Cryptography and Network Security: Principles and Practice,
Module 05. 1. Explain with a neat diagram, how an IPSec VPN Scenario works?
IPsec (IP Security) is often used to secure communications across private and public WANs and the Internet.
A common scenario is building a virtual private network (VPN) to connect branch offices or remote users to
an organization's internal network securely.
In this scenario, an organization maintains LANs at dispersed locations. Traffic within each LAN is
nonsecure. However, traffic moving offsite through the Internet uses IPsec protocols. These protocols
operate in networking devices, such as a router or firewall, that connect each LAN to the outside world.
How it works:
1. Encryption: The IPsec networking device (like a firewall) at the source encrypts and compresses all
traffic going into the WAN.
2. Transmission: The encrypted data travels securely over the public network (Internet).
3. Decryption: The IPsec networking device at the destination decrypts and decompresses the traffic
coming from the WAN.
4. Transparency: These operations are transparent to the workstations and servers on the internal
LANs.
Diagram Reference:
• Figure 19.1: An IP Security Scenario
• Page Number: 618
• Document: DOC-20251203-WA0023..pdf
• Description: The diagram shows User Systems and Ethernet Switches connecting to a "Networking
device with IPsec." These devices connect via a Public (Internet) or Private Network. It illustrates
that the IP Payload is encrypted between the networking devices.
2. With a neat diagram Explain Simple example of DKIM Deployment.
DomainKeys Identified Mail (DKIM) allows an organization to cryptographically sign email messages to
prove that the message originated from their domain.
How it works:
1. Message Origination: A user generates an email using a Message User Agent (MUA).
2. Submission: The email is sent to a Mail Submission Agent (MSA) within the user's administrative
domain.
3. Signing: The message content and selected headers are signed by the e-mail provider (the Signer)
using the provider's private key. This generally happens at the Message Transfer Agent (MTA).
4. Transmission: The signed message passes through the Internet via a sequence of MTAs.
5. Verification: At the destination, the Mail Delivery Agent (MDA) or Verifier retrieves the public key
of the signing domain via a DNS query.
6. Delivery: The Verifier checks the signature. If valid, the message is passed to the destination email
client.
Diagram Reference:
• Figure 18.10: Simple Example of DKIM Deployment
• Page Number: 608
• Document: DOC-20251203-WA0023..pdf
• Description: The diagram shows the flow from the "Mail origination network" (Signer) through the
Internet (SMTP) to the "Mail delivery network" (Verifier). It explicitly depicts the DNS public-key
query/response used for verification.
3. Brief about the Applications of IPSec.
IPsec provides the capability to secure communications across LANs, WANs, and the Internet. The key
applications include:
1. Secure branch office connectivity over the Internet: Companies can build secure virtual private
networks (VPNs) over the Internet, reducing reliance on expensive private leased lines.
2. Secure remote access over the Internet: Employees can connect to the corporate network securely
from anywhere using a local call to an Internet Service Provider (ISP), reducing toll charges.
3. Establishing extranet and intranet connectivity with partners: IPsec secures communication with
other organizations, providing authentication and confidentiality.
4. Enhancing electronic commerce security: IPsec guarantees that all traffic designated by the
network administrator is encrypted and authenticated, adding a layer of security below the
application layer (like Web browsers).
5. Routing Applications: IPsec can secure routing protocols (like OSPF) by ensuring router
advertisements and routing updates come from authorized routers and are not forged.
4. Illustrate IPSec Architecture with a neat diagram.
The IPsec architecture documents cover general concepts, security requirements, definitions, and
mechanisms. The architecture highlights the interaction between key databases and protocols.
Key Components:
• Security Policy Database (SPD): Determines the policy (discard, bypass, or protect) applied to
traffic.
• Security Association Database (SAD): Stores parameters for active Security Associations (SAs).
• Internet Key Exchange (IKE): A protocol for key management and exchange.
• ESP/AH: The actual security protocols (Encapsulating Security Payload / Authentication Header)
that protect the data.
Diagram Reference:
• Figure 19.2: IPsec Architecture
• Page Number: 622
• Document: DOC-20251203-WA0023..pdf
• Description: The diagram illustrates the relationship between the SPD, SAD, IKEv2, and the IPsec
protocols (ESP/AH). It shows how key exchange feeds into the SAD and how packet processing
interacts with both the SPD and SAD.
