Re: [dhcwg] DHCP hackathon in Prague: SeDHCPv6

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

>  Bernie addressed the key issue.   I think Bernie's suggestion is fine, but s
>  ounds a lot like DTLS, which begs the question, why not just use DTLS?   And
>   Francis, much as we might wish it otherwise, IPsec isn't actually a practic
>  al option as far as I can tell.  I have no idea how to use it for anything o
>  ther than setting up a VPN on, e.g., Mac OS X.   If you have a resource to p
>  oint to on that, I'd be interested to hear about it.

=> even if IPsec is essentially used for VPN it provides a transport mode
and not only a tunnel mode...
Now the real question is about the fact IPsec is a kernel feature, not
something you add in applications over the transport API provided by
the kernel. The world is divided between people who think it is an
advantage and people who think it is *the* problem.
Obviously I am in the first part, you in the second. Now I did a lot of
kernel programming (including IPsec kernel programming) so I am very
far to be neutral...

Regards

[e-mail]

PS: macOS has IPsec/IKE support. At the time I worked on IPsec it used
the same code than me, today I don't know.
To configure it:
 - open System Prefences
 - open Network
 - add a new interface (or service)
 - select VPN (there was a way to use transport mode but as far as I
  remember not very direct)
 - select IKEv2 VPN type
 - enter a service name
etc
BTW I am typing this on a macOS MacBook Air...