Secure network protocols (TLS, SSH, VPN)

A secure protocol sends data so that it stays private and unchanged, and proves who is at the other end. Old protocols did none of these.

You can swap most of them for a protected partner by changing a setting.

A shop manager logs in to a server from a cafe. If the login travels as plain text, anyone on the cafe wifi can read the password.

Secrecy: nobody on the way can read the data. That is encryption.

Integrity: nobody can change the data without being noticed.

Identity: you are talking to the right server, not a fake. A certificate or a stored key proves it.

A protocol missing one promise leaves a gap that an attacker uses.

printf 'pay 100 pounds' | sha256sum

printf 'pay 900 pounds' | sha256sum

A hash function turns any message into a short fingerprint. Change one character and the fingerprint changes completely.

The first message gives a fingerprint that starts 26c42532. The second starts e71dd267. They share nothing, although only one digit differs.

This is how integrity works. The sender sends a protected fingerprint, and the receiver checks it. If the two differ, the message was changed.

With TLS, the server shows a certificate. A trusted authority has signed it to say "this key belongs to this name". The browser checks the signature and the name before it sends anything private.

Then both sides agree a fresh key, and everything after is encrypted.

With SSH, a login is protected the same way. The best practice is to log in with a key pair, not a password, because a stolen password works from anywhere.

# An example only: a gateway's settings.
PermitRootLogin no
PasswordAuthentication no
MinTlsVersion 1.2
Ciphers chacha20,aes256
ListenAddress 10.0.0.1
DnsMode protected

A protected protocol can still be set up badly. The example above has good choices: no root login, no passwords, a modern TLS floor, no weak ciphers and a named listening address.

Change one line to PermitRootLogin yes or MinTlsVersion 1.0 and the same software becomes weak. A review looks at the settings, not only the name of the protocol.

The Domain Name System (DNS) turns a name into an address. A plain DNS question is sent as readable text, and the answer is not signed.

So someone on the path can see which sites you ask for. They can also send a false answer that sends you to a fake server.

DNS over TLS and DNS over HTTPS encrypt the question. DNSSEC signs the answer. The safest set-up uses a protected resolver.

TLS and SSH protect one kind of traffic. A tunnel protects all the traffic between two points, whatever it is.

A tunnel is the right tool when two sites must share old software that has no protection of its own. It wraps everything in one encrypted layer.

wglab status

wg genkey | wg pubkey | wc -c

The first Run lists four machines. The two gateways each have a second address on wan0, the link that stands for the open internet. Anything that crosses it can be watched.

The second Run makes a private key, turns it into the public key and counts it, without printing either. It prints 45: the public key's 44 characters and the newline.

The private key is gone with the command. Nothing was saved.