5. Explain DomainKeys Identified Mail (DKIM) in detail.
DomainKeys Identified Mail (DKIM) is a specification for cryptographically signing e-mail messages. It
allows a signing domain to claim responsibility for a message in the mail stream.
Key Concepts:
• Transparency: DKIM is designed to be transparent to the end user. The signature is applied by the
administrative domain (e.g., the ISP or corporate email gateway), not necessarily the individual user's
client software.
• Signing: The e-mail message is signed using a private key associated with the domain. The signature
covers the message content and specific headers.
• Verification: Recipients can verify the signature by querying the signer's domain directly via the
Domain Name System (DNS) to retrieve the appropriate public key.
• Purpose: It confirms that the message was attested to by a party in possession of the private key for
the signing domain. This helps prevent forgers from masquerading as good senders and allows
receivers to filter spam based on the reputation of the signing domain,.
6. Analyze a real email header and identify the DKIM signature field.
A DKIM signature is inserted into an email as an additional header entry starting with the keyword Dkim-
Signature.
Example Header Analysis: Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=[Link]; s=gamma;
h=domainkey-signature:mime-version:received:date:message-id:subject:from:to:content-type:content-transfer-encoding;
bh=5mZvQ...; b=PcUvP...
Field Identification:
• v=1: DKIM version.
• a=rsa-sha256: The algorithm used to generate the signature (RSA with SHA-256).
• c=relaxed/relaxed: Canonicalization method used for the header and body (to handle minor changes
en route).
• d=[Link]: The Signing Domain Identifier (SDID). This claims the message is from [Link].
• s=gamma: The selector. This allows the domain to have multiple keys; the verifier uses this to find
the specific public key in DNS.
• h=...: A list of signed header fields.
• bh=...: The hash of the canonicalized body part of the message.
• b=...: The actual signature data in base64 format,.
7. Explain how Domain Keys Identified Mail (DKIM) verifies email authenticity.
Verification is performed by an authorized module within the verifying Administrative Management
Domain (ADMD) (e.g., the receiving MTA or MDA).
The Verification Process:
1. Parse Header: The verifier reads the Dkim-Signature header.
2. Retrieve Key: It uses the domain (d=) and the selector (s=) tags from the signature to perform a DNS
lookup. It requests the TXT record that contains the public key for that specific selector and domain.
3. Canonicalization: The verifier applies the specified canonicalization (c=) to the received message
headers and body to match the format used by the signer.
4. Hash Calculation: It computes the hash of the message body and headers.
5. Signature Check: It uses the retrieved public key to verify the digital signature (b=).
6. Result: If the signature is valid, the message is authentic. The reputation of the signer can then be
assessed to determine if the message should be delivered or filtered,.
8. Implement DKIM signing and verification using a mail server or online DKIM tool.
Note: While the source text does not provide a software manual for specific tools, it describes the functional
implementation logic required for mail servers.
Signing Implementation (at the Sender's MTA):
1. Private Key Store: The signing ADMD must generate a private/public key pair and store the private
key securely.
2. Canonicalization: Before signing, the server must normalize the header and body using "simple" or
"relaxed" algorithms to account for minor transmission changes (like whitespace).
3. Hashing and Signing: The server calculates a hash of the body and selected headers (e.g., SHA-
256). It then encrypts this hash with the private key to create the signature value b=.
4. Header Insertion: The server prepends the Dkim-Signature header to the email before it leaves the
network.
Verification Implementation (at the Receiver's MTA):
1. Extraction: The server extracts the signature and the selector/domain tags.
2. DNS Lookup: The server queries the DNS of the sender (e.g., selector._domainkey.[Link]) to get
the public key.
3. Crypto Validation: The server performs the cryptographic verification using the public key. If
successful, the message is treated as authenticated.
9. Demonstrate how DNS publishes a DKIM public key using a TXT record.
To allow verification, the signing domain must publish its public key where verifiers can find it. This is done
using the Domain Name System (DNS).
The Process:
1. Selector: The signer chooses a "selector" (e.g., gamma or s1). This allows multiple keys to exist for a
domain (e.g., for different departments or key rotation).
