What are the advantages of using end-to-end and link encryption together? In which situation we can use both? If I understand correctly. In link encryption, all data are encrypted, including headers, addresses, and routing information. So at each router it is decrypted to see the details and encrypted again and forwarded to next hop. Right? In end-to-end encryption, Headers, addresses, and routing information are not encrypted, and therefore not protected. So when we use both together at the end using link encryption all the data would be encrypted.
1
-
$\begingroup$ Sounds about right to me... $\endgroup$– SEJPMNov 3, 2016 at 17:43
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Link encryption isn't really a cryptographic concept, it's more a kind of networking protocol.
Link encryption protects the message only "on the wire" between routers. Looking at the OSI model, that would be on layer 2. And yes, it therefore is applied on all things regarding routing.
However, if you look at the Wikipedia article about link encryption, they list two advantages:
- encryption is automatic so there is less opportunity for human error.
- if the communications link operates continuously and carries an unvarying level of traffic, link encryption defeats traffic analysis.
And that's just nonsense.
Link encryption is useful in some scenarios, for example if you have to worry about wiretapping and you trust the routers. This does make sense, for example in a military communication network, or some other organization where routing stations are part of it. Additionally, you need some way to know or agree on cryptographic keys, and having a key exchange for every "layer 2"-package would be a performance nightmare.
However, if you don't trust the routers, then link encryption just adds extra effort for encryption and decryption and no benefit at all. If you consider something like man-in-the-middle attacks, then those attackers actually are usually routers (or can act as one). And in fact, you need to give routers the routing information (including adresses of senders and receivers) so that they can do their job.
So if you're thinking about Internet traffic, this doesn't make any sense, and it doesn't increase security. However, you could consider the wireless networking protocols (e.g. WPA2, UMTS, ...) as link encryption on that insecure communication channel, which is easy to monitor.
Other than that, I don't think the concept offers much more, and it really depends on the level of trust and the situation. I don't see any benefit in having link encryption between all routers - if you don't control the routers yourself.
