Underlay Encryption

Summary

Currently the communication of dpservice instances with each other and with the internet facing router
in the underlay network is not encrypted. dpservice constructs overlay networks using IpInIpv6 packets
and routes them to other dpservice instances or to the internet facing router. (east-west, south-north traffic)

This underlay traffic needs to be encrypted. This involves several networking components of the ironcore like
dpservice, metalnet, metalbond.

---

Scope

✅ In Scope

• PoC of encryption of decryption using DPDK / SmartNIC capabilities.
• Prepare dpservice GRPC API to be able to accept secrets for each route.
• Prepare dpservice dataplane to do the encryption offloaded / non-offloaded. (tbd) (salt usage for the encryption / IPv6-IPSec)
• Metalnet enhancements to create private - public key pair for the NIC / compute-node where it is running.
• Metalbond protocol needs to be enhanced to include optional public key to to its protocol.

❌ Out of Scope

• Encryption of Overlay Traffic: This enhancement targets the underlay encryption only. Overlay traffic security (e.g., between endpoints in the overlay) is not touched.
• Fallback or Legacy Compatibility Modes: Support for legacy systems that do not support encryption, or fallbacks for older protocol versions, will not be implemented as part of this effort.
• Comprehensive Key Management System: While Metalnet will generate key pairs, integration with a broader key management system (e.g., TPM, HSM) is not included in this phase.

---

Responsible Areas

• Networking

---

Contributors

• @guvenc
• @byteocean
• @MalteJ

---

Acceptance Criteria

• Networking

  • East-west, south-north dpservice originated traffic is encrypted on the wire.

---

Action Items

• Assign labels (e.g., area/ironcore-api, kind/design)
• Set milestone (e.g., H1/2025)
• Assign dependent sub-issues in each required area
• Assign an owner to the issue using the GitHub "Assignee" field
• List all contributors in the "Contributors" section above
• Add this issue to the Roadmap project board

Start by mapping the underlay traffic and interfaces across dpservice, metalnet, and metalbond, including the dpservice gRPC API and the DPDK/SmartNIC encryption PoC. Review how route secrets and NIC or compute-node public keys would cross these components; done means east-west and south-north dpservice-originated traffic is encrypted on the wire.