| title | menu_order |
|---|---|
Encryption and Weave Net |
60 |
Weave Net peers communicate with each other over both TCP and UDP. This communication can be encrypted.
Encryption of TCP and UDP traffic (when sleeve overlay is used) is accomplished using the NaCl crypto libraries, employing Curve25519, XSalsa20 and Poly1305 to encrypt and authenticate messages. Weave Net protects against injection and replay attacks for traffic forwarded between peers.
NaCl was selected because of its good reputation both in terms of selection and implementation of ciphers, but equally importantly, its clear APIs, good documentation and high-quality go implementation. It is quite difficult to use NaCl incorrectly. Contrast this with libraries such as OpenSSL where the library and its APIs are vast in size, poorly documented, and easily used wrongly.
There are some similarities between Weave Net's crypto and TLS. Weave Net does not need to cater for multiple cipher suites, certificate exchange and other requirements emanating from X509, and a number of other features. This simplifies the protocol and implementation considerably. On the other hand, Weave Net needs to support UDP transports, and while there are extensions to TLS such as DTLS which can operate over UDP, these are not widely implemented and deployed.
In the case of fast datapath, UDP packets are encrypted by using ESP of IPsec. The process of encryption is handled by the Linux kernel and is controlled via the IP transformation framework (XFRM).
See Also