Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of using TLS for HTTP we just use IPsec and no need to do the same handshake stuff for other ports or protocols.


Remember that IP was a government/academic collaborative experiment, and the current Internet was never envisioned. IPv4 didn't have anything like what you suggest, and it couldn't be retrofitted (you cannot simply do something like that and break every IP device in existence). What was done, instead, was to use an encrypted tunnel.

On the other hand, IPv6 was built from the start with something like you describe. Unfortunately, it didn't really take off because people were used to the idea of tunneling, rather than encrypting in the original packet. OSPFv3 for IPv6 does as you suggest, and it may be that it becomes more common, but it is very hard to get people to change.

  • So there isn't really a factual reason but it more developed in that way due to history? That's really interesting – Jonas Feb 4 '19 at 21:52
  • The experiment called IP didn't have anything to deal with bad guys the way we have today. The original Internet was simply based on trust, and people who violated that trust were simply excluded. It wasn't until after the Internet went public that the real problems developed, and it was simply too late to be able to do something like you suggest with IPv4. IPv6 is a great improvement in many ways, including the addition of security headers and encryption, but it is very difficult to get people out of "IPv4-thinking." That has been a major problem in the conversion to IPv6. – Ron Maupin Feb 4 '19 at 21:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.