NETWORK AND CYBER SECURITY ASEC8S5, 17ECBaS MODULE-3 IP SECURITY: IP Security Overview, IP Security Policy, Encapsulation Security Payload (ESP), combining security Associations, internet Key Exchange: Cryptographic Suites TEXT BOOK: 1, William Stallings, “Cryptography and Network Security Principles and Practice”, Pearson Education Inc., 6th Edition, 2014, ISBN: 978-93-325- 1877-3. 2. Thomas |. Mowbray, “Cyber Security - Managing Systems, Conducting ‘Testing, and Investigating Intrusions", Wiley. REFERENCE BOOKS: 1, Cryptography and Network Security, Bebrouz A, Forouzan, TMH, 2007, 2. Cryptography and Network Security, Atul Kahate, TMH, 2003. eS Dept, of ECE, BGSIT, BG Nagara, Mandya Page 1NETWORK AND CYBER SECURITY ASEC8S5, 17ECB35 MODUL-3:- IP SECURITY: IP Security Overview, IP Security Policy, Encapsulation Security Payload (ESP), combining security Associations, Internet Key Exchange. Cryptographic Suites LIP SECURITY OVERVIEW IMP QS iquesdion}-O3 tn 1994, the Internet Architecture Board (IAB) issued a report titled "Security in the Internet Architecture® (RFC 1636). The report identified key areas for security mechanisms, Among these were the need to secure the network infrastructure from unauthorized monitoring and control of network traffic and the need to secure end- luser- to-ond-user traffic using atrthentication and eneryption mechanisms, To provide security, the LAB included authentication and encryption as necessary security features in the next-generation IP, which has been issued as TPv6. Fortunately, these security capabilities were designed to be usable both with the current [Pvt and the future IPv6. This means that vendors can begin offering these features now, and tiany vendors now do have some IPsec capability in their products. The IPsec specification now exists as a set of Internet standards. 1.1 APPLICATIONS OF IPsce ANP QS tquestion 00M IPsec provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet: Examples of its use include: 1, Secure branch office connectivity over the Internet: A company can build a secure virtual private network over the Internet or over a public WAN, This enables a business to rely heavily on the Internet and reduce its need for private networks, saving costs and network management overhead, 2. Secure remote access over the Internet: An end user whose system is equipped with IP security protocols can make-a local call to an Internet Service Provider (ISP) and gain secure access to a company network, This reduces the cost of tall charges for travelling employees and telecommuters. 3, Establishing extranet and intranet connectivity with partners: [Psec can be used to secure communication with other organizations, ensuring authentication and confidentiality and providing a key exchange mechanism. 4. Enhancing electronic commerce security: Bven though some Web and electronic Commerce applications have built-in security protocols; the use of rT Dept. of ECE, BGSIT, BG Nagara, Mandya Page 2NETWORK AND CYBER SECURITY ASEC835, 17ECB35 IPsoe enhances that security. IPsec guarantees that all traffic designated by the network administrator is both encrypted and authenticated, adding an additional layer of security to whatever is provided at the application layer. 1.2.1P SECURITY SCENARIO AMP 05 (aueestion) O09 Pigure 1 is a typical scenario of 1Psec usage. ‘Figure 1: TP Security Scenario * An organization maintains LANs at dispersed locations, Non secure IP traffic ts conducted on each LAN, * For traffic offsite, through some sort of private or public WAN, [Psec protocols are used. # These protocols aperate in networking devices, such as a rauter ar firewall, that Connect each LAN to the outside world, = The tPsec networking device will typically encrypt and compress all traffic going into the WAN and decrypt and decompress traffic coming from the WAN; these operations are transparent to workstations and servers on the LAN. © Secure transmission |s also possible with individual users who dial into the WAN. eee Dept. of ECE, BGSIT, BG Nagara, Mandya Page 3NETWORK AND CYBER SECURITY SEC8S5, 17ECHAS: Such user workstations must implement the !Psec protecols to proviee security. 1.4 BENEFITS OF IPSEC DMF @S (question 011 Sonié of the benefits of IPsec: hen IPsec is implemented ina firewall or router, it provides strong security that canbe applied to all traffic crossing the perimeter. Traffic within a company or workgroup does not incur the overhead of security-related processing. IPsec ipa firewall is resistant to bypass if all waffic from the outside must use IP and the firewall is the only means of entrance from the Internet into the organization, APses_is_below the transport layer (TCP. UDP) and so is transparent to applications. ‘Then is ne need to change software on a user or server system when IPsie bs implemented in the firewall or router, ven if I i in a du applications, is not affected. IPsec can be transparent to end users, There is no need to train users on security mechanisms, issue keying material on a per-user basis, or revoke keying material when users leave the organization, Psec can provi for individual users if needed. This is useful for offsite workers and for setting up a secure virtual sub network within an organization for sensitive applications. ROUTING APPLICATIONS In addition to supporting end users and protecting premises systems and networks, IPsec can play a vital role