IPSecAn Overview
Somesh Jha
University of Wisconsin
Outline
why IPSec?
IPSec Architecture
Internet Key Exchange (IKE)
IPSec Policy
discussion
IP is not Secure!
IP protocol was designed in the late
70s to early 80s
Part of DARPA Internet Project
Very small network
All hosts are known!
So are the users!
Therefore, security was not an issue
Security Issues in IP
source spoofing
replay packets
no data integrity or
confidentiality
DOS attacks
Replay attacks
Spying
and more
Fundamental Issue:
Networks are not (and will never be
fully secure
4
Goals of IPSec
to verify sources of IP packets
authentication
to prevent replaying of old packets
to protect integrity and/or
confidentiality of packets
data Integrity/Data Encryption
Outline
Why IPsec?
IPSec Architecture
Internet Key Exchange (IKE)
IPsec Policy
Discussion
The IPSec Security Model
Secure
Insecure
IPSec Architecture
ESP
AH
Encapsulating Security
Payload
IPSec Security Policy
Authentication Header
IKE
The Internet Key Exchange
8
IPSec Architecture
IPSec provides security in three
situations:
Host-to-host, host-to-gateway and
gateway-to-gateway
IPSec operates in two modes:
Transport mode (for end-to-end)
Tunnel mode (for VPN)
9
IPsec Architecture
Transport Mode
Router
Router
Tunnel Mode
10
Various Packets
Original
IP header
Transport
mode
IP header
IPSec header TCP header
IP header
IPSec header IP header TCP header
Tunnel
mode
TCP header
data
data
data
11
IPSec
A collection of protocols (RFC 2401)
Authentication Header (AH)
RFC 2402
Encapsulating Security Payload (ESP)
RFC 2406
Internet Key Exchange (IKE)
RFC 2409
IP Payload Compression (IPcomp)
RFC 3137
12
Authentication Header
(AH)
Provides source authentication
Protects against source spoofing
Provides data integrity
Protects against replay attacks
Use monotonically increasing sequence
numbers
Protects against denial of service attacks
NO protection for confidentiality!
13
AH Details
Use 32-bit monotonically increasing
sequence number to avoid replay
attacks
Use cryptographically strong hash
algorithms to protect data integrity
(96-bit)
Use symmetric key cryptography
HMAC-SHA-96, HMAC-MD5-96
14
AH Packet Details
New IP header
Next
header
Payload
length
Reserved
Security Parameters Index (SPI)
Authenticated
Sequence Number
Encapsulated
TCP or IP packet
Old IP header (only in Tunnel mode)
TCP header
Hash of everything
else
Data
Authentication Data
15
Encapsulating Security
Payload (ESP)
Provides all that AH offers, and
in addition provides data
confidentiality
Uses symmetric key encryption
16
ESP Details
Same as AH:
Use 32-bit sequence number to counter
replaying attacks
Use integrity check algorithms
Only in ESP:
Data confidentiality:
Uses symmetric key encryption algorithms
to encrypt packets
17
ESP Packet Details
IP header
Next
header
Payload
length
Reserved
Security Parameters Index (SPI)
Authenticated
Sequence Number
Initialization vector
TCP header
Data
Pad
Pad length
Next
Encrypted TCP
packet
Authentication Data
18
Question?
1.
2.
Why have both AH and ESP?
Both AH and ESP use symmetric
key based algorithms
Why not public-key cryptography?
How are the keys being exchanged?
What algorithms should we use?
Similar to deciding on the ciphersuite
in SSL
19
Outline
Why IPsec?
IPsec Architecture
Internet Key Exchange (IKE)
IPsec Policy
Discussion
20
Internet Key Exchange
(IKE)
Exchange and negotiate security
policies
Establish security sessions
Identified as Security Associations
Key exchange
Key management
Can be used outside IPsec as well
21
IPsec/IKE Acronyms
Security Association (SA)
Collection of attribute associated with a
connection
Is asymmetric!
One SA for inbound traffic, another SA for
outbound traffic
Similar to ciphersuites in SSL
Security Association Database (SADB)
A database of SAs
22
IPsec/IKE Acronyms
Security Parameter Index (SPI)
A unique index for each entry in the
SADB
Identifies the SA associated with a
packet
Security Policy Database (SPD)
Store policies used to establish SAs
23
How They Fit Together
SPD
SA-1
SA-2
SADB
SPI
SPI
24
SPD and SADB Example
As SPD
Transport Mode
Tunnel Mode
As SADB
From
To
Protocol
Port
Policy
Any
Any
AH[HMAC-MD5]
From
To
Protocol
SPI
SA Record
AH
12
HMAC-MD5 key
From
To
Protocol
Port
Policy
Tunnel Dest
Asub
Bsub
Any
Any
ESP[3DES]
From
To
Protocol
SPI
SA Record
Asub
Bsub
ESP
14
3DES key
Cs SPD
Cs SADB
25
How It Works
IKE operates in two phases
Phase 1: negotiate and establish an auxiliary
end-to-end secure channel
Used by subsequent phase 2 negotiations
Only established once between two end points!
Phase 2: negotiate and establish custom
secure channels
Occurs multiple times
Both phases use Diffie-Hellman key exchange
to establish a shared key
26
IKE Phase 1
Goal: to establish a secure channel
between two end points
This channel provides basic security
features:
Source authentication
Data integrity and data confidentiality
Protection against replay attacks
27
IKE Phase 1
Rationale: each application has
different security requirements
But they all need to negotiate
policies and exchange keys!
