computer science

Tcpcrypt

Tcpcrypt is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Tcpcrypt rather than just read about it. In short: In computer networking, tcpcrypt is a transport layer communication encryption protocol. Unlike prior protocols like TLS (SSL), tcpcrypt is implemented as a TCP extension.

Key takeaways

Tcpcrypt belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Tcpcrypt to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Tcpcrypt from memory before moving on to harder problems.

Reference excerpt

In computer networking, tcpcrypt is a transport layer communication encryption protocol. Unlike prior protocols like TLS (SSL), tcpcrypt is implemented as a TCP extension. It was designed by a team of six security and networking experts: Andrea Bittau, Mike Hamburg, Mark Handley, David Mazières, Dan Boneh and Quinn Slack. Tcpcrypt has been published as an Internet Draft. Experimental user-space implementations are available for Linux, Mac OS X, FreeBSD and Windows. There is also a Linux kernel implementation. The TCPINC (TCP Increased Security) working group was formed in June 2014 by IETF to work on standardizing security extensions in the TCP protocol. In May 2019 the working group released RFC 8547 and RFC 8548 as an experimental standard for Tcpcrypt.

Description Tcpcrypt provides opportunistic encryption — if either side does not support this extension, then the protocol falls back to regular unencrypted TCP. Tcpcrypt also provides encryption to any application using TCP, even ones that do not know about encryption. This enables incremental and seamless deployment. Unlike TLS, tcpcrypt itself does not do any authentication, but passes a unique "session ID" down to the application; the application can then use this token for further authentication. This means that any authentication scheme can be used, including passwords or certificates. It also does a larger part of the public-key connection initiation on the client side, to reduce load on servers and mitigate DoS attacks.

History The first draft of the protocol specification was published in July 2010, with reference implementations following in August. However, after initial meetings in IETF, proponents of the protocol failed to gain traction for standardization and the project went dormant in 2011. In 2013 and 2014, following Edward Snowden's Global surveillance disclosures about the NSA and agencies of other governments, IETF took a strong stance for protecting Internet users against surveillance. This aligns with tcpcrypt's goals of ubiquitous transparent encryption, which revived interest in standardization of the protocol. An official IETF mailing list was created for tcpcrypt in March 2014, followed by the formation of the TCPINC (TCP Increased Security) working group in June and a new version of the draft specification.

Performance Tcpcrypt enforces TCP timestamps and adds its own TCP options to each data packet, amounting to 36 bytes per packet compared to plain TCP. With a mean observed packet size for TCP packets of 471 bytes, this can lead to an overhead of 8% of useful bandwidth. This 36 bytes overhead may not be an issue for internet connections faster than 64kbps but it can be an issue for dial-up internet users. Compared to TLS/SSL, tcpcrypt is designed to have a lower performance impact. In part this is because tcpcrypt does not have built-in authentication, which can be implemented by the application itself. Cryptography primitives are used in such a way to reduce load on the server side, because a single server usually has to provide services for far more clients than the reverse.

Implementations The current user space implementations are considered experimental and are reportedly unstable on some systems. It also does not support IPv6 yet, which is currently only supported by the Linux kernel version. It is expected that once tcpcrypt becomes a standard, operating systems will come with tcpcrypt support built-in, making the user space solution unnecessary.

See also DTLS IPsec Obfuscated TCP – an earlier failed proposal for opportunistic TCP encryption

References

External links tcpcrypt.org at the Wayback Machine (archived 2022-01-23) TCPINC Working Group Charter at IETF Slides from USENIX 2010 presentation, explaining basics of tcpcrypt

Worked examples

Example 1 — a first encounter with Tcpcrypt

Start with the simplest possible case. Write down what Tcpcrypt claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Tcpcrypt before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Tcpcrypt ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Tcpcrypt

In research: Tcpcrypt appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Tcpcrypt in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Tcpcrypt is common in secondary-school and first-year university syllabi. It links to neighbouring topics Cryptographic protocols, Internet security, TCP extensions, so understanding it makes those chapters shorter.
In everyday life: Look for Tcpcrypt outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Tcpcrypt in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Tcpcrypt means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Tcpcrypt out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Tcpcrypt in simple terms?

In computer networking, tcpcrypt is a transport layer communication encryption protocol. Unlike prior protocols like TLS (SSL), tcpcrypt is implemented as a TCP extension.

Why does Tcpcrypt matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Tcpcrypt?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Tcpcrypt.