# Tcpcrypt
> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Tcpcrypt
> Markdown URL: https://mediated.wiki/source/Tcpcrypt.md
> Source: https://en.wikipedia.org/wiki/Tcpcrypt
> Source revision: 1304764583
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)
{{Short description|Transport layer communication encryption protocol}}
{{Lowercase title}}
{{Infobox software
| name = Tcpcrypt
| title =
| logo =
| logo caption =
| screenshot =
| caption =
| collapsible =
| author = Andrea Bittau, Mike Hamburg, [Mark Handley](/source/Mark_Handley_(computer_scientist)), David Mazières, [Dan Boneh](/source/Dan_Boneh) and Quinn Slack.
| developer =
| released =
| discontinued =
| latest release version =
| latest release date = {{Start date and age|2011|05|02|df=yes/no}}
| latest preview version =
| latest preview date =
| frequently updated =
| status =
| programming language =
| operating system =
| platform =
| size =
| language =
| language count =
| language footnote =
| genre = communication [encryption](/source/encryption) protocol
| license =
| alexa =
| website = {{webarchive |url=https://web.archive.org/web/20220123234541/http://www.tcpcrypt.org/|title=tcpcrypt.org}}
| standard =
| AsOf =
}}
In [computer networking](/source/computer_networking), '''tcpcrypt''' is a [transport layer](/source/transport_layer) communication [encryption](/source/encryption) protocol.[{{cite conference |author=Andrea Bittau|date=2010-08-13 |title=The case for ubiquitous transport-level encryption |publisher=19th USENIX Security Symposium |url=http://www.usenix.org/events/sec10/tech/full_papers/Bittau.pdf |display-authors=etal}}][{{cite news |author=Michael Cooney |date=2010-07-19 |title=Is ubiquitous encryption technology on the horizon? |url=http://www.networkworld.com/community/node/63871 |publisher=[Network World](/source/Network_World) |archive-date=2013-10-20 |access-date=2010-08-27 |archive-url=https://web.archive.org/web/20131020021350/http://www.networkworld.com/community/node/63871 |url-status=dead }}] Unlike prior protocols like [TLS](/source/Transport_Layer_Security) (SSL), tcpcrypt is implemented as a [TCP](/source/Transmission_Control_Protocol) extension. It was designed by a team of six security and networking experts: Andrea Bittau, Mike Hamburg, [Mark Handley](/source/Mark_Handley_(computer_scientist)), David Mazières, [Dan Boneh](/source/Dan_Boneh) and Quinn Slack.[{{cite web |title=tcpcrypt – About us |publisher=tcpcrypt.org |url=http://tcpcrypt.org/aboutus.php |access-date=2010-08-27 |archive-date=2015-03-28 |archive-url=https://web.archive.org/web/20150328230745/http://tcpcrypt.org/aboutus.php |url-status=dead }}] Tcpcrypt has been published as an Internet Draft.[{{cite IETF |title= Cryptographic protection of TCP Streams (tcpcrypt) |draft=draft-bittau-tcpinc-01 |last=Bittau |first=A. |author2=D. Boneh |author3=M. Hamburg |author4=M. Handley |author5=D. Mazieres |author6=Q. Slack |date=21 July 2014 |publisher=[IETF](/source/Internet_Engineering_Task_Force) }}] Experimental [user-space](/source/user-space) implementations are available for Linux, Mac OS X, FreeBSD and Windows. There is also a [Linux kernel](/source/Linux_kernel) implementation.
The TCPINC (TCP Increased Security) [working group](/source/working_group) was formed in June 2014 by [IETF](/source/Internet_Engineering_Task_Force) to work on standardizing security extensions in the TCP protocol.[{{cite web |title=TCP Increased Security (tcpinc) |work=Charter for Working Group |accessdate=25 July 2014 |url=https://datatracker.ietf.org/wg/tcpinc/charter/ }}] In May 2019 the working group released {{IETF RFC|8547}} and {{IETF RFC|8548}} as an experimental standard for Tcpcrypt.
== Description ==
Tcpcrypt provides [opportunistic encryption](/source/opportunistic_encryption) — if either side does not support this extension, then the protocol falls back to regular unencrypted TCP. Tcpcrypt also provides encryption to any application using TCP, even ones that do not know about encryption. This enables incremental and seamless deployment.[{{cite news |author=Jake Edge |date=2010-08-25 |title=Transport-level encryption with Tcpcrypt |publisher=[LWN.net](/source/LWN.net) |url=https://lwn.net/Articles/401943/ }}]
== History ==
The first draft of the protocol specification was published in July 2010, with [reference implementation](/source/reference_implementation)s following in August. However, after initial meetings in IETF, proponents of the protocol failed to gain traction for standardization and the project went dormant in 2011.[{{cite mailing list |author=Mark Handley |date=9 September 2013 |title=Kernel patch for Linux 3.10.10? |quote=Two years ago we failed to get much traction for the takeup of tcpcrypt. |url=https://mailman.stanford.edu/pipermail/tcpcrypt-dev/2013-September/000047.html }}]
In 2013 and 2014, following [Edward Snowden](/source/Edward_Snowden)'s [Global surveillance disclosures](/source/Global_surveillance_disclosures_(2013%E2%80%93present)) about the [NSA](/source/National_Security_Agency) and agencies of other governments, IETF took a strong stance for protecting Internet users against surveillance.[{{cite news |author=Richard Chirgwin |date=14 May 2014 |title=IETF plans to NSA-proof all future internet protocols |publisher=[The Register](/source/The_Register) |url=https://www.theregister.co.uk/2014/05/14/ietf_documents_start_of_its_privacy_battle/ }}][{{cite news |author=Mark Jackson |date=13 May 2014 |title=IETF Commits to Hamper State Sponsored Mass Internet Surveillance |publisher=ISP Review |url=http://www.ispreview.co.uk/index.php/2014/05/ietf-commits-hamper-state-sponsored-mass-internet-surveillance.html }}] This aligns with tcpcrypt's goals of ubiquitous transparent encryption, which revived interest in standardization of the protocol. An official IETF [mailing list](/source/mailing_list) was created for tcpcrypt in March 2014,[{{cite mailing list |title=New Non-WG Mailing List: Tcpcrypt -- Discussion list for adding encryption to TCP |date=24 March 2014 |publisher=IETF Secretariat |url=http://www.ietf.org/mail-archive/web/tcpcrypt/current/msg00000.html }}] followed by the formation of the TCPINC (TCP Increased Security) [working group](/source/working_group) in June[{{cite web |title=Trends in Wide Area IP Traffic Patterns A View from Ames Internet Exchange|author="Sean McCreary and kc klaffy"|url=http://www.caida.org/publications/papers/2000/AIX0005/}}] this can lead to an overhead of 8% of useful bandwidth. This 36 bytes overhead may not be an issue for internet connections faster than 64kbs but it can be an issue for dial-up internet users.
Compared to [TLS/SSL](/source/Transport_Layer_Security), tcpcrypt is designed to have a lower performance impact. In part this is because tcpcrypt does not have built-in authentication, which can be implemented by the application itself. Cryptography primitives are used in such a way to reduce load on the [server](/source/server_(computing)) side, because a single server usually has to provide services for far more clients than the reverse.