in ‘the routing architecture required for internetworking. Lists the following examples of the use of IPsec. IPsec ean assure that A router advertisement (a new router advertises its presence) comes fram an authorized router. ‘A neighbour advertisement (a router seeks to establish or maintain a neighbour Relationship with a router in another routing domain) comes from an authorized router. A redirect message comes from the router to which the initial IP packet was sent. eens Dept. of ECE, BGSIT, BG Nagara, Mandya Page 4NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS © Arouting update is not forged. Routing protocols such as Open Shortest Path First (OSPF) should be run on top of security associations between routers that are defined by IPsec, 1 IPsec DOCUMENTS IMP OS tquestion A591 IPsec encompasses. three: functional areas: authentication, confidentiality, and key management. The documents .can ive categorized inta the follawing groups. © Architecture: Covers the general concepts, security requirements, definitions, fining IP: th ‘ti is REE 4301 Security Architecture for the Internet Protocal, * Authentication Header (AH): Allis an_extension header to provide message It is included in IPsecv3 for backward compatibility but should not be used in new applications, We do not discuss Al! in this chapter. * Encapsulating Security Payload (ESP): ESP consists_of an_encapsuliting header and trailer used to _previde _eneryption or combined encryption/authentication. The current specification is RFC 4303, IP Encapsulating Security Payload (ESP). * Internet Key Exchange (IKE): This isa collection of documents describing the key: management schemes for use with IPsee. The main specification is REC 5996, Internet Key Exchange (IKEv2) Protocol, but there are a number of related RFCs. * Cryptographic algorithms: This category encompasses a large set of documents eens Dept. of ECE, BGSIT, BG Nagara, Mandya Page 5NETWORK AND CYBER SECURITY 1SEC835, 17ECKAS IP sce SERVICES > 1Psec provides security services at the IP layer by enabling a system to select required ‘Security protocols, determine the algorithms) to wse for the service(s), and put in place arly crypiographic keys required to provide the requested services. > ‘Two protocols are used to provide security: an authentication prowcol designited by > RPC 4301 lists the following services: = Access comtral, © Coanectionless integrity © Data origin authentication, * Rejection of replayed packets (a form of partial sequence integrity) = Confidemtiatity (encryption). * Limited traffic flow confidentiality. L.7 THANSPORT AND TUNNEL MODES MLE PS fequeemtioond FONE oth Authentication Headers (AH) and Encapsulating Security Payload (ESP) support two modes of use: transport and tunnel mode. 1.7.1 Transport Mode > Transport mode provides protection primarily for upper-layer protocols, That is, transport mode protection extends to the payload of an iP packet. % When a host runs’AH ot ESP over IPv4, the payload is the data that notinally follow the IP header. » For IPv6, the payload is the data that normally follow both the IP header and any IPv6 extensions headers that are present, with the possible exception of the destination options header, which may be included in the protection. % ESP in transport mode encrypts anil optionally authenticates the IP payload but not the IP header. > AH in transport mode authenticates the IP payload and selected portions of the IP header. Dept. of ECE, BGSIT, BG Nagara, MandyaNETWORK AND CYBER SECURITY ASEC835, 17ECBaS TADLE 1 SUMMARIES TRANSPORT AND TUNNEL MODE FUNCTIONALITY. Table 1; Tunnel Mode and Transport Mode Functionality 1.7.2 Tannel Made > ‘Tunnel mode provides protectian to the entire IP packet. To achieve this, alter the AH or ESP fidlds are added to the IP packet, the entire packet plus security fields is treated as the payload of new outer IP packet with a new outer IP header. + Theentire original, inner, packet travels through a tunnel from one point of an IP network to another no routers along the way are able to examine the inner IP header. Because the original packet Is encapsulated, the new, larger packet may have totally different source and destination adidresses, atlding to the security. Tunnel mode is used when one or both ends of a security association (SA) area security gateway, such asa firewall ar router that implements IPsec. > ESP in tunnel mode encrypts and optionally authenticates the entire inner IP packet, inclodting the thner 1 header * AH in tunnel mode authenticates the entire inier IP packet and selected portions of the outer IP header: 2 IP SECURITY POLICY EMP 9S (question) 01M Fundamental to the operation of IPsee is the concept of a security policy applied to each IP packet that transits from a souirce to a destination. IPsec policy (s determined primarily by the interaction of two databases, the security association database (SAD) and the security policy database (SPD). ‘This section provides an overview of these two databases and then summarizes their use during [Psec operation. Figure 2 illustrates the relevant relationships. es Dept. of ECE, BGSIT, BG Nagara, Mandya Page 7NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS a Figure 2 IPsec Architecture 2.1 SECORETY ASSOCEATIONS EMP OS (question iM > A key concept that appears in both the authentication and confidentiality mechanisms for |P is the security association (SA). > An association is a one-way logical connection between a sender and a receiver that affords security services to the traffic carried on it. > Ifa peer relationship is needed for two-way secure exchange, then two security associations are required > Asecurity association is uniquely identified by three parameters. = Security Parameters Index (SPI): A 32-bit unsigned integer assigned to this ‘SA_and having local significance only, The SPI is cartied in AH and ESP headers to enable the receiving system to. select the SA undes which a receiwed packet willbe processes, * IP Destination Address: This is the address of the destination endpoint of the SA. which may be an end-user system or a network system such as a firewall or router, = Security Protocol Identifier: ‘This field from the outer IP header indicates whether the association ts an AH or ESP security association, % Hence, in any IP packet, the security association is uniquely identified by the Destination Address in the IPv4 or |Pv6 header and the SPI in the enclosed extension header (AH or ESP). eS Dept. of ECE, BGSIT, BG Nagara, Mandya aeNETWORK AND CYBER SECURITY ASEC8S5, 17ECRa5 2.2 SHCUMETY ASSOCLATION DATABASE IMP 5 (question) B59 > In each IPsec implementation, there is a naminal2 Security Association Database that defines the parameters associated with each SA. % Asecarity association is normally defined by the following parameters in an SAD entry. 1, Security Parameter Index: A 32-bit value selected by the receiving ond of an SA to uniquely identify the SA. tn an SAD entry for an outbound SA, the SPI is used to construct the packet's AH or ESP header. In an SAD entry for an inbound SA, the SP1is used to map traffic to the appropriate SA. 2. Sequence Number Counter: A 32-bit value used to generate the Sequence Number field in AH or ESP headers, described in Section 20.3 (required for all Implementations). 3, Sequence Counter Overflow: A flag indicating whether overflow of the ‘Sequence Number Counter should generate an auditable event and prevent further transmission of packets-on this SA (required for all implementations). 4. Anti-Replay Window: Used to determine whether an inbound AH or ESP packet isa replay, (Required far all implementations), 5. AH Information: Authentication algorithm, keys, key lifetimes, and related parameters being used with AH (required for AH implementations). 6. ESP Information: Encryption and authentication algorithm, keys, initialization values, key lifetimes, and related parameters being used with ESP (required for ESP implementations). 7. Lifetime of this Security Association: A time interval or byt count after which an SA must be replaced with a ew SA (and new SPI) or terminated, plus an indication of which of these actions should occur (required for all implementations). 8. IPsec Protocol Made: Tunnel, transport, or wildcard, 9%, Path MTU: Any observed path maximum transmission unit (maximeim size of a packet that can be transmitted without fragmentation) and aging variables (required for all implementations). —- ST Dept. of ECE, BGSIT, BG Nagara, Mandya Page 9NETWORK AND CYBER SECURITY 2.5 SECURITY POLICY DATABASE EMP QS tquecstion GM > The means by which IP traffic is related to specific SAs (or no SA in the case of traffic allowed to bypass IPsec) is the nominal Security Policy Database (SPD). In ity simplest forin, an SPD contains eritries, each of which defines a subset of IP Wwaffic and paints to ani SA foe tha waffic. > In more complex environments, there may be multiple entries that potentially relate to a single SA or multiple SAs associated with a single SPD entry. > Each SPD entry is defined by a set of IP and upper-layer protocol field values, called selectors. > Ineffect, these selectors are used to filter outgoing traffic in ordet to map it Into a particular SA. > Outbound processing obeys the following general sequence for each IP packet, 1. Compare the values of the appropriate fields in the packet (the selector fields) against the SPD to find a matching SPD entry, which will point to zero or mare SAs, 2. Determine the SA if any for this packet and its associated SPL 3. Do the required IPsec processing (i.c., AH or ESP processing). > The following selectors determine an SPD entry: * Remote IP Address: This may be a single IP address, an enumerated list or range of addresses, or a wildcard (mask) address. The latter twoare required to support more than one destination system sharing the same SA (eg. behind a firewall), * Local IP Address: This may be a single IP address, an enumerated list oF range of addresses, or a wildcard (mask) address, The latter two are required to support more than one source system sharing the same SA (eg. behind a firewall). * Next Layer Protocol: The IP protocol header (IPv4, IPv6, or IPv6 Extension) Includes a fleld (Protocal for IPv4, Next Header for [Pvé or IPv6 Extension) that designates the protocol operating aver IP. This is an individual protocol number, ANY, or for IPv6 only, OPAQUE. If AH ur ESP is used, then this IP protocol header immediately proceeds the AH or ESP header in the packet. rT Dept. of ECE, BGSIT, BG Nagara, Mandya Page 10NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS * Name; A user identifier from the operating system. This is nota field in the IP or upper-layer headers but js available {f IPsec is running on the same operatinig system as the user, * Local