD_PRELOAD wrapper
> 	c) using SCP instead of FTP (or rsync over SSH)
> 	d) OpenVPN or SSH port forwarding
> 	e) HIP

Perhaps in none of those circumstances.
CRYPT extension is just an alternative, as well OpenOffice Writer is an
alternative of Microsoft Word. It is good to have several different
alternatives.

> 
>     Gervasio> We have also developed a module in Python that use the
>     Gervasio> CRYPT extension, configuration files, has automatic key
>     Gervasio> management and user authentication using certificates. But
>     Gervasio> we need that someone else can test first the extension
>     Gervasio> alone, and comments its experience to us.
> 
>   Why in the world would you build such a complicated system? 

It is much more easy of which you imagine. You only have to run a Python
application and voila!!

>   You just told us that you wanted something simpler than IPsec.
> 
>   It seems like vanity crypto to me.
>