Best practices for using encryption in transit
The idea behind encryption in transit is to allow two parties to share messages over a publicly exposed network, in a secure way, while retaining message confidentiality and integrity.
Internet Protocol security (IPSec)
IPSec is the most used protocol for encryption at transit, mainly for site-to-site VPN and VPN tunnels. IPSec resides on layer 3 of the OSI model.
The following are some best practices regarding IPSec:
- Use the IKEv2 protocol for security association (SA)
- Use AES-GCM for encryption
- Use HMAC-SHA256 (or higher) for integrity
- When supported by both the client and the server, use certificate-based authentication instead of a pre-shared key
- Use an up-to-date VPN client (to avoid known vulnerabilities)
For more information, please refer to the following resources:
