why-is-ipsec-so-complex.html

---
date: 2013-10-16T07:38:00.000+02:00
tags:
- design
- IPsec
title: Why is IPsec so Complex?
url: /2013/10/why-is-ipsec-so-complex/
---

<p>Jason Edelman <ahref="http://www.jedelman.com/1/post/2013/10/never-have-trouble-again-setting-up-a-site-to-site-vpn-tunnel-between-disparate-vendors.html">wrote a great blog post</a> after watching Ethan Banks struggle with yet another multi-vendor IPsec deployment. Some of his ideas make perfect sense (wiki-like web site documenting working configurations between vendor X and Y for every possible X and Y), others less so (tunnel broker – particularly in view of <ahref="https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html">recent Tor challenges</a>), but let’s step back a bit and ask ourselves “<em>Why is IPsec so complex?</em>”<!--more--></p>
<p><strong>Whatever happened to running code?</strong> IETF standard were supposed to be <ahref="http://www.ietf.org/tao.html">based on running code</a>. That might have been the case 30 years ago; I’m positive some of the standards we love to hate wouldn’t be around if running code would be the first step in standard development process.</p>
<p><strong>Where’s the operational experience?</strong> Looking from the sidelines it seems that vendors lead a lot of standard developments (because their engineers are the only ones with time to work on IETF documents, argue in mailing lists, and have the budget to travel all across the globe to attend IETF meetings). </p>
<p>Engineers with operational experience are too busy running their networks, and get involved when it’s way too late (see also: IPv6). Making matters worse, their complaints usually get shot down with flames from ivory towers (including: <em>you don’t get it</em>, <em>you’re stuck with old mentality</em>, <em>your use case isn’t relevant</em>, <em>your idea violates the shiny principles</em>…).</p>
<p><strong>Exploring the solution space</strong>. Instead of focusing on “a solution is done when there’s nothing to cut away”, we often get a <ahref="http://www.tonyadavidson.com/wp-content/uploads/2012/02/camel-WI.jpeg">designed-by-a-committee</a> “solution is done when we cannot add another option to it” (example: <ahref="http://tools.ietf.org/html/draft-xu-mpls-in-udp">MPLS-over-UDP</a> because MPLS-over-GRE is so last millennium).</p>
<p><strong>Partial implementations</strong>. IETF documents are full of SHOULDs and MAYs, begging the vendors to implement only parts of them … and then there are <ahref="http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html">people deliberately messing up the standards</a>.</p>
<p>Making matters worse, multiple (incompatible) drafts document similar functionality. Not surprisingly, a multi-vendor deployment becomes an exercise in futility when a desperate engineer tries to find the maximum subset of shared functionality. Dial tone signaling in SIP comes to mind, as does IPsec. This is what Bruce Schneier had to say about <ahref="https://www.schneier.com/paper-ipsec.pdf">IPsec complexity</a>:</p>
<blockquoteclass="cite">Our main criticism of IPsec is its complexity. IPsec contains too many options and too much flexibility; there are often several ways of doing the same or similar things. This is a typical committee effect. Committees are notorious for adding features, options, and additional flexibility to satisfy various factions within the committee. As we all know, this additional complexity and bloat is seriously detrimental to a normal (functional) standard. However, it has a devastating effect on a security standard.</blockquote>
<p><strong>Clueless de</strong><strong>signs</strong>. We don’t have time for reading the standards, trying to understand the technology, and building designs and architectures on sound foundations. </p>
<p>It’s way faster to read a whitepaper or two, throw a few icons together in PowerPoint or Visio, and pass the buck to the deployment team.</p>
<p><strong>The Nerd Knobs</strong>. A technology eventually meets reality and has to be implemented, at which point all of the above strikes at the poor implementation/operations team. </p>
<p>If their company bought enough equipment to have significant leverage with the vendor, they can force the vendor to implement a knob (or two … or a dozen) to get their design working (hint: check the hundreds of VoIP “features” added to Cisco IOS). Welcome to the wonderful world of nerd knobs.</p>
<p>Not surprisingly, the nerd knobs usually work well only in a particular scenario they were designed to solve and get used in all sorts of weird ways. They might also introduce non-standard behavior (because they had to be put in place to make a standard work in real life), making multi-vendor deployments even more fun.</p>
<h4>Can we do any better?</h4><p>It’s hard to stop a tanker by swimming against it, but we can try. When was the last time you said NO to a shiny new technology and <ahref="/2013/09/sooner-or-later-someone-will-pay-for/">tried to solve a problem using the tools that have been proven to work</a>?</p>