and Remote Ports: These may be individual TCP or UDP port values, an enumerated list of ports, or a wildcard port. Table 2 provides an oxample of an SPD on a host system (as opposed to a network system such asa firewall or router), Prniwcal | Lowal P| Poet | Remote i? | Port | Action Upr | iaam || soa | = ae _ | BYPASS sep ize | + | BYPASS . yan [+ [raaem [> | pRorecrtsr {nlranepet mde ver [ism [+ [isan [a | morecnesr rer [iaaue [+ [acer |_| myrass * asm [+ [aaa [= | piscanp = Tas [+f aT ‘Table & Host SPD Example 2.4 1 TRABETC PROCESSING AMP OS farrention 10 IPsec Is executed on a packet-by-packet basis. When IPsec is Implemented, each outbound IP packet is processed by the |Psec logic befare transmission, and each inbound packet is processed by the [Psec logic after reception and before passing the packet contents on to the next higher layer (e.g, TCP or UDP). OUTBOUND PACKETS Figure 3 highlights the main elements of IPsec processing for outbound traffic. A block of data from a higher layer, such as TCP, is passed down to the IP layer and an IP packet is formed, consisting of an fP header and an IP body. Then the following steps accur:- IPsec searches the SPD for'a match tn this packet. . If to match is found, then the packet is discarded and an error message is generated. . Ifa mate {s found, further processing is determined by the first matching entry in the SPD. If the policy for this packet is DISCARD, then the packet is discarded. If the policy is BYPASS, then there is no further IPsec processing: the packet is forwarded to the network for transmission. eS Dept, of ECE, BGSIT, BG Nagara, Mandya Page 11NETWORK AND CYBER SECURITY ASEC8S5, 17ECBaS ‘ratioand HP packet (eg. frame TCP ar OP) Figure 8 Processing Model for Outbound Packets 4. Ifthe policy is PROTECT, then a search is made of the SAD for a matching entry. If ‘no entry fs found, then IKE is invoked to create an SA with the appropriate keys andan entry is made in the SA. 5. The matching entry in the SAD determines the processing for this packet. Encryption, authentication, ar both can be performed, and either transport or tunnel made can be used. The packet is then forwarded to the network far transmission, INBOUND PACKETS: Figure 4 highlights the main elements of IPsec processing for inbound traffic. An theaming IP packet triggers the IPsec processing. The following steps occur: 1. IPsec determines whether this is an vnsecured IP packet or one that has ESP or AH headers/trailers, by examining the IP Protocol fleld (IPv4) or Next Header field (Pv). | ee Dept. of ECE, BGSIT, BG Nagara, Mandya Page 12NETWORK AND CYBER SECURITY ASEC835, 17ECBaS Inbounel 1 gcket (from Iniersets Figure 4 Processing Model for Inbound Packets 2. If the packet is unsecured, IPsec searches the SPD for a mateh to this packet. If the first matching entry has a policy af BYPASS, the IP header is processed and stripped off and the packet body is delivered tothe next higher layer, such as ‘TCP. If the first matching entry has.a policy of PROTECT or DISCARD, or if there is no matching entry, the packet is discarded. For a secured packet, IPsec searches the SAD. If no match is found, the packet is discarded. Otherwise, [Psec applies the appropriate ESP or AH processing, Then, the IP header is processed and stripped off and the packet body is delivered to the nexthigher layer, such as TCP. 3 SAPSULATING SECURITY PAYLOAD UMP QS tqnestion)03" > ESP can be used to provide confidentiality, data origin authentication, connectionless integrity; an anti-replay service (a form of partial sequence integrity), and (limited) traffic flow confidentiality. > ‘The set of services provided depends on options selected at the time of Secutity Association (SA) establishment and on the location of the implementation in a network topology, rT Dept. of ECE, BGSIT, BG Nagara, Mandya Page 13NETWORK AND CYBER SECURITY 1SECA35, 17ECHAS a SP can work with a variety of encryption and authentication: algorithms, including authenticated encryption algorithms such as GCM. 3.1. ESP Format IMP QS (question) -O8M ‘ bine - rm ICY coverme (a) Top-tevel forinat nf an ESP Packet Payload ICV cover Koerypted tb) Substructure of py oad data Figure 5 ESP Packet Format Figure 5{a) shdws the top-level format of an ESP packet. It contains the following Fields, 1, Security Parameters Index (32 bits): \dentifies a security association, 2, Sequence Number (32 bits): A monotonically increasing counter value; this provides an anti-replay function, as discussed for AH. 3. Payload Data (variable); This is a transport-tevel segment (transport mode) or IP packet (tunnel mode) that is protected by encryption. Dept. of KC IGSIT, BG Nagara, Mandya Page 14NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS 4. Padding (0-255 bytes): The purpose of this field is discussed later. 5, Pad Length (8 bits): Indicates the number of pad bytes immediately preceding this field. 6, Next Header (Bi bits): Identifies the type of data contained in the payload data ficld by identifying the first header in that payload (e.g, an extension header in 1PV6, oF an upper-layor protocol such as TCP). 