IPSec is in the kernel. IKE is outside in userland. IKE tends to be the parts that get compromised often and IPSec in itself is pretty simple. Putting control

IPSec is in the kernel. IKE is outside in userland. IKE tends to be the parts that get compromised often and IPSec in itself is pretty simple. Putting control planes in the kernel is the worrying part IMHO.