IPSec – IP Security Protocol

1. IPSec – IP Security Protocol By Archis Raje

2. What is IPSec • IP Security – set of extensions developed by IETF to provide privacy and authentication to IP. • To protect the contents of an IP datagram, the data is transformed using cryptography.

3. Why do we need IPSec? Because IP is insecure – you can • Forge IP address • modify packet contents • replay old content • inspect packet content during transit

4. How does it work? combination of - • Cryptographic protocols • Security mechanisms

5. What Does IPSec Provide? • Access control to network elements. • Data origin authentication. • Connectionless integrity for protocols such as UDP. • Detection and rejection of replayed packets. • Use of encryption to provide data confidentiality. • Limited traffic flow confidentiality.

6. Since the IPSec services are offered at the network layer of the TCP/IP protocol stack, these services can be used by any of the upper-layer protocols such as TCP, UDP, ICMP and IGMP or any application layer protocol. • IPSec provides cryptographic based security for ipv4 and ipv6 datagrams.

7. How? Using two traffic security protocols: • Authentication header (AH). • Encapsulating security payload (ESP). And through the use of cryptographic-key management procedures and protocols such as - • Internet key exchange (IKE) protocol.

8. Together, the security protocols provide - • Data confidentiality • Limited traffic flow confidentiality • Connectionless integrity • Data origin authentication • Anti-replay service

9. Modes of Operation of AH and ESP • Transport mode • Tunnel mode

10. Transport Mode AH transformation: Upper layer payload TCP/UDP Header IP Header TCP/UDP Header Upper layer payload IP Header AH Header Authenticated

11. Transport Mode ESP transformation: Upper layer payload IP Header TCP/UDP Header ESP Header TCP/UDP Header Upper layer payload ESP Trailer ESP auth IP Header Encrypted Authenticated

12. Tunnel Mode AH transformation: Upper layer payload TCP/UDP Header IP Header TCP/UDP Header Upper layer payload IP Header AH Header IP Header Authenticated

13. Tunnel Mode ESP transformation: TCP/UDP Header Upper layer payload IP Header ESP Header ESP Trailer ESP auth TCP/UDP Header Upper layer payload IP Header IP Header Encrypted Authenticated

14. Communication • The IKE protocol is used to negotiate the cryptographic algorithm choices, to be utilized by AH and ESP, and put in place the necessary cryptographic keys that the algorithms require. • IPSec can implement different security policy/encryption algorithm for different subnets, nodes, etc. • It does this by the use of Security Association (SA).

15. Security Association An agreement between communicating peers on factors such as - • IPSec protocol • Mode of operation of the protocols (transport mode or tunnel mode) • Cryptographic algorithms • Cryptographic keys • Lifetime of the keys SAs are simplex (unidirectional)

16. SAD – Security Association Database • Stores SA parameters communicated by IKE. • Contents are – • Sequence number counter. • Sequence counter overflow flag • Anti-replay window • IPSec protocol mode • Path maximum transfer unit (PMTU) • Lifetime of the SA

17. SPD - Security Policy Database • Contains policies that are to be applied to the traffic destined to or originated from a given host or network. • Contents are – • Destination IP address • Source IP address • Transport layer protocol • System name: FQDN or email id • User ID

18. Drawbacks • Complex - has too many options. • Prone to Initialization Vector attacks.