Subject: [Roll] On IPsec CPU and memory requirements

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 07 Sep 2010 08:40:43 +0200

During recent discussions of security concerns of RPL it was mentioned
that IPsec could be used to secure the RPL messages.  One concern of
using IPsec is the reluctance facing its supposedly large requirements
on CPU and memory.

I think IPsec AH with HMAC and MD4 may not need large computing
ressources.  Moreover, I think it may need less than AES and RPL with
CCM (current RPL spec).

Detractor texters of IPsec seem to assume "IPsec" to be: IKE key
generation exchange Diffie-Hellman, RC5, firewalls and ACLs, ESP
encapsulation.  Were it so then I'd agree that that "IPsec" to be too
much for little RPL nodes.

However, some reduced form of "IPsec" could be just AH header, ICV value
containing the CCM (or HMAC-MD4) value, and a data structure containing
entries of the form dstaddress-key, and SPI (security parm index).  That
is very simple and easy to implement, documented, software exists.  This
kind of "IPsec" would have very little CPU and memory requirements.

Alex