3 ms·

IPSec is not fundamentally broken, it's just needlessly complex.

• cpeterso 13y ago
  Is there a simple (and auditable) subset of IPSec that could still compatible with IPSec clients using a full/complex stack?
  • wiml 13y ago
    As I understand it most of the terribleness is in the key agreement stuff; the actual packet processing is a little ugly but is practical. So you could in theory set up (and regularly update) SAs manually with setkey(8), instead of having racoon do it. For a small network you could presumably lash together some cronjobs to keep this working. Would that be as secure as IKEv2 as actually implemented? I dunno :)
• plorkyeran 13y ago
  If the unnecessary complexity has resulted in most implementations being broken then I'd be okay with calling it fundamentally broken, but I have no idea if that's actually the case.