Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My understanding is that IPSec is a security layer added inside the IP protocol to make IP itself a secure transport.

My understanding of IPv6 is that it is the newest version of IP that will (for the foreseeable future) solve our IP exhaustion dilemma.

My understanding of SSL/TLS is that they are a way of securing TCP, which sits on top of IP.

First of all, if anything I have said is incorrect, please start by correcting me!

Assuming I am more or less correct:

  1. Can IPSec be used with IPv6 or does IPv6 include IPSec inherently?
  2. Are SSL/TLS a suitable (security- and encryption-wise) substitute for IPSec?
  3. Are SSL/TLS one in the same or do they address different problem domains?
  4. Is there anything to be gained from having SSL/TLS over IPSec? Or is that way too much security? Are there performance losses from such a setup?

Thanks in advance!

share|improve this question

1 Answer 1

up vote 2 down vote accepted
  1. The IETF (the Internet standards body) made IPSec support a requirement of IPv6 support. You don't have a fully IPv6-compliant host if it doesn't also support IPSec. However, you don't have to actually use IPSec all the time just because you're using IPv6.
  2. No, SSL/TLS only protects the transport layer (layer 4) and above. If you want to protect layer 3 (the network layer; IP), you need IPSec.
  3. SSL was originally invented by Netscape to secure HTTP, and was generally done on a separate port (443 instead of 80). The IETF took SSL and turned it into TLS by making it something that could protect any transport-layer traffic flow regardless of protocol, and could be negotiated on the traditional ports for those protocols, rather than requiring a separate "secure" port for each protocol.
  4. This comes down to fundamental questions of why networking protocols are designed in layers, and which services different layers should provide, and whether they should always provide them or not. I recommend you read the End-to-End paper.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.