Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Counter mode encryption is potentially more robust against lost packets. It is used in SRTP.

I assume that if I use counter mode, a lost packet causes a lost UDP packet or TCP retransmission instead of total renegotiation of the security context.

I found some RFC drafts describing IPsec counter mode but I have no idea how widely it is really implemented. There is a mention that StrongSwan may have implemented it 2010.

Is IPsec counter mode something I could assume to be found in any standard Cisco endpoint?

Are there essential weaknessess in the counter mode?

share|improve this question

2 Answers 2

Actually, counter mode is used in Cisco for a technology called "Get VPN". All other Cisco VPN use Point-to-Point Crypto VPN transform-set.

You can read more about counter-based techniques in Get VPN here.

share|improve this answer

http://en.wikipedia.org/wiki/Galois/Counter_Mode

It has nothing to do with TCP-like stuff like resending lost packets etc.

Security - it uses AES, so far not leaking keys in the encrypted stream....

Cisco - You need recent IOS, namely 2011Q2 onwards.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.