3 ms·
Another serious problem was/is the lack of interoperability. The key management protocol is complex with features for everyone and their cat. Lots of people exp
by xorcist 8y ago
Another serious problem was/is the lack of interoperability. The key management protocol is complex with features for everyone and their cat. Lots of people expected operating systems to implement IPsec which would make it easier to manage large scale. That didn't work out all that well.
Since you can't count on interoperability, especially not in the future, everybody uses tested server/client combinations, that whole standardization process wasn't that useful anymore which somewhat negates any gain over using a much simpler protocol (whether TLS or something else).
- peterwwillis 8y agoSo rather than securing connections at the os level, we re-invent the network stack past layer 3. First you bring your own crypto, then create a whole new virtual network stack, then create connections. Or do what Google does and bring your own crypto, then bring your own layer 5-7 routing and transport on the server. These are "interoperable" if 1) your users download an extra app, or 2) your server implements custom app-specific solutions.
- bogomipz 8y ago>"Another serious problem was/is the lack of interoperability." What interoperability issues with keying? IKE which is pretty much universal is built on a standardized framework - ISAKMP which specifies how the key exchange mechanics work. IKE is made up of 3 mature and standardized protocols - ISAKMP, OAKLEY(which modes) and SKEME(for pub key-based exchanges). In a past life I configured VPNs, often between sites where there were disparate vendors on both ends. Never once did I run into an issue where a VPN just wasn't possible because of interoperability issue.