Subject: IPSec Implementation

From: "George Hadjichristofi" <[email-masked]>
Date: Tue, 20 May 2003 00:31:54 -0400

Hi,

I have a question related to the different implementations of IPSec.

I am currently looking into the FreeBSD, FreeSWAN Linux, and the one that
comes with the new version of linux.

Does anyone know the basic differences between these implementations?

Which one has the best documentation?
Which one is "easiest" to understand and modify?

Thank you,

George

*************************************************
George C. Hadjichristofi
Graduate Student,Computer Engineering Department
Virginia Tech,Blacksburg,VA 24061,U.S.A
TEL:(540)-951-8936
*************************************************

---

From: Feng Ye <[email-masked]>
Date: Tue, 20 May 2003 09:29:48 -0700 (PDT)

Hey George,

I was doing the same thing a while ago, I looked into
Kame, and briefly went through the code, seems the
Kame is ok to understand, anyway they are all based on
the standard (I mean, the IKE part).
I think there're some difference between the open
source implementations:
 1.FreeS/wan: they do not support those they think are
unsecure, like single DES, DH group 1, agressive mode,
etc. Besides, freeswan is not used in VPNC testing.
 2.openbsd (isakmpd): they have hardware support (like
Hifn chips), they do not support multiple ESP/AH
headers as required by an iterated VPN cloud. Model
IPsec tunnel as pseudo interfaces.
 3.kame (racoon): do not model IPsec tunnel as pseudo
interfaces (maybe a good thing). Does not implement
byte lifetime for both phase 1 and phase 2.

As for the documentation, Kame has some documents in
Japanese. The best way still is to go over the code, I
think the open source documentation is not sufficient
enough.

As for the modification, I only looked into Kame,
which is based on PF_KEY socket implementation, so if
your system is socket based it should be easier.

I am still very interested in this, if you have any
result, can you let me know?

Regards,
Feng Ye

> Which one is "easiest" to understand and modify?

__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com

---

From: Michael Richardson <[email-masked]>
Date: Tue, 20 May 2003 13:49:25 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "George" == George Hadjichristofi <[email-masked]> writes:
    George> I have a question related to the different implementations of
    George> IPSec. 

    George> I am currently looking into the FreeBSD, FreeSWAN Linux, and the
    George> one that 
    George> comes with the new version of linux.

  Best documented would be FreeS/WAN.

  Easiest to modify for someone who has never looked at the code, might be
*BSD. I'd say that the NetBSD 1.6 code is probably the easiest to understand,
because it is the least efficient - i.e. most poorly optimized!! That will
change very soon, I think.
  Easiest to test with would be FreeS/WAN, because it has "make check" that
runs about 100 test cases using User-Mode-Linux.  

  I have (intentionally) never looked at the Linux 2.5 code, so I can not
comment. 

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: "George Hadjichristofi" <[email-masked]>
Date: Wed, 21 May 2003 00:22:20 -0400

Hi Michael,

Which implementation has the best documentation?
Which one is the "easiest" to understand and modify?

Thank you,
George

*************************************************
George C. Hadjichristofi
Graduate Student
Bradley Department of Electrical and Computer Engineering
Virginia Tech,Blacksburg,VA 24061,U.S.A
TEL:(540)-951-8936
*************************************************

-----Original Message-----
From: Michael Richardson [mailto:[email-masked]]
Sent: Tuesday, May 20, 2003 1:49 PM
To: George Hadjichristofi
Cc: Ipsec
Subject: Re: IPSec Implementation

-----BEGIN PGP SIGNED MESSAGE-----

*BSD. I'd say that the NetBSD 1.6 code is probably the easiest to
understand,

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls
[
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net
architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device
driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security
guy"); [

---

From: "George Hadjichristofi" <[email-masked]>
Date: Wed, 21 May 2003 00:25:19 -0400

Please disregard the previous email.
I got confused :-)

Thank you,
George

-----Original Message-----
From: George Hadjichristofi [mailto:[email-masked]]
Sent: Wednesday, May 21, 2003 12:22 AM
To: Michael Richardson
Cc: Ipsec
Subject: RE: IPSec Implementation

Hi Michael,

Thank you,
George