linux-ipsec: Configuration commands

>From klips/doc/rgb_setup file in the distribution:

> ipsec0 needs to be associated with a real interface. . . . Then we
> need to configure the new pseudo interface:
>
> gonzales# ipsec tncfg --attach --virtual ipsec0 --physical eth0
> gonzales# ifconfig ipsec0 192.168.2.110 netmask 255.255.255.0
>
> <snip>

Shouldn't the IPSEC device inherit addresses and netmask, then? Why is the second command above necessary? For that matter, why isn't the whole thing just:

        ipsec attach ipsec0 eth0

Notes like the one above scare me. I'm inclined to assume that if users can get something wrong, some of them will.

On the other hand, is there some reason that inheritance won't work? Hard
to implement? Not appropriate in all cases? If the latter, should it be a
default which can be overidden when required?

-- 
"The real aim of current [cryptography] policy is to ensure the
 continued effectiveness of US information warfare assets against
 individuals, businesses and governments in Europe and elsewhere" 
       Ross Anderson, Cambridge University