ycweb

3 ms·

1. 1.▲
   by ycweb 16y ago

   IPSec doesn't support authentication well. For example, if you have a shared secret like a web cookie, how would you use this to authenticate one endpoint of an IPSec connection? It's hard, because the granularity of IPSec session keys is
2. 2.▲
   by ycweb 16y ago

   If you use X.509 server authentication with 2,048-bit RSA keys, tcpcrypt offers about a 25x speed-up over SSL for equivalent security. (Actually slightly better, since tcpcrypt offers forward secrecy while, in the benchmark, SSL does not.)
3. 3.▲
   by ycweb 16y ago

   A lot of the SSL vs. SSH discussion on here is just demonstrating the fact that there is no one-size-fits-all solution for authentication. The point of tcpcrypt is to get the best security possible under any setting, so it can be used with