Paper 2013/410

Plug-and-Play IP Security: Anonymity Infrastructure Instead of PKI

Yossi Gilad and Amir Herzberg


We present the Plug-and-Play IP Security (PnP-IPsec) protocol. PnP-IPsec automatically establishes IPsec security associations between gateways, avoiding the need for manual administration and coordination between gateways, and the dependency on IPsec public key certificates - the two problems which are widely believed to have limited the use of IPsec mostly to intra-organization communication. PnP-IPsec builds on Self-validated Public Data Distribution (SvPDD), a protocol that we present to establish secure connections between remote peers/networks, without depending on pre-distributed keys or certification infrastructure. Instead, SvPDD uses available anonymous communication infrastructures such as Tor, which we show to allow detection of MitM attacker interfering with communication. SvPDD may also be used in other scenarios lacking secure public key distribution, such as the initial connection to an SSH server. We provide an open-source implementation of PnP-IPsec and SvPDD, and show that the resulting system is practical and secure.

Available format(s)
Publication info
Published elsewhere. This is a full version of a paper accepted to appear in ESORICS 2013 (but not yet published).
key management
Contact author(s)
yossig2 @ gmail com
2013-06-25: received
Short URL
Creative Commons Attribution


      author = {Yossi Gilad and Amir Herzberg},
      title = {Plug-and-Play IP Security: Anonymity Infrastructure Instead of PKI},
      howpublished = {Cryptology ePrint Archive, Paper 2013/410},
      year = {2013},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.