Opportunistic Encryption

Description

The main idea of opportunistic encryption is to deploy security gateways that will sit between the border of intranets (private networks) and the Internet. A gateway intercepts an outgoing packet aimed at a remote host, and attempts to negotiate an IPsec tunnel to that host's security gateway. If the attempt succeeds, traffic can then be secured transparently (without changes to the end-host software). If the attempt fails, packets are sent through in the clear or dropped, according to the local policy. Opportunistic encryption allows secure (encrypted, authenticated) communication via IPsec without connection-by-connection pair-wise pre-arrangement.

Our Opportunistic Encryption scheme for IPv6 relies on IPv6 Anycast, Authorization certificates and Crypto-Based Identifiers (CBID) to provide secure and easily deployable Opportunistic Encryption in IPv6.

Unlike existing schemes (e.g. FreeS/WAN), our proposal does not rely on any global Third Trusted Party (such as DNSSEC or a PKI). Hence, we claim it is more secure, easier to deploy and more robust.

More information about our Opportunistic Encryption proposal is available in the following publications:

• Claude Castelluccia, Gabriel Montenegro, Julien Laganier, and Christoph Neumann, "Hindering Eavesdropping via IPv6 Opportunistic Encryption", In Proc. of 9th European Symposium on Research in Computer Security (ESORICS 2004). Lecture Notes in Computer Science (LNCS), Springer-Verlag, September 2004 (PDF).
• Claude Castellucia and Gabriel Montenegro, "IPv6 Opportunistic Encryption", INRIA Research Report Number 4568, October 2002 (PDF).

Source Code: OE-SPKI library

This library offers basic functionalities to handle SPKI certificates in the context of Opportunistic Encryption (OE).

The latest release...

• OEspki_v0.1 (gzipped tar), (February 9th, 2005)

Old releases...

• Nothing here yet.

Local Contact and Feedback

Claude Castelluccia, (claude_DOT_castelluccia_AT_inria_DOT_fr).
Gabriel Montenegro, (gab_AT_sun_DOT_com).
Julien Laganier, (julien_DOT_laganier_AT_sun_DOT_com).
Christoph Neumann, (christoph_DOT_neumann_AT_inria_DOT_fr).

Last Updated: 09-02-2005.