4 ms·
While I generally agree with the concept, encryption isn't free, and will break pretty much every routing protocol used. It's easy enough to get a tunnel throug
by Tiksi 12y ago
While I generally agree with the concept, encryption isn't free, and will break pretty much every routing protocol used. It's easy enough to get a tunnel through transit when you control both ends, but neither the hardware nor the software that actually runs the peers supports it in any way. You'd have to set the link, then encrypt on top of that, costing a ton of cpu cycles, bandwidth overhead, and requiring something that can handle encrypting everything in real time and then pass it off to the actual edge connection. "Large" networks do 100Gbit plus, and I can't think of any way this is currently feasible to do.
- 7952 12y agoI was really thinking in terms of coporate networks, which would be considered small. It is already common on such networks to have proxies/NAT/filtering that inspect and route everything in a very resource unfrinedly way. I would propose creating single VPN tunnel between these corporate networks that all traffic destined for the other network is routed down. Just join individual private networks with encryped tiunnels. This would be completely transparent at the client level as the data would just follow a different path. It would avoid the startup cost of SSL or the higher CPU requirements of symmetric encryption. Such a setup could be required as a contract/tendering/supplier requirement. Really if you have two companies that are sending data that may be sensitive why would you want any of the packets to ever be sent in plan view? Client side standards will never give a complete gurantee of that. It is much more enforcable to add the security at the network level.