Opportunistic Encryption Using IPsec
summary
Libreswan uses the kernel XFRM kernel hooks to get netflow events, dynamically run IKEv2 to create XFRM states and encrypt host-to-host traffic, and it can preemptively trigger setup from DNS lookups. Configurations show X.509 and LetsEncrypt certificate use and planned GSSAPI or DNSSEC IPSECKEY support; a demo assigns a tunnel address inside the IPsec subsystem and successfully encrypts subsequent packets. Workarounds include packet caching for TCP and a VTI/tcpdump visibility fix; a lingering 96-bit truncation bug still affects ~1.4 billion devices.
AI-written summary · about
chapters (18)
- 0:00Intro
- 3:00What is IPsec
- 6:20History of IPsec
- 7:10What is Libreswan
- 11:48What happened to IPsec
- 15:57John Gilmour gave up
- 24:05IPsec v2
- 28:32NSA
- 31:33Linux Implementation
- 34:35Opportunistic Encryption
- 35:55The Problem
- 38:38Configuration
- 41:17Internal Configuration
- 43:32Anonymous IPsec
- 43:56Lets Encrypt
- 45:00Demo
- 46:33Server config
- 48:02Features
related talks
42mIPsec development for large scale deployments
26mThe Dangers of Key Reuse: Practical Attacks on IPsec IKE
20mConnecting, Securing and Optimising Enterprise Networks with Free Software
48mWireGuard: Next Generation Abuse-Resistant Kernel Network Tunnel
25mOver view of linux tunnels
28mPsycho Security - End to End Encryption
33mFull-Mesh IPsec Network: 10 Dos and 500 Don'ts
21mHow to Use XDP and eBPF to Accelerate IPSec Throughput by 400%