The case for ubiquitous transport-level encryption

  • Authors:
  • Andrea Bittau;Michael Hamburg;Mark Handley;David Mazières;Dan Boneh

  • Affiliations:
  • Stanford;Stanford;UCL;Stanford;Stanford

  • Venue:
  • USENIX Security'10 Proceedings of the 19th USENIX conference on Security
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Today, Internet traffic is encrypted only when deemed necessary. Yet modern CPUs could feasibly encrypt most traffic. Moreover, the cost of doing so will only drop over time. Tcpcrypt is a TCP extension designed to make end-to-end encryption of TCP traffic the default, not the exception. To facilitate adoption tcpcrypt provides backwards compatibility with legacy TCP stacks and middle-boxes. Because it is implemented in the transport layer, it protects legacy applications. However, it also provides a hook for integration with application-layer authentication, largely obviating the need for applications to encrypt their own network traffic and minimizing the need for duplication of functionality. Finally, tcpcrypt minimizes the cost of key negotiation on servers; a server using tcpcrypt can accept connections at 36 times the rate achieved using SSL.