2

I recently made a very basic TCP client/server system in C++. I got the client and server running between two computers connected to my private Wi-Fi. Since a private Wi-Fi is encrypted, does that protect the TCP server-client communication in any way?

How about connecting it over WAN ? In that case, cryptography would be mandatory, right?

I am thinking of using ECDH with AES 256-CBC as my encryption scheme.

Improve this question
3
  • 2
    For the WAN case, why not use SSL/TLS?
    – Eugene Styer
    Commented Dec 28, 2019 at 14:32
  • @EugeneStyer Of course, I will but I'm not using any external libraries like openssl for it. So is WPA2 PSK enough for LAN ? Can a malware running in my OS (server/client) intercept with my communication ?
    – Aravind A
    Commented Dec 28, 2019 at 14:42
  • " Can a malware running in my OS (server/client) intercept with my communication ? " Yes. This is true no matter what encryption you use. Even if you go all-in with a TPM or other "secure enclave" style hardware, your client or server application needs to he the decrypted data in memory at some point and malware can just dump memory to get it. You can make that task harder but in general if an adversary can run code on your system, they've already won.
    – Ben
    Commented Dec 30, 2019 at 15:20

1 Answer 1

Reset to default
2

Since a private Wi-Fi is encrypted, does that protect the TCP server-client communication in any way?

Of course it protects the connection: to the level that WiFi connection is secure. And if the connection travels over anything that is not WiFi, then it is not protected. In itself, assuming that the connection is WiFi, or WiFi all the way seems just waiting for somebody to connect an additional wired router or switch, if you ask me.

Although it's getting better fast, previous WiFi protocols were all very vulnerable against attacks and the WiFi designers have been ignoring standard secure cryptographic techniques in the past. I would still not fully trust the security offered by it for any serious data. And that's assuming a professionally implemented WiFi connection, of course; all bets are off otherwise. Adding an additional layer seems very wise.

How about connecting it over WAN ? In that case, cryptography would be mandatory, right?

WAN is just a designation of how far a network spreads. It does not carry any mandatory security. As such, it would depend on the specific WAN. My connection to the ISP does not offer enough protection for me to trust it. Hopefully some kind of VPN is applied, and then the security of that particular VPN needs to be investigated.

Just like WiFi, it may not provide full point-to-point security from client to server. And any changes in it may still break any assumptions made for your client / server security.

I am thinking of using ECDH with AES 256-CBC as my encryption scheme.

Seriously, use TLS. Just using ECDH won't cut it and AES in CBC mode is vulnerable against padding oracle attacks. The chances of creating a secure transport mode yourself are so remote as to be near non-existent, so you have to use a common existing protocol.

Improve this answer
2
  • Thankyou very much, for answering my question !!!
    – Aravind A
    Commented Dec 30, 2019 at 13:51
  • Yes I have upvoted your answers on crypto.stackexchange as I have > 15 rep there. But after all we are all humans sharing ideas, and it is because of people like you we have this amazing community in the first place! I really do believe that a sincere appreciation will do miracles for the giver as well as the receiver, and for the entire community ! I really do respect everyone at the other end, and people like you are like a beacon of light for anyone to learn cryptography or programming by their self alone ! I was always fascinated by crypto ever since I was a kid !!!
    – Aravind A
    Commented Dec 30, 2019 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .