Best practices for using encryption in transit
The idea behind encryption in transit is to allow two parties to share messages over a publicly exposed network, in a secure way, while retaining message confidentiality and integrity.
IPSec
IPSec is the most commonly used protocol for encryption at transit, mainly for site-to-site VPN and VPN tunnels. IPSec resides on layer 3 of the OSI model.
The following are some best practices regarding IPSec:
- Use the IKEv2 protocol for security association (SA).
- Use AES-GCM for encryption.
- Use HMAC-SHA256 (or higher) for integrity.
- When supported by both the client and the server, use certificate-based authentication instead of a pre-shared key.
- Use an up-to-date VPN client (to avoid known vulnerabilities).
For more information, please refer to the following resources:
Internet Protocol Security (IPSec):
https://en.wikipedia.org/wiki/IPsec
Guide to IPSec VPNs:
