If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.


If there was a communication protocol that encrypts at the very low-level,

There is: IPSec

this would solve the problem of wiretapping entirely and for all.

It doesn't.

  • 3
    In particular, IPSec doesn't do anything about the metadata: who's talking to whom is still readily available to anybody who can sniff the traffic. – Michael Hampton Aug 11 '13 at 20:20
  • @gowenfawr, Why are you commenting on stack 3 instead of stack 2? – Pacerier Apr 9 '14 at 12:03
  • @Pacerier, if by "stack 3" you mean layer 3 of the ISO model, the OP specifically asked for an alternative to TCP/IP, not Ethernet. (In addition, because Layer 2 is by necessity localized, any discussion of encryption at layer 2 is pointless in this context.) – gowenfawr Apr 9 '14 at 16:05
  • @gowenfawr, the OP is asking for a low-level communication protocol. Yes the question states alternatives to TCP/IP but I belive he meant alternatives to IP itself. IP is layer 3 whereas Ethernet is layer 2. – Pacerier Apr 10 '14 at 5:33

The answer you are looking for is Bitmessage, or something that works like that.

End-to-end encryption is not a solution

There is metadata to think of. Take the Dutch system for wiretapping: it's illegal without a warrant. But the police is allowed to see, without warrant, your address and name, your phone number, whom you're calling, when you called, your approximate location (based on cell towers I assume), and when the call ended. That's a lot of information. I'm assuming that's why you're looking for such low-level encryption: the IP headers also get encrypted and it's not possible to find out whom you're communicating with.

Unfortunately, that's the way the internet works. If intermediaries, including your ISP and thus the police, can't tell where a packet is supposed to go, it won't get there. You'd have to setup a mesh network where everyone talks to everyone, and only the peer that has the decryption key can decipher your message.

... which is exactly what Bitmessage does ;)

But let's explore your low-level encryption idea a little bit further.

How'd you setup end-to-end encryption anyway?

Skype promised end-to-end encryption. They did that for a good while I hear, but nowadays it's possible to wiretap it. How would you do that? First we have to know how the end-to-end encryption works.

Your goal is to exchange private information over an insecure channel (i.e. the internet) between a number of parties (you and all your contacts). In order to do this we need to meet in person and exchange encryption keys... but one of your contacts is in Australia and you're in Europe... so we need something better.

Someone came up with asymmetric encryption: You generate a public and private key, and only share the public key with the world. Then anyone can encrypt a message (using the public key) while only you can decrypt it (using the private key). You can't decrypt the message using the public key (at least, not in the scheme we're currently using; signing data is a different story and different concept).

Now we have a big problem: How do I send someone my public key, and can that person prove that I was the one that sent it?

Here we are. This is why end-to-end encryption is a lie. Skype can give you any key you want, they can read the contents, then re-encrypt it using the correct public key, and send it to your contact. Wiretap complete.

So how is Bitmessage any better?

Well to tell the truth, it's not that much better than plain old asymmetric encryption. But once you have succesfully exchanged the keys out of band, both the message contents and the metadata are secure. It's still possible to see that you're sending a Bitmessage message and how large it is, but not whom the sender and receiver are.

Okay and why aren't we all using it yet?

If mesh networks worked so well, we would all be using it. The problem is that it's incredibly easy to flood the network, but even without trying the network would be completely flooded if all our https traffic was switched over to bitmessage traffic. Bitmessage 'solves' this by requiring a certain amount of work before being allowed to send a message (the larger the message, the more work it requires), but it's not really ideal for huge-scale systems.


Tor is an alright alternative. The issue is that if you own a great number of nodes, you have a reasonable chance of decrypting some traffic. It's now known that the NSA is very interested in Tor and also owns a great number of nodes.

Overall, there is no ultimate solution, and any good security researcher will tell you the same. There are different systems which all have advantages and disadvantages. Some may work better in one case while others work better in other cases.

  • I cannot see why PoW would help the flooding as it is not the result of spamming, but rather that each potential information has to go to everybody. Like in a room only so and so many people can talk, or it gets so noisy, that communication is lost. – humanityANDpeace Mar 31 '14 at 22:17
  • This answer need more votes. – Pacerier Apr 9 '14 at 11:59

The best alternative will be quantum locking of communications in peer to peer sessions but it is still developing, extremely expensive, has distance limitations for now

  • Quantum crypto doesn't solve any of the hard problems (binding public keys to the ill defined concept of identity, traffic analysis, etc.) and only replaces the easiest part (exchange an ephemeral key and encrypt the data). – CodesInChaos Apr 1 '14 at 11:15


Cjdns-IPv6 (which is used i.e. by Enigmabox) implements an encrypted IPv6 network using public key cryptography for network address allocation and a distributed hash table for routing. The New Scientist reports that "Instead of letting other computers connect to you through a shared IP address which anyone can use, cjdns only lets computers talk to one [another] after they have verified each other cryptographically. That means there is no way anyone can be intercepting your traffic."

I havn't tried it, but this seems like a promising solution

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.