Re: How do I know my Connection is Encrypted.

On Mon, Apr 16, 2012 at 09:29:37PM -1000, Mike Gibbons wrote:
> I hadn't understood that some initial key negotiation was in the
> clear, so thank you for that explanation. I am using mppe so from your
> answer I gather that the key exchanges are encrypted.

Yes, but if I recall correctly it is the same key each side, and this
simplifies an attack.

> I believe that my client is configured so all eth0 connections passes
> through ppp0.

Good.  You can verify this by looking for packets transmitted or
received by eth0 that are not protocol GRE.

$ sudo tcpdump -i eth0 -n not proto 47

... and while that command is running, make a connection using some
client application, like a web browser.

If you see packets displayed, and your connection was successful, then
you may suspect that the connection was achieved without use of the
tunnel.

If you see no packets displayed, and there is only the one external
network interface, then you can be reasonably sure that the packets went
via the tunnel.

> You say that the blue line from the target to the client does not
> represent the actual data flow, so does it flow back through the
> server and if so, is it encrypted between the server and the client?

I fear I may have not explained properly, again.

Let me explain using a geography example.

Imagine that you live on a farm.  Call that the client.  A nearby town
is the server.  A city further away is the target.

You are asked to go to the city.  You do it by walking to the town, then
to the city.

The dark blue line on the diagrams is "farm to city".  It is the
intention.  The other line on the diagrams are the actual steps taken;
"farm to town" and "town to city".  These are the implementation.

So with my diagrams, the dark blue line is the intention, or the design,
of a data flow, and the other lines are how the data flow is actually
achieved.

> Lastly, how does the client side verify that encryption has been used
> in the transaction? All the search engine research I have been able to
> do implies this just has to trusted.

I agree, there is no way for an application to verify that encryption
has been used, unless it uses it itself.

An analogy.  You ask your friend to tell another friend a message.  You
ask your friend to use encryption.  You leave them to it.  How can you
tell encryption was used?  You can't, unless you observe or receive the
same message and subject it to analysis.  Even then, the analysis can be
flawed.  If you don't know the encryption method used by your friend,
how can you tell that your message was encrypted?  It might appear to be
noise.

-- 
James Cameron
http://quozl.linux.org.au/

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev