Encrypt Your Network Traffic - Tcpcrypt
Tcpcrypt is a protocol that attempts to encrypt (almost) all of your network traffic. Unlike other security mechanisms, Tcpcrypt works out of the box: it requires no configuration, no changes to applications, and your network connections will continue to work even if the remote end does not support Tcpcrypt, in which case connections will gracefully fall back to standard clear-text TCP. Install Tcpcrypt and you’ll feel no difference in your every day user experience, but yet your traffic will be more secure and you’ll have made life much harder for hackers.
So why is now the right time to turn on encryption? Here are some reasons:
ºIntercepting communications today is simpler than ever because of wireless networks. Ask a hacker how many e-mail passwords can be intercepted at an airport by just using a wifi-enabled laptop. This unsophisticated attack is in reach of many. The times when only a few elite had the necessary skill to eavesdrop are gone.
ºComputers have now become fast enough to encrypt all Internet traffic. New computers come with special hardware crypto instructions that allow encrypted networking speeds of 10Gbit/s. How many of us even achieve those speeds on the Internet or would want to download (and watch) one movie per second? Clearly, we can encrypt fast enough.
ºResearch advances and the lessons learnt from over 10 years of experience with the web finally enabled us to design a protocol that can be used in today’s Internet, by today’s users. Our protocol is pragmatic: it requires no changes to applications, it works with NATs (i.e., compatible with your DSL router), and will work even if the other end has not yet upgraded to tcpcrypt—in which case it will gracefully fall back to using the old plain-text TCP. No user configuration is required, making it accessible to lay users—no more obscure requests like “Please generate a 2048-bit RSA-3 key and a certificate request for signing by a CA”. Tcpcrypt can be incrementally deployed today, and with time the whole Internet will become encrypted.
How Tcpcrypt works
Tcpcrypt is opportunistic encryption. If the other end speaks Tcpcrypt, then your traffic will be encrypted; otherwise it will be in clear text. Thus, Tcpcrypt alone provides no guarantees—it is best effort. If, however, a Tcpcrypt connection is successful and any attackers that exist are passive, then Tcpcrypt guarantees privacy.
Network attackers come in two varieties: passive and active (man-in-the-middle). Passive attacks are much simpler to execute because they just require listening on the network. Active attacks are much harder as they require listening and modifying network traffic, often requiring very precise timing that can make some attacks impractical.
By default Tcpcrypt is vulnerable to active attacks—an attacker can, for example, modify a server’s response to say that Tcpcrypt is not supported (when in fact it is) so that all subsequent traffic will be clear text and can thus be eavesdropped on.
Tcpcrypt, however, is powerful enough to stop active attacks, too, if the application using it performs authentication. For example, if you log in to online banking using a password and the connection is over Tcpcrypt, it is possible to use that shared secret between you and the bank (i.e., the password) to authenticate that you are actually speaking to the bank and not some active (man-in-the-middle) attacker. The attacker cannot spoof authentication as it lacks the password. Thus, by default, Tcpcrypt will try its best to protect your traffic. Applications requiring stricter guarantees can get them by authenticating a Tcpcrypt session.
Installing tcpcrypt
$ git clone git://github.com/scslab/tcpcrypt.git
$ cd tcpcrypt
$ ./bootstrap.sh
$ ./configure
$ make
$ sudo ./launch_tcpcryptd.sh
The launch script starts tcpcryptd and adds firewall rules to divert all TCP traffic — except that which is already encrypted, like SSH — to tcpcryptd. When the script exits (on Ctrl-C or kill), it restores your firewall config to its former state — no permanent changes are made.
On Linux, you must first install libnfnetlink, libnetfilter_queue, and libcap.
Optional: running make install will install libtcpcrypt and tcpcrypt headers, for building apps that use tcpcrypt’s session ID.
Try it out
Go to http://tcpcrypt.org/test.php with tcpcryptd running. If tcpcrypt is working, you’ll be able to join the tcpcrypt Hall of Fame and your tcpcrypt session ID will be displayed at the bottom of the page.
Now let’s examine the packets going over the wire by starting tcpdump and then reloading the URL above.
sudo tcpdump -X -s0 host tcpcrypt.org
Compare this tcpdump output, which appears encrypted (or at least unreadable), with the cleartext packets you would see without tcpcryptd running.
A final netcat example:
$ sudo ./launch_tcpcryptd.sh &
$ nc -l 7777 &
$ sudo tcpdump -i lo -n -s0 -vvvv -X tcp port 7777 &
$ echo hello, world! | nc localhost 7777
# clean up
$ sudo killall tcpcryptd tcpdump
Troubleshooting
If it’s not working, the most likely causes are the following.
ºYour browser already had an open, non-tcpcrypted TCP connection to tcpcrypt.org before you ran the launch script. Quit and reopen your browser, wait 30 seconds, or use a different browser to retrieve the tcpcrypt.org URL.
ºThere’s a conflict with your existing firewall rules. See the firewall setup section in the install guide for your platform.
