Re: [mpls] FW: I-D Action: draft-farrelll-mpls-opportunistic-encrypt-00.txt

[Mark Tinka <[e-mail]>]

On Friday, January 10, 2014 06:06:06 PM Eric Rosen wrote:

> I think encryption at the network layer is much more
> complicated to do at scale than is encryption at the
> data link layer.  There's just a lot more to figure out
> on a per-packet basis, and the system design becomes
> more complex.

This is one of my major concerns with this draft. 
Implementation is likely to make the forwarding plane very 
complex to the extent that if any vendor is brave enough to 
support this, they will, in all likelihood, develop a 
completely separate line card that employes this kind of 
security, while building the generalized line cards in 
parallel. Want to guess which one is more likely to be 
affordable/sellable?

Optical vendors are providing low-latency encryption at the 
link layer, but I suspect that will not succeed much (in the 
service provider market, anyway) because Ethernet speeds are 
growing at a very fast rate; and it's hard enough to scale 
that before one considers how adding security in the data 
plane affects the same.

Mark.