| SPDX-FileCopyrightText | © 2026 Menacit AB <foss@menacit.se> | |||||
|---|---|---|---|---|---|---|
| SPDX-License-Identifier | CC-BY-SA-4.0 | |||||
| title | Practical cryptography course: Network encryption tools | |||||
| author | Joel Rangsmo <joel@menacit.se> | |||||
| footer | © Course authors (CC BY-SA 4.0) | |||||
| description | An introduction to several tools used for network traffic encryption | |||||
| keywords |
|
|||||
| color | #ffffff | |||||
| class |
|
|||||
| style | section.center { text-align: center; } table strong { color: #d63030; } table em { color: #2ce172; } |
Network traffic can be intercepted anywhere between your phone in a café and TikTok's fancy data center in Shenzhen.
Cryptography is used to protect confidentiality and integrity of communication.
We've talked about TLS, let's have a look at the other network layers.
- Physical layer
- Data link layer
- Network layer
- Transport layer
Session layerPresentation layer- Application layer
Common vocabulary, not reality.
- Link layer (most commonly Ethernet)
- Internet layer (IPv4 or IPv6)
- Transport layer (TCP, UDP, ICMP...)
- Application layer (DNS, HTTP, TLS...)
| "OSI model" layer | "TCP/IP model" layer |
|---|---|
| 1: Physical | N/A |
| 2: Data link | 1: Link |
| 3: Network | 2: Internet |
| 4: Transport | 3: Transport |
| 7: Application | 4: Application |
OCI model still acts as Interlingua.
Used to protect high-bandwidth/legacy links.
"Transparent encryption" of all communication that is provided by pricey HW.
Easy to implement, suitable for legacy networks and compliance checkboxes.
Open standard that extends Ethernet.
Uses AES-GCM for confidentiality and integrity.
Supported in fancy switches at "line-rate".
Leaks a bit of metadata (which MAC addresses communicate with eachother).
Family of open standards to provide a secure version of IP.
Supported by most OSes and network appliances.
Act in "host-to-host" or "routed" mode.
Quiet a mess with gazillion different options for encryption, integrity checking and authentication.
Performant alternative to TCP that was initially developed by Google.
Uses UDP and cryptographic protections based on TLS version 1.3.
~Used by HTTP version 3 and DNS-over-QUIC.
Virtual Private Network.
Creates a virtual network link between computers.
Access is restricted and traffic encrypted.
"Site-to-site" or "user-to-site".
Network traffic is routed through a VPN provider and NATed to the Internet.
Connection peers will see the VPN provider's IP address as source, not the "real one".
Typically sold as penicillin for security, don't believe the marketing!
How do you really know that they don't log or try to manipulate your traffic?
Oldie but goldie!
Supports tunneling of OSI L2 and L3 traffic.
PSK or X.509 for peer authentication.
Supports storing client credentials on HW token such as the YubiKey.
Tons of configuration options, for better or worse.
Fast, modern and minimal.
Only L3.
Built-in support in Linux and *BSD kernels, software available for other OSes.
Easy to use software for setting up a "mesh VPN" (direct connections between all peers).
No need to send all traffic through some centralized servers.
Uses a bag of "NAT hole punching" techniques and WireGuard under the hood.
Connections are authenticated and established through a proprietary cloud service, may be replaced with the self-hostable "Headscale".
Physical and virtual appliances providing VPN functionality.
Easy setup and lots of fancy management functionality.
Often decent cryptographic algorithms, but riddled with other vulnerabilities.
You don't want your edge security products to be broken - stay away from these!
Which option should I choose?
Well, that depends on your use-case - more than one, get some defense in depth!