Opportunistic encryption

Opportunistic encryption, often abbreviated OE is the attempt to arrange network communication systems so that any two nodes can encrypt their communication, without any connection-specific setup by the system administrators. Once two machines are set up for OE, they can set up secure connections automatically.

One large benefit is a reduction in administrative workload. If the administrators must set up every connection, the effort required for a fully connected network of N machines scales by N². There are several ways to avoid this disaster on large networks, including using a centralised authentication system such as Kereberos, or putting in hardware to encrypt at link level, or using IPsec to encrypt at network level. Any of these can reduce the workload to something manageable. OE, however, cuts the Gordian knot. For OE, the effort scales linearly; the work to set up N machines for OE is just N.

Another benefit is that more connections may be encrypted. Once OE is set up, any two OE-capable machines can secure their connections. If OE is sufficiently widespread, secure connections can be the default.

Like any encryption scheme, an OE system must rely on some form of source authentication. It does no good at all to encrypt messages so that only the recipient can read them unless the recipient is who you think it is. Different OE designs rely on different authentication mechanisms; see individual articles for details.

Opportunistic encryption for IP

The term "opportunistic encryption" comes from the FreeS/WAN project, who built OE into a Linux implementation of IPsec. They relied on DNS to manage authentication data. RFC 4322 "Opportunistic Encryption using the Internet Key Exchange (IKE)" documents that design. Used alone, this would be secure against passive attacks; add DNS security to protect the authentication data and it is also secure against active attacks.

The Planete project are building OE for IPv6. They claim "Unlike existing schemes (e.g. FreeS/WAN), our proposal does not rely on any global Third Trusted Party (such as DNSSEC or a PKI). Hence, we claim it is more secure, easier to deploy and more robust."

Alternatives

Another way to use IPsec with reduced administrative overheads is better-than-nothing security or BTNS, IPsec done without authentication. This gives the same security level as OE done without DNS security.

Normal IPsec, OE and BTNS are all secure against passive eavesdroppers who only try to listen in; encrypting the connection stops them. Normal IPsec, or OE with secure DNS, are also secure against active attackers who try to trick systems into communicating with them instead of legitimate partners. BTNS, or OE without secure DNS, are not; you need authentication to block those attacks.

Another system which defends against passive attacks but may be vulnerable to man-in-the-middle attacks is Google's obfuscated TCP.

A newer effort is TCP crypt.