Chapter 5

Summary

In this chapter, we have had a detailed look at X.509 Certificates: what they are, what they contain, and how to make them. We have also looked at how they may be used in Openswan and covered the configuration options you need, as well as other technologies related to them.

129

6

Opportunistic Encryption

This chapter will describe how Openswan can encrypt more than just a few prearranged tunnels. It will discuss:

•The concept of Opportunistic Encryption

•Storing IPsec information in DNS

•The different kinds of Opportunistic Encryption

•Subnet protection using Opportunistic Encryption

•Policy Groups for tuning Opportunistic Encryption

So far, we have used IPsec to secure communications between places and people we know. We have connected laptops, and branch offices, and secured some server-to-server and subnet-to- subnet connections. All these connections had one thing in common: we knew beforehand who we wanted to talk to, and we had some trusted method of communicating with the other side to set up our crypto arrangements. We exchanged a public key through email, used a phone call to verify the email was not tampered with, or used the PGP web of trust to verify the digital signature on the email. Or we were in control of both machines, and could transfer keys using other secure protocols such as SSH. We have seen that setting up IPsec is not that difficult, and now we are ready for an important question:

Why can't we talk IPsec to everyone by default?

The short answer is "We can." The long answer is this chapter.

In the old days of the Internet, when there was no spam, no copyright infringements, and no commercially-driven content, everyone shared everything. And when people got an IP packet, they went out of their way to assist and see if they could deliver it. This is no longer the case, with a few exceptions such as the big European Internet Exchanges. IP packets no longer go the shortest way, the fastest way, the reliable way, or the secure way. They go the cheapest way, and we all know that cheap and secure are mutually exclusive. In the old days, we also had a few trusted networks that interconnected. Now we have absolutely no idea if we can trust anyone with our packets. The result was that people scrambled to secure various protocols with additional layers, now mostly standardized using SSL/TLS for a very few sensitive websites, PGP or S/MIME for email, and IPsec for VPNs.