hence the question
https://cloud.google.com/blog/products/identity-security/ann...
HN discussion at the time:
The PSP Security Protocol (PSP) is a security protocol created by Google for encryption in
transit. PSP uses several of the concepts from IPsec ESP to provide an encryption
encapsulation layer on-top of IP that is streamlined and custom-built to address the
requirements of large-scale data centers.
[1] https://raw.githubusercontent.com/google/psp/main/doc/PSP_Ar...
Ok in fairness it was probably originally something like Paul's Security Protocol and they felt that that wasn't professional enough or something.
https://dl.acm.org/doi/10.1145/3708821.3710829
https://csrc.nist.gov/CSRC/media/projects/cryptographic-modu...
QUIC (over UDP) also requires encryption at its protocol layer in addition to encoding a encryption context identifier that is comparable, but non-compatible with the PSP header. So, a implementation that properly conforms to both standards would double encrypt the same data and send redundant headers/identifiers with no added security.
They could relatively easily restructure QUIC and PSP to be fully compatible, letting PSP do connection identification and encryption and then layering QUIC framing on top. But no. What a mess.
phoronixrly•4mo ago
Documentation https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-n...