Crypto 5th Module
Crypto 5th Module
Module 5
IP SECURITY
Secure branch office connectivity over the Internet: A company can build a secure virtual
private network over the Internet or over a public WAN. This enables a business to rely
heavily on the Internet and reduce its need for private networks, saving costs and network
management overhead.
Secure remote access over the Internet: An end user whose system is equipped with IP
security protocols can make a local call to an Internet Service Provider (ISP) and gain secure
access to a company network. This reduces the cost of toll charges for traveling employees
and telecommuters.
Establishing extranet and intranet connectivity with partners: IPsec can be used to secure
communication with other organizations, ensuring authentication and confidentiality and
providing a key exchange mechanism.
Enhancing electronic commerce security: Even though some Web and electronic
commerce applications have built-in security protocols, the use of IPsec enhances that
security. IPsec guarantees that all traffic designated by the network administrator is both
encrypted and authenticated, adding an additional layer of security to whatever is provided
at the application layer.
Secure transmission is also possible with individual users who dial into the WAN. Such
user workstations must implement the IPsec protocols to provide security.
An IP Security Scenario
Benefits of IPsec
Some of the benefits of IPsec are:
When IPsec is implemented in a firewall or router, it provides strong security that can be
applied to all traffic crossing the perimeter.
IPsec in a firewall is resistant to bypass if all traffic from the outside must use IP and the
firewall is the only means of entrance from the Internet into the organization.
IPsec is below the transport layer (TCP, UDP) and so is transparent to applications.
IPsec can be transparent to end users. There is no need to train users on security mechanisms,
issue keying material on a per-user basis, or revoke keying material when users leave the
organization.
IPsec can provide security for individual users if needed.
Routing Applications
IPsec can assure that
A router advertisement comes from an authorized router.
A neighbor advertisement comes from an authorized router.
A redirect message comes from the router to which the initial IP packet was sent.
A routing update is not forged.
IPsec Documents :
IPsec encompasses three functional areas: authentication, confidentiality, and key
management. The best way to grasp the scope of IPsec is to consult the latest version of the
IPsec document roadmap, which as of this writing is [FRAN09].
IPsec Services
IPsec provides security services at the IP layer by enabling a system to select required
security protocols, determine the algorithm(s) to use for the service(s), and put in place any
cryptographic keys required to provide the requested services.
Two protocols are used to provide security:
An authentication protocol designated by the header of the protocol,
Authentication Header (AH)
A combined encryption/ authentication protocol designated by the format of the
packet for that protocol, Encapsulating Security Payload (ESP).
The services are:
Access control
Connectionless integrity
Data origin authentication
Rejection of replayed packets (a form of partial sequence integrity)
Confidentiality (encryption)
Limited traffic flow confidentiality
Security Associations
An association is a one-way logical connection between a sender and a receiver that affords
security services to the traffic carried on it.
Security association (SA) is the key concept for both authentication and confidentiality
mechanism for IP.
A security association is uniquely identified by three parameters.
Security Parameters Index (SPI): A bit string assigned to this SA and having local
significance only. The SPI is carried in AH and ESP headers to enable the receiving
system to select the SA under which a received packet will be processed.
IP Destination Address: This is the address of the destination endpoint of the SA,
which may be an end-user system or a network system such as a firewall or router.
Security Protocol Identifier: This field from the outer IP header indicates whether
the association is an AH or ESP security association.
Outbound processing obeys the following general sequence for each IP packet:
1. Compare the values of the appropriate fields in the packet (the selector fields) against
the SPD to find a matching SPD entry, which will point to zero or more SAs.
2. Determine the SA if any for this packet and its associated SPI.
3. Do the required IPsec processing (i.e., AH or ESP processing).
Data sensitivity level: used for systems providing information flow security
Transport layer protocol: this may be an individual protocol number, a list of protocol
numbers, or a range of protocol numbers
Source and Destination ports: these may be individual TCP or UDP port values, an
enumerated list of ports or a wildcard port
Transport Mode:
Transport mode provides protection primarily for upper-layer protocols.
Transport mode protection extends to the payload of an IP packet.
Example: TCP or UDP segment or an ICMP packet
Transport mode is used for end-to-end communication between two hosts (e.g., a client and
a server, or two workstations).
When a host runs AH or ESP over IPv4, the payload is the data that normally follow the IP
header.
For IPv6, the payload is the data that normally follow both the IP header and any IPv6
extensions headers that are present, with the possible exception of the destination options
header, which may be included in the protection.
ESP in transport mode encrypts and optionally authenticates the IP payload but not the IP
header.
AH in transport mode authenticates the IP payload and selected portions of the IP header.
Tunnel Mode:
Tunnel mode provides protection to the entire IP packet. To achieve this, after the AH or
ESP fields are added to the IP packet, the entire packet plus security fields is treated as the
payload of new outer IP packet with a new outer IP header.
The entire original, inner, packet travels through a tunnel from one point of an IP
network to another; no routers along the way are able to examine the inner IP header.
Because the original packet is encapsulated, the new, larger packet may have totally
different source and destination addresses, adding to the security.
Tunnel mode is used when one or both ends of a security association (SA) are a security
gateway, such as a firewall or router that implements IPsec.
Next Header (8 bits): Identifies the type of the header immediately following this header.
Payload Length(8 bits): Length of authentication header in 32-bit words, minus 2.
Reserved(16 bits): For future use.
Security Parameters Index(32 bits): Identifies a security association.
Anti-Replay service
A replay attack is one in which an attacker obtains a copy of an authenticated packet and
later transmits it to the intended destination
The sequence number field is designed to thwart such attacks
When a new SA is established, the sender initializes a sequence number counter to 0
Each time a packet is sent on this SA, the sender increments the counter and places the
value in sequence number field .Thus, the first value to be used is 1.
