4

We can Process encryption of data at application layer according to given key. So why do we need to use IPSec for security ?

Lets say I want to send message to other machine over internet. Which one is good IPSec or manual encryption ?

  • 5
    Encryption doesn't encrypt the headers of the protocol you're using above IP meaning you leak some information to observers that you can't hide on this layer, whereas IPsec encrypts everything above the IP layer. – mroman Nov 10 '17 at 17:33
  • You don't need to and you never "need" any specific tool. You can always get away with some other more or less similar tools. It's just more practical to use some tool rather than a less specific tool... depends on what you are trying to do. – curiousguy Nov 11 '17 at 1:29
7

TLS was designed to secure only the Application Layer data only. You can use TLS to create a VPN tunnel, but it is not in this way as often.

IPSec/ISAKMP was designed to secure the IP, TCP, and Application Layer data. When using IPSec the IPs are encapsulated with an extra layer of the two endpoints for the IPSec tunnel (VPN), and everything at the Transport Layer and above are encrypted.

Because of the way IPSec encapsulates and secures data it is ideal for large routers. You can route specific network traffic to use the IPSec tunnel across multiple subnets if you wanted to. It also doesn't require special knowledge or a key exchange since the decision to encrypt traffic is made at the IP level of the stack. It does require your network to have already established an IPSec tunnel to reach the services in the remote network. This is ideal for connecting different company campuses' networks together through single points of access.

  • Did you mean "everything at the Transport Layer and above are encrypted"? Don't we normally say layer 1 is "below" layer 7? – Todd Wilcox Nov 10 '17 at 21:58
  • @ToddWilcox Ah, good call. I always switch up how I view layers in Wireshark vs. OSI Layers. – RoraΖ Nov 13 '17 at 14:41
3

It's simpler to setup IPsec once between hosts than between every service on your hosts

On a reasonably secure host you should be running several administrative services, like shipping your syslogs to a central server for analysis, same w local system emails, backup agent, HIDS, NTP, SNMP, SSH

Is it simpler to setup ONE encryption/authentication system per machine, or SEVEN?

It's also safer because new connections you make will be secure by default, so when the new Node.js webdev comes in, and connects to your database, he doesn't need to worry about SSL

Some protocols have weak security and will be more secure if over IPsec, like NIS/YP, SNMP, SMTP, NFS

Here's my guide on setting up IPSec between hosts with OpenBSD:

http://blog.databasepatterns.com/2017/09/encrypt-your-lan-with-ipsec-openbsd.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.