You're viewing the y.diskcat.com public feed.

Federated feed Local feed

Vertex 🔞livingshredder@furry.engineer
Oct 20, 2026, 10:11 PM
So in my alternate future they decided to go down the path of IPsec for transport security instead of TLS… I wrote about the connection flow
There were three historical standards:
E2S = Encryption to the ISP
E2H = Encryption to the Home
E2D = Encryption to the Device
NPI Enhanced E2S Flow
1. Client looks up hostname of service and determines address and NPI support via DNS
2. Client sends ICMP NPI OPEN packet to ISP PEI (upstream gateway) with IPv6 address of peer
3. ISP PEI initiates IKE Phase One with service; X.509 certificate is returned which includes the network prefix in an extension
4. ISP PEI looks up the ISP issuer of the service’s NPI certificate and validates it against its list of trusted ISP issuers
💬 1🔄 0⭐ 0

Replies

Vertex 🔞livingshredder@furry.engineer
Oct 20, 2026, 10:11 PM
5. ISP PEI initiates IKE Phase Two with service, responding with ICMP NPI OPEN COMPLETE
6. Client can now communicate with remote IPv6 for which the ISP PEI transparently proxies the IPsec SA. Before establishment all packets to the address would have been dropped
7. Client continues to send ICMP NPI KEEPALIVE packets to PEI based on minimum interval in OPEN COMPLETE to keep the tunnel open
8. If the tunnel is closed by the ISP or remote host an ICMP NPI TERMINATED packet is sent to the client
For E2H: the home border router acts as the ISP PEI and point of initiation for tunnels, and clients send ICMP NPI messages to it exactly as with PEIs. For E2D, no ICMP messages are sent and instead the kernel networking stack takes over the role of the PEI internally.
💬 1🔄 0⭐ 0
Vertex 🔞livingshredder@furry.engineer
Oct 20, 2026, 10:11 PM
Service provider support continues to sometimes be an issue with E2H and E2D because of authentication. Historically, service providers would require ISPs to “vouch” for the user’s identity by authenticating them on their behalf and then presenting a client certificate to complete the IPsec handshake. Because individuals had no access to ISPs certificates, this posed an issue.
It would eventually be solved by ISPs issuing individual certificates to households and devices, where the devices would generate the private key and send the CSR to the ISP, ensuring the ISP did not keep a record of it. For legacy reasons, some providers still do not “trust” this arrangement, making E2S necessary.
💬 0🔄 0⭐ 0