Wolfgang Rupprecht wrote:

>Can netbsd's ipsec along with isakmpd or racoon be used for privacy
>with random remote hosts?  Older user-land protocols like ssh will
>allow two hosts that have never communicated and have no shared
>secrets to establish a secure connection.  (Well, with the one proviso
>that one can't really guard against a man-in-the-middle attack.)  Can
>netbsd's ipsec be setup in a similar fashion?  It would be really nice
>if all incoming and outgoing IP connections would go via some secured
>method and only fall back to non-ipsec methods if the other side
>declined the isakmp negotiations.  Is this possible?
>
>-wolfgang
>
Looks like IP supports an IP_IPSEC_POLICY setsockopt. Maybe you could 
negotiate your key with the far end using some RSA based scheme then 
plug in the stream cipher and use IPSEC for the host to host communication.

You could probably use the ssh upper scheme and then ask IPSEC to do the 
main work for you. In this way you could in theory use any hardware 
acceleration that may be present.

Dunno if it works... Looks fesable though. If you could pre-share your 
key at each end that may make it quicker for a simple test.

A.