7, Integrity Check Vatue (variable): A variable-tength fleld (must be an integral number of 32-bit words) that contains the Integrity Check Value computed over the ESP packet minus the Authentication Data field. Figure 5(). Two additional fields may be present in the payload figure 5(b). an initialization value (iv), or nonce, is present if this is required by the encryption or authenticated encryption algorithm used for esp. if tunnel mode is being used, then the IPsec implementation may add traffic flow confidentiality (TFC) padding after the payload data and before the padding field, as exphiined subsequently. 3.2 ENCRYPTION ANG AUTHENTICATION ALGOHITHSES > The Payload Data, Padding Pad Length, and Next Header fields are encrypted by the ESP service. > If the algorithm used to encrypt the payload requires cryptographic synchronization data, such as an initialization vector (IV), then these data may be carried explicitly at the beginning of the Payload Data field. If included, an initialization vector (IV), is usually not encrypted, although it is often referred to as being part of the cipher text. > ‘The ICV field is optional, It is present only ifthe integrity service is selected and is provided by either a separate integrity algorithm or a combined mode algorithm that uses an ICV. > ‘The Integrity check value (ICV) is computed after the encryption is performed. > Note that the ICV is not protected by encryption a keyed Integrity algorithm must be employed to compute the Integrity check value (ICV). rN Dept. of ECE, BGSIT, BG Nagara, Mandya Page 15NETWORK AND CYBER SECURITY ASEC83S, 17ECBaS 3.0 PADBING ‘The Padding field serves several purposes: + If an encryption algorithm requites the plaintext to be a multiple of some humber of bytes (eg, the multiple df a single block for a block cipher), the Padding field is used to expand the plaintext (consisting of the Payload Data, Paclding, Pad Length, and Next Header fields) to the required length. ‘+ ‘The ESP format requires that the Pad Length and Next Header fields be right aligned within a 32-bit word. Equivalently, the cipher text must be an integer multiple of 32 bits. The Padding field is ised to assure this alignment. + Additional padding may be added to provide partial traffic-flaw confidentiality by concealing the actual length of the payload. 3 ANTE REPLY SERVICE AMP OS (qavctionyaaMt > A ceplay attack is one in which ani attacker obtains @ copy of an authenticated packet and later transmits it to the intended destination. The receipt of duplicate, authenticated IP packets may disrupt service in some way or may have some other undesired consequence, > ‘The sequence number field is used to thwart the reply attack, I Marks af vat inmarkes if alt packer roorned packet OO vet severed Figure 6 Ani-replay Mechanism Fioure 6~ ® The sequence number is set to zeta with a new SA (Security Associations) established > ‘The number is incremented by 1 for each packet sent on the SA. > ‘The SA is terminated or negotiated with a new key is N=2"4-1 eee Dept. of ECE, BGSIT, BG Nagara, Mandya Page 16NETWORK AND CYBER SECURITY SECHS5, 17ECHS: > Awindow of size W is implemented in order for IP packed to be delivered in reliable manner (with a default of w=64), & The right edge of the window represents the highest sequence nuimber, N, so far received for a valid packet. Forany packet with a sequence number in the range from N- W +1 to W that has been correctly received (Le, properly authenticated), the corresponding slat in the window is marked (Figure 6). Inbound processing proceeds as follows when a packet is received: |. If the received packet falls within the window and is new, the MACs checked Mf the packet is authenticated, the corresponding slot in the window is marked. 2. Ifthe received packet is to the right of the window and is new, the MAC is. Checked. IFthe packet js authenticated, the winclow Is advanced so that this Sequence number is the right edge of the window, and the corresponding slot in the window is marked. 3. Ifthe received packet is to the left of the window arif authentication fails, the packet is discarded; this ts an auditable event. 3.5 TRANSPONT AND TUNNEL MODES TMP OS (question /OU Ficure 7 stows » ‘Two ways in which the IPsec ESP service can be used, > In the upper part of the figure, encryption (and optionally authentication) is provided directly between twa hosts, > Pigure 7(b) shows how tunnel mode operation can be used to set up a virtual private network. In this example * An organization has four private networks interconnected across the Internet. Hosts on the internal networks use the Internet fur transport af data nut do not interact with other Internet-based hosts. = By terminating the tunnels at the security gateway to each internal network, the configuration allows the hosts to avoid implementing the security capability. rT Dept. of ECE, BGSIT, BG Nagara, Mandya Page 17NETWORK AND CYBER SECURITY ASEC835, 17ECBaS ta Tramsporievel security thy A vietaal private netinurh via tunnel mnde Figure 7 Transport-Modes versus TunnelMode Encrypbon «The former technique is supported by a transpart mode SA, while the latter technique [Link] mode SA, > ‘The scope of ESP for the two modes, The considerations are somewhat different for IPv4 and IPv6. We use the packet formats of Figure (a! tarting paint, 2.3.1 Transport Mode ESP INL @S tquestion OOM Transport mode ESP is used to encrypt and optionally authenticate the data carried by IP (e:g.,a TCP segment), as'shown in Figure 8{b.) AS SHOWN IN Ficune 8(6.) IPva:- = For this mode using IPv4, the ESP header is inserted into the IP packet immediately prior to the transport-layer header (e.g, TCP, UDP, ICMP), and ee Dept. of ECE, BGSIT, BG Nagara, Mandya Page 18NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS an ESP trailer (Padding, Pad Length, and Noxt Header fields) is placed after tthe IP packet, = If authentication is selected, the ESP Authentication Data field is added after the ESP trailer. + The entire transportlevel segment plus the ESP trailer are encrypted Authentication covers all of the cipher text plus tho ESP header. oe PR J a ape fae te Figure B Scopes of ESP Enerypsion and Authentication * In the context of IPv6, ESP is viewed as an end-to-end payload; that is, it is ‘Not examined or processed by intermediate routers. = Therefore, the ESP header appears after the IPv6 base header and the hop- ‘by-hop, routing, and fragment extension headers, (a Dept. of ECE, BGSIT, BG Nagara, Mandya Page 19NETWORK AND CYBER SECURITY ASEC8S5, 17ECRaS * ‘The destination options extension header could appear before or after the ESP header, depending on the semantics desired. * For IPvé, encryption covers the entire transport-level segment plus the ESP trailer plus the destination options extensiati header if ivoceurs after the ESP header. * Again, authentication covers the cipher text plus the ESP header, TRANSPORT MODE OPERATION MAY BE SUMMARIZED AS FOLLOWS. 1. At the source, the block of data consisting of the ESP trailer plus the entire transport-layer segment is encrypted and the plaintext of this block is replaced with its cipher text to form the IP packet for transmission. Authentication is added if this option is selected, 2. The packet is then routed to the destination. Each intermediate router needs to examine and process the IP header plus any plaintext 1P extension headers bist does not need to examine the cipher text. 3. The destination node examines and processes the IP header plus any plaintext IP extension headers. Then, on the basis of the SPI in the ESP header, the destination node decrypts the remainder of the packet to recover the plaintext transport-layer segment. ADVANTAGES AND DRAWHACKS + Transport mode operation peuvides confidentiality for any application that uses it, thus avoiding the need to implement confidentiality in every individual application. © One drawback to this mode is that it Is possible to do traffic analysis on the transmitted packets. 3.5.2 Tunnel Mode ESP IMP QS tquestion GM * Tunnel mode ESP is used to encrypt an entire IP packet (Ficurt 8c). © For this thode, the ESP header is prefixed to the packet and then the packet plus the ESP trailer is encrypted. * This method can be used to counter traffic analysis, Because the IP header contains the destination address and possibly source routing directives and hop- by-hop option information, it is not possible simply to transmit the encrypted IP packet prefixed by the ESP header. ey Dept. of ECE, BGSIT, BG Nagara, Mandya Page 20NETWORK AND CYBER SECURITY ASEC835, 17ECHaS a ee * Intermediate routers would be unable to process such a packet. Therefore, it is necessary to encapsulate the entire block {ESP header plus cipher text plus Authentication Data, if present) with a inew IF header that will contain sufficient information far routing but not for traffic analysis. AGURE 9 SHOWS THE PROTOCOL ARCHITECTURE FOR THE TWO MODES. Figure 9 Protocol Operation for ESP * Considera case in which an external host wishes to communicate with a host on an internal network protected by a firewall, and in which ESP is implemented in the external host and the firewalls, «The following steps accur for transfer of a transport-layer segment fram the external host to the internal host. 1, ‘The source prepares an inner IP packet with a destination address of the target internal host. This packet is prefixed by an ESP header; then the packet and ESP eS Dept. of ECE, BGSIT, BG Nagara, Mandya Page 21NETWORK AND CYBER SECURITY SEC8S5, 17ECHAS: trailer are oncrypted and Authentication Data may be added, The resulting block is encapsulated with anew IP header (base header plus optional extensions such as routing and hop-by-hop: options for IPv6) whose destination address is the firewall; this forms the outer IP packet. . The outer packet is routed to the destination firewall. Each intermediate router heeds to examine and process the outer IP header plus any outer IP extension headers but does not need to examine the cipher text. . The destination firewall examines and processes the outer IP header plus any outer IP extension headers. Then, on the basis of the SPI in the ESP header, the destination node decrypts the remainder of the packet to recaver the plaintext inner IP packet. This packet is then transmitted in the internal network. ‘The inner packet is routed through zero or more rauters in the internal network to the destination host. 1. COMBINING SECURITY ASSOCIATIONS ur qs (question-oom > An Individual SA (Security Associations) cin implement either the AH {Authentication Header) or ESP (encapsulating Security Payload) protocol but nat both, ‘Sometimes a particular traffic flow will call for the services provided by both AH and ESP. Further, a particular traffic flow may require IPsec services between hosts and, for that same flow, separate services between security gateways, such as firewalls. In [Link] these cades, multiple SAs must be emiployed for the same traffic flaw to achieve the desired IPsec services, The SAs in a bundle may terminate at different