gotiate security services. Although this covers the whys and hows, it does not cover the whats of the exchanges. The details of what exactly must be negotiated is left to another type of specification document, which in the case of IPsec is called the Domain of Interpretation (DOI). The exact bit field positions reflect the exact significance of all parameters involved with algorithm choices and configurations. In addition to encryption and authentication, IPsec addresses several other interesting aspects of operation. One of them is network-layer compression. The payload content is compressed prior to being encrypted. In fact, this is exactly how it should always be, because if it is done the other way around, the process ends up being worthless because compression is impossible or, as more often is the case, because compressing an encrypted stream is not a reversible operation and the receiver can- not decrypt traffic. IPComp is the protocol used for IPsec compression. It creates a type of SA known as the IP Payload Compression Protocol (PCP). Other techniques of compressing are available in this same IP realm such as the Lempel-Ziv standard (LZS) and Deflate, but we will not spend any time on them here. Other issues of interest are also how IPsec behaves in a multicast environment and how the Network Address Translation (NAT) protocol can be consolidated within the same context where IPsec security may be required. The textbook by Doraswamy and Harkins covers all of these issues in detail. Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS NETWORK PROCESSORS As a conclusion, the overriding point we want to make is that the consolidated need for significant computational power justifies offloading all IPsec operations onto an accelerating coprocessor. SSL is a layered handshake protocol that was originally designed by Ne