Subject: Re: can vpn's extended to mobility

From: "James P. Salsman" <[email-masked]>
Date: Tue, 26 Sep 2000 17:59:27 -0700 (PDT)

> The most popular IETF standard for VPNs is IPsec using ESP.

IPsec could be improved for wireless:
  http://pilc.grc.nasa.gov/pilc/list/archive/1012.html
  http://pilc.grc.nasa.gov/pilc/list/archive/1022.html

Now PPP-over-SSH isn't any better, just a lot easier and much less 
expensive for most people on both Unix and Windows.  Either would 
probably be an acceptable mobile VPN solution.  IPsec would probably 
add less latency, but not much compared to what existing wireless 
customers are used to.

If I ever get 128kbps Ricochet on my neighborhood lamp-post, I'll 
try and see what the round trip time for ppp-over-ssh ends up.  I'm 
not thrilled with the 0.7s first-hop round-trip of plain Richochet 
wireless service to begin with, nor with the fact that the location 
of that first hop is New Jersey when the modem is in California.

Cheers,
James

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 27 Sep 2000 03:11:27 +0100 (BST)

>   http://pilc.grc.nasa.gov/pilc/list/archive/1022.html

You've completely missed the point of that
discussion. (Unsurprisingly.)

We were discussing how layering and IPSec encapsulation prevents (IMO
stupid and at the very least unsafe) link-layer local-optimisation
tricks based around sniffing packet contents and making gross
assumptions about source delivery requirements based on
whether UDP or TCP was found within.

(In a similar vein, there are academic papers being written about
diffserv which assume that they can distinguish between UDP and TCP
flows and mark them differently at ingress so that fairness
between UDP and TCP can be achieved. Fat chance of that working
in the real world with IPSec or even in a downstream domain.)

> IPsec would probably add less latency, but not much compared to
> what existing wireless customers are used to.

If IPSec adds any latency beyond startup negotiation, I for one will
be quite surprised. Use of IPSec will degrade any link-level
compression in your modem, of course, but that's hardly IPSec's fault;
more a fundamental limitation of information and entropy.

L.

some argue that IPSec could be improved by junking about half of it:
http://www.counterpane.com/ipsec.html

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: "James P. Salsman" <[email-masked]>
Date: Wed, 27 Sep 2000 00:04:14 -0700 (PDT)

> If IPSec adds any latency beyond startup negotiation....

The encryption takes some time.  Some $olutions will have 
hardware for it, but straightforward implementations mean 
lots of bit-field operations, which most C compilers don't 
optimize very well, and some compilers on certain platforms 
do a really bad job on those.

Cheers,
James