IPsec

IPsec, which is the short form for IP Security, is a set of protocols developed by the IETF to support secure exchange of packets at the IP layer. It's main purpose is to support VPN, which is exactly, what we are looking for. For IPsec to work, the sending and receiving devices must share a public key. This is a accomplished through a protocol known as Internet Security Association and Key Management Protocol (ISAKMP), which allows the receiver to obtain a public key and authenticate the sender using digital certificates.

There are two modes of IPsec - tunnel and transport mode. Tunnel mode is used for secure communication between subnets, this is very useful for connecting two company-sites, for example. The solution we are looking for is called Transport mode. IPsec should guarantee, that the packets are encrypted, authenticated and anti-replay protected. IPsec encrypts every IP packet which requires that it reside in the kernel of an operating system, and not in userspace.

By design, IPsec communication is encrypted by symmetric algorithms (Blowfish, DES, 3DES). The whole packet is not encrypted, only the data (payload), not the IP-Headers. This is known as ESP-Mode. encrypted (and authenticated) headers can be achieved with Authentication Header (AH) mode. We will only focus on ESP-Mode, as we are interested in encrypting our data traffic, and are not interested in authentication in this layer.

Authentication can be done with a pre-shared key (which is considered weak) or by using certificates, which is quite a secure solution.

IPsec is our first choice, as it is an approved IETF standard, free implementations exist, and Windows, Mac, Pocket PC, Linux and BSD clients support it.