World Library  
Flag as Inappropriate
Email this Article

Obfuscated TCP

Article Id: WHEBN0022729558
Reproduction Date:

Title: Obfuscated TCP  
Author: World Heritage Encyclopedia
Language: English
Subject: Transmission Control Protocol, Opportunistic encryption, Tcpcrypt
Collection: Transmission Control Protocol
Publisher: World Heritage Encyclopedia
Publication
Date:
 

Obfuscated TCP

Obfuscated TCP (ObsTCP) was a proposal for a transport layer protocol which implements opportunistic encryption over TCP. It was designed to prevent mass wiretapping and malicious corruption of TCP traffic on the Internet, with lower implementation cost and complexity than TLS. In August 2008, IETF rejected the proposal for a TCP option, suggesting it be done on the application layer instead.[1] The project has been inactive since a few months later.

In 2010 June, a separate proposal called tcpcrypt has been submitted, which shares many of the goals of ObsTCP: being transparent to applications, opportunistic and low overhead. It requires even less configuration (no DNS entries or HTTP headers). Unlike ObsTCP, tcpcrypt also provides primitives down to the application to implement authentication and prevent man-in-the-middle attacks.[2]

Contents

  • Historical origin 1
  • Encryption features 2
  • Comparison with TLS/SSL/HTTPS 3
  • Connection establishment 4
  • See also 5
  • References 6

Historical origin

ObsTCP was created by Adam Langley. The concept of obfuscating TCP communications using opportunistic encryption evolved through several iterations. The experimental iterations of ObsTCP used TCP options in 'SYN' packets to advertise support for ObsTCP, the server responding with a public key in the 'SYNACK'. An IETF draft protocol was first published in July 2008. Packets were encrypted with Salsa20/8,[3] and signed packets with MD5 checksums.[4]

The present (third) iteration uses special DNS records (or out of band methods) to advertise support and keys, without modifying the operation of the underlying TCP protocol.[5]

Encryption features

ObsTCP is a low cost protocol intended to protect TCP traffic, without requiring public key certificates, the services of Certificate Authorities, or a complex Public Key Infrastructure. It is intended to suppress the use of undirected surveillance to trawl unencrypted traffic, rather than protect against man in the middle attack.

The software presently supports the Salsa20/8[3] stream cipher and Curve25519[6] elliptic-curve Diffie Hellman function.

Comparison with TLS/SSL/HTTPS

Feature ObsTCP SSL/TLS/HTTPS
Public Key Infrastructure Does not require a signed public key certificate Requires that a signed public key certificate is purchased (or self signed certificate is used)
Web browser support Patched versions of Firefox available[7] Widely supported by all popular web browsers
Web server support Requires patches/server upgrades for lighttpd and Apache[8] Widely supported by popular web servers
Network latency Nil additional round trips per connection (though DNS lookup may be required to obtain key advertisement) One or two additional round trips per connection
Encryption speed Very fast cryptography Slower
TCP port Can use any TCP port Typically uses port 443
Security characteristics Does not resist some man in the middle attacks Resists man in the middle attacks

Internet Protocol Security (IPsec), the protocol for IP encryption and authentication, forms an integral part of the base protocol suite in IPv6. IPsec support is mandatory in IPv6; this is unlike IPv4, where it is optional.

Connection establishment

A server using ObsTCP advertises a public key and a port number.

A DNS 'A record' may be used to advertise server support for ObsTCP (with a DNS 'CNAME record' providing a 'friendly' name). HTTP header records, or cached/out of band keyset information may also be used instead.

A client connecting to an ObsTCP server parses the DNS entries, uses HTTP header records, or uses cached/out of band data to obtain the public key and port number, before connecting to the server and encrypting traffic.

See also

References

  1. ^ Adam Langley (2008-08-15). "Sorry folks, I think Obfuscated TCP died". Obfuscated TCP development blog. 
  2. ^ Andrea Bittau, et al. (2010-08-13). "The case for ubiquitous transport-level encryption". 19th USENIX Security Symposium. 
  3. ^ a b "Snuffle 2005". cr.yp.to. Retrieved 2009-05-08. 
  4. ^ "Extending the Space Available for TCP Options". IETF. Retrieved 2009-05-08. 
  5. ^ "Obfuscated TCP History". Google. Retrieved 2009-05-08. 
  6. ^ "Curve25519: high-speed elliptic-curve cryptography". cr.yp.to. Retrieved 2009-05-08. 
  7. ^ "Obfuscated TCP Clients: Firefox". Google. Retrieved 2009-05-08. 
  8. ^ "Installing ObsTCP using the ObsTCP transport layer". Google. Retrieved 2009-05-08. 
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
 
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
 
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.
 


Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.