Messages in this thread | | | Date | Mon, 03 Aug 1998 16:10:31 +0200 | From | Daniel Pittman <> | Subject | Re: CIPE - Encrypted IP Encapsulation |
| |
Alan Cox wrote:
> > Are there any plans for a CIPE-like networking option in the kernel? or > I'd love to BUT > > > just addons like this? Or wold it be possible just to merge the CIPE tree > > into the kernel (it appears ready for it to be inserted into the > > kernel..). > > We can't do it until the US government grows a braincell
Hang on for a second - with the new IP firewall chains code in the 2.1.x kernel, you can do userspace filtering of packets, right? Could this possibly be used to implement at least the IP-SEC layer?
Failing that, adding code to implement IP-SEC with the allowable key length for US export would be possible, I imagine; of course, this is dependant on the US government following their own rules, which I wouldn't want to put money on. So, implement the IP-SEC layer in the networking code using a nice 40 bit secret key. Make it all nice and clean.
Of course, following the principals of good design and consistency, this should be implemented as a nice layer in the API, or even as a plug layer between two existing APIs. A modular version would be good, to let those people who didn't want any encryption code cut it out, or demand load it.
I have some vague memories of the US having some sort of rule against shipping a product into which encryption could be "plugged" at a later date, but if this got past the officials and was exportable, it would be a fine and happy thing.
Oh, and the fact that it lets someone in a sane country write a plugin replacement module with a real set of encryption routines, well, wouldn't that be a real shame?
Of course, I am not a lawyer and probably have a very distorted idea of what the US government are liable to allow or something...
Daniel
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |