Re: IPSec vs. SSL

From: UncleStoner (unclestoner_at_hotmail.com)
Date: 05/19/04 

Date: 19 May 2004 07:00:41 -0700

Thanks for your reply Juha.

You've verified the advantages I suspsected IPSec had over SSL, which
are just a result of the fact that it's lower down in the network
stack.

If we assume that IPSec does offer authentication (which you
tentatively suggest it does, and anyway even if it currently doesn't a
future revision could certainly include it), then:

What is the point of SSL? Why not just get rid of it and use IPSec
instead?

 - If you want to secure _all_ traffic to and from a machine (as in
your company-labtop-from-home example), then the machine just has to
be configured (at an OS level) to send/receive only IPSec packets (as
is the case today).
 - If you want to allow both secured and unsecured traffic (for
instance a web site that has some secured parts, or for that matter a
web browser that sometimes goes to secured web sites and sometimes to
unsecured web sites), then the machine-wide configuration would _not_
be required to send/receive only IPSec packets. Rather, whether or
not to use IPSec would be the choice of the individual applications,
via the sockets interface. **This isn't any more insecure than using
SSL for some but not all connections**. If you want to secure all
traffic to and from a machine, don't do this.

Basically, there isn't any reason (that I can see) that the IPSec
protocol could not be used
 - to completely secure a computer from sending unencrypted data and
accepting unauthenticated communication
 - OR as a generic client/server solution.
depending on the configuration. Of course it can't do both at the
same time on the same machine...but at least we would only have one
protocol to study and understand and improve.

And on a fun note: I recently unearthed some letters from my
great-grandfather who immigrated to the US from Oulu after WWI I
believe. They were quite interesting for two reasons. They were
written in the years around WWII, and it was fascinating to feel how
conflicted he was about the alliance between his new country and the
Soviet Union. Unlike a lot of other Americans, he had no illusions
about Stalin for obvious reasons. Secondly, he spoke English well
enough but had never learned the spelling, so he spelled everything
phonetically. It was difficult to read until I started speaking the
words out loud...I was talking with a thick Finnish accent! Pretty
eerie since he was dead decades before I was born.

Relevant Pages

  • Re: Ace Password Sniffer : How does it work ?
    ... >> Another protocol that offers same is IPSec. ... >> authentication and secure transfer of data between server and client ... >> would be pretty hard to use SSL to secure data exchanged between ... Once you are done with the secured login, ...
    (microsoft.public.security)
  • Re: Securing Communication Between Domain Members and their Domain Controllers
    ... look into using an ipsec tunnel into a gateway computer or ipsec endpoint device or ... > located stand alone servers. ... > integrte them into a single secure Active Directory Domain. ... > member servers to communicate this way, looking through the MS tech. support ...
    (microsoft.public.win2000.security)
  • Re: IPSEC with non-domain Server
    ... Certificates are not the "most secure", rather, they are one of the 2 "more ... > authenticate computers and protect traffic integrity and confidentiality ... > Attacks on IPSec and Other Security Concerns ...
    (microsoft.public.security)
  • Re: wifi security
    ... IPSec over WiFi is just as secure as IPSec ... Having said that it is correct to say that copper is more secure than ... >>Secret data networks the DoD uses fiber. ...
    (Security-Basics)
  • Re: IPSEC vs. PPTP, etc
    ... IPSEC is generally considered to be more secure and fights against the "man ... PPTP and GRE do work with most NATS. ... WinGate VPN uses IPSEC over UDP which is compatible with virtually all NAT ...
    (comp.security.firewalls)