So, provide the basic security
features and allow application to
establish custom sessions
28
Examples
All packets sent to address
[Link] must be encrypted using
3DES with HMAC-MD5 integrity
check
All packets sent to address
[Link] must use integrity
check with HMAC-SHA1 (no
encryption is required)
29
Phase 1 Exchange
Can operate in two modes:
Main mode
Six messages in three round trips
More options
Quick mode
Four messages in two round trips
Less options
30
Phase 1 (Main Mode)
Initiator
Responder
[Header, SA1]
31
Phase 1 (Main Mode)
Initiator
Responder
[Header, SA1]
[Header, SA2]
Establish vocabulary for further communication
32
Phase 1 (Main Mode)
Initiator
Responder
[Header, SA1]
[Header, SA2]
[Header, KE, Ni, {Cert_Reg} ]
33
Phase 1 (Main Mode)
Initiator
Responder
Header, SA1
[Header, SA1]
[Header, KE, Ni { , Cert_Req} ]
[Header, KE, Nr {, Cert_Req}
Establish secret key using Diffie-Hellman key exchange
Use nonces to prevent replay attacks
34
Phase 1 (Main Mode)
Initiator
Responder
[Header, SA1]
[Header, SA1]
[Header, KE, Ni {,Cert_Req} ]
[Header, KE, Nr {,Cert_Req}]
[Header, IDi, {CERT} sig]
35
Phase 1 (Main Mode)
Initiator
Responder
[Header, SA1]
[Header, SA1]
[Header, KE, Ni {, Cert_req}]
[Header, KE, Nr {, Cert_req}
[Header, IDi, {CERT} sig]
[Header, IDr, {CERT} sig]
Signed hash of IDi (without Cert_req , just send the hash)
36
Phase 1 (Aggressive Mode)
Initiator
Responder
[Header, SA1, KE, Ni, IDi]
37
Phase 1 (Aggressive Mode)
Initiator
Responder
[Header, SA1, KE, Ni, IDi]
[Header, SA2, KE, Nr,
IDr, [Cert]sig]
[Header, [Cert]sig]
First two messages combined into one
(combine Hello and DH key exchange)
38
IPSec (Phase 1)
Four different way to authenticate
(either mode)
Digital signature
Two forms of authentication with public
key encryption
Pre-shared key
NOTE: IKE does use public-key
based cryptography for encryption
39
IPSec (Phase 2)
Goal: to establish custom secure
channels between two end points
End points are identified by <IP, port>:
e.g. <[Link], 8000>
Or by packet:
e.g. All packets going to [Link]/24
Use the secure channel established in
Phase 1 for communication
40
IPSec (Phase 2)
Only one mode: Quick Mode
Multiple quick mode exchanges can
be multiplexed
Generate SAs for two end points
Can use secure channel established
in phase 1
41
IP Payload Compression
Used for compression
Can be specified as part of the
IPSec policy
Will not cover!
42
Outline
Why IPsec?
IPsec Architecture
Internet Key Exchange (IKE)
IPSec Policy
Discussion
43
IPsec Policy
Phase 1 policies are defined in terms of
protection suites
Each protection suite
Must contain the following:
Encryption algorithm
Hash algorithm
Authentication method
Diffie-Hellman Group
May optionally contain the following:
Lifetime
44
IPSec Policy
Phase 2 policies are defined in terms of
proposals
Each proposal:
May contain one or more of the following
AH sub-proposals
ESP sub-proposals
IPComp sub-proposals
Along with necessary attributes such as
Key length, life time, etc
45
IPSec Policy Example
In English:
All traffic to [Link]/24 must be:
Use pre-hashed key authentication
DH group is MODP with 1024-bit modulus
Hash algorithm is HMAC-SHA (128 bit key)
Encryption using 3DES
In IPSec:
[Auth=Pre-Hash;
DH=MODP(1024-bit);
HASH=HMAC-SHA;
ENC=3DES]
46
IPsec Policy Example
In English:
All traffic to [Link]/24 must use one
of the following:
AH with HMAC-SHA or,
ESP with 3DES as encryption algorithm and
(HMAC-MD5 or HMAC-SHA as hashing algorithm)
In IPsec:
[AH: HMAC-SHA] or,
[ESP: (3DES and HMAC-MD5) or
(3DES and HMAC-SHA)]
47
Virtual Private Networks
(VPNs)
Virtual
It is not a physically distinct network
Private
Tunnels are encrypted to provide
confidentiality
CS dept might have a VPN
I can be on this VPN while traveling
48
Alice is Traveling
Alice works for the mergers and
acquisitions (M&A) department of
[Link]
She is at Hicktown taking over a
meat-packing plant
She wants to access the M&A server
at her company (confidentially of
course)
49
Alice is Traveling
50
Outline
Why IPsec?
IPsec Architecture
Internet Key Exchange (IKE)
IPsec Policy
Discussion
51
Discussion
IPSec is not the only solution!
Security features can be added on top
of IP!
e.g. Kerberos, SSL
Confused?
IP, IPSec protocols are very complex!
Two modes, three sub protocols
Complexity is the biggest enemy of
security
52
Discussion
Has it been used?
Yesprimarily used by some VPN vendors
But not all routers support it
Noit is not really an end-to-end solution
Authentication is too coarse (host based)
Default encryption algorithm too weak (DES)
Too complex for applications to use
53
Resources
IP, IPsec and related RFCs:
[Link]
IPsec: RFC 2401, IKE: RFC 2409
[Link]
Google search
54