Opportunistic encryption

Opportunistic encryption, often abbreviated OE is the attempt to arrange network communication systems so that any two nodes can encrypt their communication, without any connection-specific setup by the system administrators. Once two machines are set up for OE, they can set up secure connections automatically.

One large benefit is a reduction in administrative workload. If the administrators must set up every connection, the effort required for a fully connected network of N machines scales by N². There are several ways to avoid this disaster on large networks, including using a centralised authentication system such as Kereberos, or putting in hardware to encrypt at link level, or IPsec to encrypt at network level. Any of these can reduce the workload to something manageable. OE, however, cuts the Gordian knot. For OE, the effort scales linearly; the work to set up N machines for OE is just N.

Another benefit is that more connections may be encrypted. Once OE is set up, any two OE-capable machines can secure their connections. If OE is sufficiently widespread, secure connctions can be the default.

Like any encryption scheme, an OE system must rely on some form of source authentication. It does no good at all to encrypt messages so that only the recipient can read them unless the recipient is who you think it is. Different OE designs rely on different authentication mechanisms; see individual articles for details.

Using OE without authentication is also possible. This is secure against passive eavesdroppers who only try to listen in; encrypting the connection stops them. However, it is completely insecure against active attackers who may try to trick systems into communicating with them instead of legitimate partners; you need authentication to block that.

Systems using OE

The term "opportunistic encryption" comes from the FreeS/WAN project, who built OE into a Linux implementation of IPsec. They relied on DNS to manage authentication data. RFC 4322 "Opportunistic Encryption using the Internet Key Exchange (IKE)" documents that design.

The most widely deployed OE system encrypts server-to-server SMTP mail transfers. The original implementation was ssmail or Secure Sendmail [1]. The current standard is RFC 3207. This does not provide all of the benefits of end-to-end mail encryption systems such as PGP; in particular it provides no protection against an enemy with privileged access to one of the mail servers involved. However, it does prevent attacks at routers between the mail servers. It provides partial protection against wholesale mail monitoring, forcing a government to subvert mail servers or get their owners to co-operate if it wants to monitor.

The Planete project are building OE for IPv6. They claim "Unlike existing schemes (e.g. FreeS/WAN), our proposal does not rely on any global Third Trusted Party (such as DNSSEC or a PKI). Hence, we claim it is more secure, easier to deploy and more robust."