Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I hope this question fits this stackexchange:
From what I understand, IPSec takes care of encrypting everything above the IP layer (transport, application). Does that mean that if I open a socket between two applications for, say, a chat, that my chat is "secure"? (in the sense that no one can alter the data sent by MITM / impersonate the other side).
There are several modes for IPsec:
These protections are applied on a per packet basis. It is up to the two involved machines to apply protection consistently; it thus depends on their configuration. A sane configuration between two machines is to apply ESP on all packets, and reject unprotected packets from the other machine; in that case, all TCP connections between these two machines will be "protected" in the sense that attackers won't be able to understand the data streams or to inject fake data. However, it will still be plain to attackers that the two machines are involved in some TCP connections (encryption does not hide length, so the initial TCP three-way handshake and the subsequent push/ack mechanism will exhibit a highly recognizable pattern).
ESP with Tunnel Mode is meant mostly for routers and VPN. Typically, a tunnel is opened between two distinct networks, or between a network and an external machine. Attackers will be able to see that data is exchanged between the external machine and the network, but the only IP addresses they will see will be those of the network gateway, and the external machine. The actual target addresses will remain hidden.
Active attackers can always disrupt communications by dropping packets. No amount of IPsec can prevent that.
