4 ms·

Actually from this: https://en.m.wikipedia.org/wiki/IPsec#Alleged_NSA_interference https://en.m.wikipedia.org/wiki/IPsec#Alleged_NSA_interferen... Doesn't hurt

• tptacek 10y ago
  This isn't a coherent theory of NSA interference with IPSEC, but rather a collection of different theories, many of which pertain both to IPSEC and (via TLS) to OpenVPN. * Here's a deep dive on that OpenBSD IPSEC backdoor theory (long story short: it wasn't one, though even if it had been, it would have affected only an old version of IPSEC): https://news.ycombinator.com/item?id=2014197 https://news.ycombinator.com/item?id=2014197 * Virtually everyone I know in cryptography believes BULLRUN to be a code name for Dual EC DRBG, which is a backdoor, and targets TLS. * The Diffie-Hellman attack referred to here was discovered first in (you guessed it) TLS. As for zero-day attacks again IPSEC software, that is no doubt a thing! But it's no less a thing for OpenSSL. I don't understand how you manage to get to "IPSEC is less open than TLS", since they're both equally open.
  • tornadoboy55 10y ago
    Not IPSEC in itself, but the full stack (tunnel+encryption) implementation in (for example) macOS is completely closed. You could go for something like StrongSwan, but then you lose the advantage you mentioned, namely OS-integration.
    • tptacek 10y ago
      "Completely closed"? Isn't it still raccoon?