2. DNS Record: The domain administrator adds a TXT record to their DNS zone file.
3. Structure: The record is placed at a specific subdomain constructed as: selector._domainkey.domainname.
4. Retrieval: When a verifier sees d=[Link] and s=jun2025 in the email header, it queries DNS for
the TXT record at jun2025._domainkey.[Link]. The response contains the public key required to
decrypt the signature hash.
10. Explain the structure and role of the Security Association Database (SAD).
In IPsec, the Security Association Database (SAD) defines the parameters associated with each active
Security Association (SA).
Role: It allows the IPsec implementation to determine how to process incoming and outgoing packets
associated with a specific security connection.
Structure (Parameters in an SAD entry):
• Security Parameter Index (SPI): A 32-bit value used to identify the SA.
• Sequence Number Counter: Generates the Sequence Number field in headers.
• Sequence Counter Overflow: A flag indicating if overflow should stop transmission.
• Anti-Replay Window: Used to detect replay attacks.
• AH Information: Authentication algorithms, keys, and lifetimes (if AH is used).
• ESP Information: Encryption/authentication algorithms, keys, IVs, and lifetimes (if ESP is used).
• Lifetime of this Security Association: Time interval or byte count after which the SA must be
replaced.
• IPsec Protocol Mode: Tunnel, transport, or wildcard.
• Path MTU: Observed path maximum transmission unit.
11. Apply IPsec and DKIM concepts to propose a multi-layered security plan for a
small enterprise.
A multi-layered security plan combines network-level protection with application-level trust.
Layer 1: Network Security (IPsec)
• Objective: Secure site-to-site and remote access connectivity.
• Plan: Implement IPsec in Tunnel Mode on the enterprise firewall. This creates a Virtual Private
Network (VPN).
o Why: It encrypts all traffic entering and leaving the enterprise network via the Internet,
protecting against eavesdropping and traffic analysis. It effectively extends the secure internal
network to remote workers or branch offices.
Layer 2: Application Security (Email - DKIM)
• Objective: Ensure the integrity of outgoing email and verify incoming email to prevent phishing.
• Plan: Configure the enterprise Mail Transfer Agent (MTA) to implement DKIM.
o Outgoing: The MTA signs all outgoing email using the enterprise's private key. This allows
receivers to verify the email truly originated from the enterprise domain.
o Incoming: The MTA validates signatures on incoming mail. If a signature fails or is missing
from a domain known to sign (reputation), the email is filtered as potential spam/phishing.
This protects employees from email-based fraud,.
12. Explain with a diagram, ESP Formats for:
• [Link] level format of an
ESP Packet
• Substructure of Payload data.
Top Level Format of an ESP Packet: The Encapsulating Security Payload (ESP) packet consists of a
header, the encrypted payload, and a trailer.
• Header: Contains the Security Parameters Index (SPI) (32 bits) and the Sequence Number (32
bits).
• Encrypted Portion: Includes the Payload Data, Padding, Pad Length, and Next Header.
• Trailer/Auth: Contains the Integrity Check Value (ICV) (variable length) if authentication is
selected.
Substructure of Payload Data:
• Initialization Value (IV): Optional, present if required by the encryption algorithm.
• TFC Padding: Traffic Flow Confidentiality padding (optional).
• Rest of Payload Data: The actual data being protected (e.g., TCP segment or IP packet).
Diagram Reference:
• Figure 19.5: ESP Packet Format
• Page Number: 628
• Document: DOC-20251203-WA0023..pdf
• Description: Figure 19.5(a) shows the top-level fields (SPI, Sequence, Payload, Padding, ICV).
Figure 19.5(b) shows the internal structure of the Payload Data (IV, TFC Padding, Data),.
13. Briefly Explain the Benefits of IPSec.
The benefits of implementing IPsec include:
1. Perimeter Security: When implemented in a firewall or router, it provides strong security to all
traffic crossing the perimeter.
2. Resistant to Bypass: In a firewall, it is resistant to bypass if all outside traffic must use IP and pass
through the firewall.
3. Transparency to Applications: It is below the transport layer (TCP/UDP), so applications (email,
web, etc.) do not need to be modified to use it.
4. Transparency to Users: Users do not need to be trained on security mechanisms; the security
processing happens automatically at the network layer.
5. Individual Security: It can provide security for individual users (e.g., offsite workers) if needed.
Follow My insta ID for more notes
[Link]
g==