endpoints or at the same endpoints. Security associations may be combined into bundles in two ways: » Transport adjacency: Refers to ajyplying more than one security protocol to the same IP packet without invoking tunnelling. This approach to combining AH and ESP allows for only ane level of enmbination; further nesting yields po added benefit since the processing is performed at ane fPsec instance: the (ultimate) destination. rT Dept. of ECE, BGSIT, BG Nagara, Mandya Page 22NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS 2. Merated tunnelling: Refers to the application of multiple layers of security protocols affected through [P tunnelling. This approach allows for multiple levels of nesting, since each tuntiel can originate of terminate at a different IPsec site along the path. UTHENTICATION PLCS CONFIDENTIALITY 1 @5 iqnestion 12 Encryption and authentication can be combined in order to transmit an IP packet that has both confidentiality and authentication between hasts. of ESP wit h Authentication Option + In this approach, the user first applies ESP to the data to be protected and then appends the authentication data field. > ‘There are actually two sub cases; 1. Transport made ESP: Authentication and encryption apply to the IP frayload delivered tothe host, but the IP headers not protected. 2. Tunnel made ESP: Authentication applies to the entire IP packet delivered to the outer IP destination address (eg, a firewall), and authentication ts performed at that destination, The entire inner IP packet ts protected by the privacy mecitanism for delivery to the inner IP destination. % For both cases, authentication applies to the cipher text rather than the plaintext. 1.1.2 Transport Adjaccaey > Another way to apply authentication after encryption is to use two bundled transport SAs, with the inner being an ESP, SA and the outer being an AH, SA. > In this case, ESP is used without its authentication option, Because the inner SA isa transport SA, encryption is applied to the IP payload. > The resulting packet consists of an IP header (and possibly IPv6 header extensions) followed by an ESP. % AH is then applied in transport mode, so that authentication cavers the ESP plus the original IP header (and extensions) except for mutable fields. ee Dept. of ECE, BGSIT, BG Nagara, Mandya Page 23NETWORK AND CYBER SECURITY 15EC835, 17ECKIS: ADVANTAGE AMD DISADVANTAGE > The advantage of this approach over simply using a single ESP SA with the ESP authentication option is that the authentication covers more fields, including the Source and destination IP addresses, % ‘The disadvantage is the overhead of two SAs versus one SA. 11.9 Transport-Tunne! Rundle > The use of authentication prior to encryption might be preferable for several reasons. First, because the authentication data are protected by encrypticn, it is impossitile for anyone to intercept the message and alter the authentication data without detection. * Second, it may be desirable to store the authentication information with the message at the destination for later reference. » Itis more convenient to do this if the authentication information applies to the unencrypted message; otherwise the message would have to be re encrypted to verily the authentication information, 12 BASIC COMBINATIONS @F SECURITY ASSOCLATIONS IMP Qs Aqaestion oa > ‘The IPsec Architecture document lists four examples af combinations of SAs that must be supported by compliant |Psec hosts (e.g, workstation, server) or security gateways (ty. firewall, router), THESE ARE MLUSTRATED IN FIGURE 10, ¥ ‘The lower part of each case in the figitre represents the physical connectivity of the elements; the upper part represents logical connectivity via one or more nested SAs, > Each SA can be elther AH or ESP. > For host-to-host SAs, the mode may be either transport or tunnel; otherwise it must be tunnel mode. CASES > Case 1, All security is provided between end systems that implement IPsec, RH Dept. of ECE, BGSIT, BG Nagara, Mandya Page 24NETWORK AND CYBER SECURITY ASEC8SS, 17ECBaS For any two end systems to communicate via an SA, they must share the appropriate secret keys. Among the possible combinations are 1. AH in transport mode . ESP in transport mode |. ESP followed by AH in transport mode (an ESP SA inside an AH SA) Any one of ab, ar c inside an AM or ESP in tunnel made -eN woe support. The security architecture document specifies that only a single tunnel SA ts needed for this case, The tunnel could support AH, ESP. or ESP with the authentication option, Nested twnnels are not required, because the IPsec services apply to the entire inner packet. » Case 3. This hwilds on case 2 hy adding end-to-end security. The same combinations discussed for cases 1 and 2 are allowed here. The gateway-to- rT Dept, of ECE, BGSIT, BG Nagara, Mandya Page 25NETWORK AND CYBER SECURITY ASEC835, 17ECBaS aca RTA iareRNE RSI hosts can. wise any additional IPsec services required for given applications or given users by means of end-to end SAs. hishind the Breall Only tunnel mode is required between the remote host aid the firewalll As In case 1, one or two SAs may be used hetween the remate hast and the local host. S INTERNET KEY EXCHANGE IMP QS deqmestion) 05 0 > The key management portion of [Psec involves the determination and distribution of secret keys, Atypical requitement is four keys for communication between two applications: