Re: threats ID

[Tim Shepard <shep@alum.mit.edu>]

> > Note that IPSEC adds a layer, increasing the number of layers below
> > TCP by one.
> 
> it is clearly stated in RFC2401 "Security Architecture for the
> Internet Protocol", which defines IPSEC architecture, that:
> 
>    The goal of the architecture is to provide various security
>    services for traffic at the IP layer, in both the IPv4 and IPv6
>    environments.


Interesting that the draft says that.  Note though that despite the
draft saying that IPSEC provides it "at" the IP layer, it in fact does
all of its communication sitting on top of unmodified IP.  For
example, the routers don't need to be upgraded to allow IPSEC to run
over them.  So in some meaningful sense, IPSEC is above the IP layer,
even if there is a document telling us that we're not supposed to
think about it that way.

			-Tim Shepard
			 shep@alum.mit.edu