Encryption and Layers understanding

Question

If I'm right the SSL encryption take place in the application layer, but we can also have encryption in the Internet Layer.

Why are we using both, and why sites that doesn't have SSL are considered insecure even tho the information is encrypted in the Internet Layer anyway.

Also is it possible for anyone in the Internet to sniff packets of a site (ex. stackexchange.com) or the attacker should tap the cables outside of the building the servers are located. And if we have encryption in the Internet Layer and Wi-Fi is physical layer why is it considered insecure to log in to a site without SSL in a public Wi-Fi network.

Answer 1

Thinking in "layers" can be confusing. Layers come from the OSI model which was meant for another set of protocols, former competitors of what became TCP/IP (the "Internet protocol" that we use nowadays). If you want to put SSL into the layers model, your more-or-less have to put it on layer 6 or more, but also below layer 4 at the same time, which does not work. The "layer model" cannot really digest SSL.

When you want security, when talking to "a server", you want several things:

• Confidentiality: people who can spy on wires must not be able to understand the data you exchange.
• Integrity: people who can plug on wires must not be able to alter the data while it transits.
• Authenticity: when you talk to a server, you must have some reasonable guarantee that you are talking to the genuine server, not to some attacker-controlled faked.

SSL is "end-to-end": it ensures these characteristics regardless of how the data bytes are physically transported. Encryption systems applied on "lower layers", usually, lack this wide scope. E.g., when using a WiFi access point, there is some encryption which occurs between your laptop and the access point, but it stops there. The access point itself, and routers beyond that access point, will see the cleartext data.

There are end-to-end protocols which purport to integrate with TCP/IP at a lower level (e.g. IPsec), but they don't get used as widely as SSL for "usual browsing" because of historical tradition. Indeed, if you want some security between your Web browser and a Web server, then both the browser and the server must support the same relevant protocol and agree to use it; right now, the only protocol which "works everywhere" is SSL (which is why people concentrate on SSL support, which is why SSL works everywhere, which is why people concentrate on SSL support, which...).

Answer 2

I don't know what you mean by the "internet layer" - I assume you are referring to the network layer.

Your question is predicated on encryption being implemented lower in the stack - this is a possible but very unusual scenario.

Network layer encryption is optional - IPSec is an example of this which can provide end-to-end encryption. Wifi encryption only covers the OTA hop - not subsequent hops.

A further consideration is that not all encryption is based on the same trust model - SSL was specifically designed to verify the server side, and optionally the client side, and to support authentication based on a small number of authorities (i.e. clients don't need to pre-configure keys for each server) - but this comes at a cost which would not be practical for all types of internet data exchanges (it's rather difficult to use SSL with UDP and ICMP).

Answer 3

Due to encapsulation you can only encrypt from your layer 'up'. That is if you are in SSL (layer 5), you are able to encrypt layers 5-6-7.

IPsec is a layer 3 protocol, with the ESP method we can encrypt the whole IP packet (although not the IP header, you require to be able to see this to forward the packet). This would encrypt layers 3-4-5-6-7.

Sites not using SSL are considered insecure because not every client uses IPsec by default. We can consider a typical web application as in the application layer (lol).

In order to sniff all traffic to/from a host you require to be an on path attacker (Man in the middle). This can be performed by several ways such as ARP poisoning.

It is insecure to log without SSL in a public network because anyone inside that network (not outside) would be able to see what you are sending. Level 2 encryption only prevents from users outside the network to sniff your packets.