transmit and receive pairs for both integrity and confidentiality. % ‘The IPsec Architecture document mandates support fur two types of key management: * Manual: A system administrator manually configures each system with its ‘awn keys and with the keys of other communicating systems. This is practical for small, relatively staticenvironments. © Automated: An automated system enables the on-demand creation of keys for SAc and facilitates the uce of keye in a large distributed cyetem with an ‘evolving configuration. > The default automated key management protocol for IPsec is referred to as ISAKMP/Oakley anid consists of the following elements: * Qakley Key Determination Protocol: Oakley Is a key exchange protocol based on the Diffie-Hellman algorithm but providing added security. Oakley is generic in that it does not dictate specific formats. = Internet Security Association and Key Management Protocol (ISAKMP): ISAKMP provides a framework for Internet key management and provides the specific protocol support, including formats, for negotiation of security attributes. Dept. of ECE, BGSIT, BG Nagara, Mandya Page 26NETWORK AND CYBER SECURITY ASEC8S5, 17ECBaS 3.1 KEY DETERMINATION PHETOCOL = IKE key determination is a refinement of the Diffie-Hellman key exchange algorithm. * The Diffie-Hellman involves the following interaction between users A and B. «© ‘There is prior agreement on two global parameters: g, a large prime number; And a, a primitive rout iof g. ‘+ Aselects a random integer X,,as its private key and transmits to B its public key Yq a™mnd g- * Similarly, B selects a random integer Xp as its private key and transmits to A its public key Yy = %" mod g. Each side can now compute the secret session key: Yay" mod g = (Y4y"* modg = a** mod g © The Diffie-Hellman algorithm has two attractive features: * Secret keys are created only when needed. There is no need to store secret keys fora long period of time, exposing them to increased vulnerability. © The exchange requires no pre-existing infrastructure other than an agreement on the global parameters. * However, there area number of weaknesses to Diffie-Hellman, as painted out in (HUIT98). * Itdoes not provide any information abaut the identities of the parties. © It is subject to a man-in-the-middle attack, in which a third party C impersonates B while communicating with A and impersonates A while communicating with B. Both A and B end up negotiating a key with C, which can then listen to and pass on traffle, The man-in-the-middle attack proceeds as 1. Bsends his public key Yuin a message addressed to A (see Figure 11). 2. ‘The enemy (E) intercepts this message. E saves B's public key and sends a message to A that has B’s User ID but E's public key Yp. This message is sent in such a way that it appears as though it was sent (rom B's host system, A receives E's message and stores E's public key with B's User ID. Similarly, E sends a message to B with E's public key, purporting to come from A. a S Dept, of ECE, BGSIT, BG Nagara, Mandya Page 27NETWORK AND CYBER SECURITY ASEC835, 17ECBaS 3. B computes a secret key KL based on B's private key and Ye. A computes a ‘secret key K2 based on A’s private key and Y,. E computes KI using E's secret key X_ anid Y, and computers K2 using X- And ¥,. Fagiare 11 Mati-in-the-Middle Auacks 4. From now on, E is able to relay messages from A to B and from B to A, appropriately changing their encipherment en route in such a way that neither A nor B will know that they share their communication with E. © It is computationally intensive. As a rexdlt, it is vulnerable to a clogging attack, in which an oppanent requests a high number of keys. The victim spends considerable computing resources doing uscless modular exponentiation rather than real work, es Dept. of ECE, BGSIT, BG Nagara, Mandya Page 20NETWORK AND CYBER SECURITY ASEC8S5, 17ECBaS FEATURES OF UKE KEY PETEMMIN ATION EMP 5 tquestion/-O0M Tue IKE KEY DETERMINATION ALGORITHM IS CHARACTERIZED BY FIVE IMPORTANT FEATURES: 1. Itemploys a mechanism known as cookies to thwart clogging attacks: 2. MW enables the two parties to negotiate a group; this, in essence, specifies the global parameters of the Diffie-Hellman key exchange, 3. Irises nonces to ensure against replay attacks, 4. Itenables the exchange of Diffie-Hellman public key values. 5. It authenticates the Diffie-Hellman exchange to thwart man-in-the-middle attacks. TKE MANDATES THAT COOKIE GENERATION SATISY THREE mASIC REQUIREMENTS: cookies that will be accepted by that entity, This implies that the issuing entity will use local secret information in the generation and subsequent verification of a cookie. It must n possible to ded his seevet inform from an not save copies of its cuokies, which are then more vulnerable to discovery, but can verify an incoming cookie acknowledgment when it needs to, 4. The-cookie generation_and_werification_methods musthe fast te thwart attacks intended to sabotaye processor resources, IKE KEY DETERMINATION SUPPORTS THE USE OF DUFERENT GROUPS FoR THE DIFFE- HELLMAN KEY EXCHANGE EACH GROUP INCLUDES THE DEFINITION OF THE TWO GLOBAL PARAMETERS AND THE IDENTITY OF THE ALGORTHM, THE CURRENT SPECIFICATION INCLUDES THE FOLLOWING GROUPS. * Modular exponentiation with a 768-bit modulus Be I 1 RL x ae] + 1) a=2 ‘© Modolar exponentiation with a 1024-bit modulus ——_—, _ —_—_ Dept. of ECE, BGSIT, BG Nagara, Mandya Page 29