Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Best practices for encrypting continuous/small UDP data

Tags:

encryption

udp

I am having an application where I have to send several small data per second through the network using UDP. The application needs to send the data in real-time (no waiting). I want to encrypt these data and ensure that what I am doing is as secure as possible.

Since I am using UDP, there is no way to use SSL/TLS, so I have to encrypt each packet alone since the protocol is connectionless/unreliable/unregulated.

Right now, I am using a 128-bit key derived from a passphrase from the user, and AES in CBC mode (PBE using AES-CBC). I decided to use a random salt with the passphrase to derive the 128-bit key (prevent dictionary attack on the passphrase), and of course use IVs (to prevent statistical analysis for packets).

However I am concerned about few things: Each packet contains small amount of data (like a couple of integer values per packet) which will make the encrypted packets vulnerable to known-plaintext attacks (which will result in making it easier to crack the key). Also, since the encryption key is derived from a passphrase, this will make the key space way smaller (I know the salt will help, but I have to send the salt through the network once and anyone can get it). Given these two things, anyone can sniff and store the sent data, and try to crack the key. Although this process might take some time, once the key is cracked all the stored data will be decrypted, which will be a real problem for my application.

So my question is, what are the best practices for sending/encrypting continuous small data using a connectionless protocol (UDP)? Is my way the best way to do it? ...flowed? ...Overkill?

Please note that I am not asking for a 100% secure solution, as there is no such thing.

like image 809
temp Avatar asked Jun 14 '10 19:06

temp


People also ask

Can UDP data be encrypted?

Security for UDP The connection-oriented methods of TCP make security much easier to implement in that protocol in UDP. However, there are encryption standards available for UDP. The main option that directly aims at security UDP is the Datagram Transport Layer Security protocol or DTLS.

How do I make UDP more secure?

The simple approach is to use any off the self strong encryption. To prevent tampering use any signing algorithm with a private/public key scheme. You can use the same key pair for encryption and authentication. The drawback of this approach is that it is on layer 7 and you have to do most of the work on your own.

How is UDP encrypted?

To provide encryption to secure UDP packets, Open 3D Engine uses OpenSSL to implement DTLS (Datagram Transport Layer Security). The O3DE AzNetworking framework provides the DtlsSocket and DtlsEndpoint classes to enable DTLS over UDP.

What encryption does UDP use?

In practice, there are two protocols which can currently be used for practical UDP encryption: DTLS (using, for example, [OpenSSL]) and QUIC (using [libquic]).


1 Answers

You have several choices. You can use DTLS, which is a version of TLS adapated for datagrams. It is specified in an RFC and implemented in the openssl library. You can also use the IKE/IPsec protocol and use a UDP encapsulation of the IPsec portion. Usually IPsec is available at the OS level. You can also use OpenVPN, which looks to be a hybrid of TLS for key exchange and a proprietary UDP-based packet encryption protocol.

like image 99
President James K. Polk Avatar answered Sep 22 '22 19:09

President James K. Polk