Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Counter mode encryption is potentially more robust against lost packets. It is used in SRTP.

I assume that if I use counter mode, a lost packet causes a lost UDP packet or TCP retransmission instead of total renegotiation of the security context.

I found some RFC drafts describing IPsec counter mode but I have no idea how widely it is really implemented. There is a mention that StrongSwan may have implemented it 2010.

Is IPsec counter mode something I could assume to be found in any standard Cisco endpoint?

Are there essential weaknessess in the counter mode?

share|improve this question

Actually, counter mode is used in Cisco for a technology called "Get VPN". All other Cisco VPN use Point-to-Point Crypto VPN transform-set.

You can read more about counter-based techniques in Get VPN here.

share|improve this answer

It has nothing to do with TCP-like stuff like resending lost packets etc.

Security - it uses AES, so far not leaking keys in the encrypted stream....

Cisco - You need recent IOS, namely 2011Q2 onwards.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .