<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-network-encryption
description: >-
  Implement and validate network encryption using TLS 1.3, IPsec, WireGuard, and MACsec
  for transit data protection including certificate management, cipher suite hardening,
  and encrypted tunnel deployment.
domain: cybersecurity
subdomain: network-security
tags:
  - tls
  - ipsec
  - wireguard
  - macsec
  - encryption
  - certificates
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557", "T1040", "T1573"]
  nist-csf: ["PR.DS-2", "PR.DS-5", "PR.AC-5"]
  uuid: a1b2c3d4-1004-4a00-b004-f00d00000004
---

# Implementing Network Encryption

## Overview

Network encryption protects data in transit against interception, tampering, and replay
attacks. This skill covers TLS 1.3 deployment and cipher suite hardening, IPsec tunnel
and transport mode, WireGuard VPN configuration, MACsec for LAN encryption, and
certificate lifecycle management.

Mode: `[MODE: ARCHITECT]` for design; `[MODE: BLUE]` for validation and monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| OpenSSL 3.x for certificate operations and TLS testing | Required |
| strongSwan or Libreswan for IPsec | Required |
| WireGuard kernel module or wireguard-tools | Required |
| Zeek/Suricata for TLS monitoring | Required |
| Certificate Authority (internal PKI or Let's Encrypt) | Required |

## Key Concepts

### TLS 1.3 Cipher Suite Hardening

```bash
# Test TLS configuration
nmap --script ssl-enum-ciphers -p 443 target.example.com

# Verify TLS 1.3 support
openssl s_client -connect target.example.com:443 -tls1_3 -brief

# Check certificate chain
openssl s_client -connect target.example.com:443 -showcerts 2>/dev/null | \
  openssl x509 -noout -dates -subject -issuer

# Generate strong TLS config (nginx)
# ssl_protocols TLSv1.3;
# ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
# ssl_prefer_server_ciphers off;
# ssl_session_timeout 1d;
# ssl_session_tickets off;
```

### WireGuard VPN Configuration

```bash
# Generate keys
wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key

# Server configuration
cat > /etc/wireguard/wg0.conf << 'EOF'
[Interface]
Address = 10.200.0.1/24
ListenPort = 51820
PrivateKey = <server-private-key>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.200.0.2/32
EOF

# Start tunnel
wg-quick up wg0
wg show wg0
```

### IPsec with strongSwan

```bash
# /etc/ipsec.conf — site-to-site tunnel
conn site-to-site
    type=tunnel
    authby=pubkey
    left=203.0.113.1
    leftsubnet=10.1.0.0/16
    leftcert=host.cert.pem
    right=198.51.100.1
    rightsubnet=10.2.0.0/16
    rightid="C=US, O=Corp, CN=remote"
    ike=aes256gcm16-sha384-ecp384!
    esp=aes256gcm16-ecp384!
    auto=start

# Start and verify
ipsec restart
ipsec statusall
```

### Suricata TLS Monitoring

```
# Alert on weak TLS versions
alert tls any any -> any any ( \
  msg:"Weak TLS - SSLv3 or TLS 1.0 detected"; \
  tls.version:!1.2; tls.version:!1.3; \
  sid:3001020; rev:1; \
  metadata:mitre_attack_technique T1557;)

# Detect expired certificates
alert tls any any -> any any ( \
  msg:"TLS certificate expired"; \
  tls_cert_expired; \
  sid:3001021; rev:1;)
```

### Zeek TLS Analysis

```bash
# Extract TLS versions from Zeek logs
zeek-cut version server_name < ssl.log | sort | uniq -c | sort -rn

# Find weak cipher suites
zeek-cut cipher < ssl.log | sort | uniq -c | sort -rn | grep -i "rc4\|des\|null"
```

## Workflow

### Step 1: Audit Current Encryption Posture

Scan all services for TLS version and cipher support.

### Step 2: Harden TLS Configuration

Enforce TLS 1.3 where possible, TLS 1.2 minimum with strong cipher suites.

### Step 3: Deploy Encrypted Tunnels

Configure WireGuard or IPsec for site-to-site and remote access.

### Step 4: Monitor Encryption Compliance

Deploy Suricata rules and Zeek scripts to detect weak or missing encryption.

## Detection

```yaml
title: Network Encryption Detection
id: 5f9489a8-aa35-4cf1-9947-1ae96caad36c
status: experimental
description: Detects suspicious activity related to implementing network encryption techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1040
  - attack.t1573
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Encryption Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557, T1040, T1573 |

## Verification

- [ ] TLS 1.3 enforced on all public-facing services
- [ ] No SSLv3, TLS 1.0, or TLS 1.1 accepted
- [ ] Certificate chain valid and properly pinned
- [ ] WireGuard/IPsec tunnels established with perfect forward secrecy
- [ ] Suricata alerts on weak TLS negotiation
- [ ] Certificate expiry monitoring in place

## References

- [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/)
- [WireGuard Protocol Documentation](https://www.wireguard.com/protocol/)
- NIST SP 800-52 Rev 2: TLS Implementation Guidelines
- CIS Controls v8 — Control 3: Data Protection