If anti-replay is enabled, the sender must not allow the sequence number to cycle past
232 – 1 back to 0 otherwise, there would be multiple valid packets with the same sequence
number.
If the limit of 232 – 1 is reached, the sender should terminate this SA and negotiate a
new SA with a new key.
Because IP is a connectionless, unreliable service, the protocol does not guarantee that
packets will be delivered in order and does not guarantee that all packets will be delivered.
The IPSec authentication document dictates that the receiver should implement a
window of size W with a default of W=64.
The right edge of the window represents the highest sequence number, , so far received
for a valid packet.
For any packet with a sequence number in the range from to that has been correctly
received (i.e., properly authenticated), the corresponding slot in the window is marked .
Anti-replay Mechanism
1. If the received packet falls within the window and is new, the MAC is checked. If the packet is
authenticated, the corresponding slot in the window is marked.
2. If the received packet is to the right of the window and is new, the MAC is checked. If the
packet is authenticated, the window is advanced so that this sequence number is the right edge of
the window, and the corresponding slot in the window is marked.
3. If the received packet is to the left of the window, or if authentication fails, the packet is
discarded; this is an auditable event.
Transport Mode:
In this case authentication is provided directly between a server and client workstations;
the workstations can be either on the same network as the server or on an external network.
As long as the workstation and the server share a protected secret key, the authentication
process is secure.
Tunnel Mode:
In this case a remote workstation authenticates itself to the corporate firewall, either for
access to the entire internal network or because the requested server does not support the
authentication feature.
For transport mode AH using IPv4, the AH is inserted after the original IP header and
before the IP payload
Authentication covers the entire packet, excluding mutable fields in the IPv4 header that
are set to zero for MAC calculation
For tunnel mode AH, the entire original IP packet is authenticated and the AH is
inserted between the original IP header and a new outer IP header
The inner IP header carries the ultimate source and destination address
The outer IP header may contain different IP addresses
The below diagram shows Scope of AH Encryption and Authentication scheme
Scope of AH Authentication
ESP Format
In below Figure shows the format of an ESP packet. It contains the following fields.
Authentication coverage
Confidentiality
coverage
3. The destination firewall examines and processes the outer IP header plus any outer IP
extension headers. This packet is then transmitted in the internal network.
4. The inner packet is routed through zero or more routers in the internal network to the
destination host.
Transport Adjacency
Another way to apply authentication after encryption is to use two bundled transport SAs,
with the inner being an ESP SA and the outer being an AH SA
Here ESP is used without its authentication option. Because the inner SA is a transport
SA, encryption is applied to the IP payload.
The resulting packet consists of an IP header followed by an ESP.
AH is then applied in transport mode, so that authentication covers the ESP plus the
original IP header except for mutable fields.
Advantage
This approach over simply using a single ESP SA with the ESP authentication option is
that the authentication covers more fields, including the source and destination IP
addresses.
Disadvantage
The disadvantage is the overhead of two SAs versus one SA.
Transport-Tunnel Bundle
The use of authentication prior to encryption might be preferable for several reasons.
1. Because the authentication data are protected by encryption, it is impossible for
anyone to intercept the message and alter the authentication data without detection.
2. It may be desirable to store the authentication information with the message at the
destination for later reference.
The IPsec Architecture document lists four examples of combinations of SAs that
must be supported by compliant IPsec hosts (e.g., workstation, server) or security
gateways (e.g. firewall, router).
Nested tunnels are not required, because the IPsec services apply to the entire inner
packet.
Case 3.
This builds on case 2 by adding end-to-end security.
The same combinations applies for cases 1 and 2 are allowed here.
The gateway-to-gateway tunnel provides either authentication, confidentiality, or both for
all traffic between end systems.
When the gateway-to-gateway tunnel is ESP, it also provides a limited form of traffic
confidentiality.
Individual hosts can implement any additional IPsec services required for given
applications or given users by means of end-to-end SAs.
Case 4.
This provides support for a remote host that uses the Internet to reach an organization’s
firewall and then to gain access to some server or workstation behind the firewall.
Only tunnel mode is required between the remote host and the firewall.
As in case 1, one or two SAs may be used between the remote host and the local host.
Secret keys are created only when needed. There is no need to store secret keys for
a long period of time, exposing them to increased vulnerability.
The exchange requires no pre-existing infrastructure other than an agreement on
the global parameters. The oakley key determination algorithm is characterized by
five important features:
Disadvantages of Diffie-Hellman key exchange algorithm
1. It does not provide any information about the identities of the parties.
2. It is subject to a man-in-the-middle attack, in which a third party C impersonates B while
communicating with A and impersonates A while communicating with B. Both A and B
end up negotiating a key with C, which can then listen to and pass on traffic
3. B computes a secret key K1 based on B’s private key and YE. A computes a secret key K2
based on A’s private key and YE. E computes K1 using E’s secret key XE and YB and
computers K2 using XE and YA.
4. E is able to relay messages from A to B and from B to A, appropriately changing their
encipherment en route in such a way that neither A nor B will know that they share their
communication with E.
Features of Oakley
The IKE key determination algorithm is characterized by five important features:
1. It employs a mechanism known as cookies to thwart clogging attacks.
2. It enables the two parties to negotiate a group; this, in essence, specifies the global
parameters of the Diffie-Hellman key exchange.
3. It uses nonces to ensure against replay attacks.
4. It enables the exchange of Diffie-Hellman public key values.
5. It authenticates the Diffie-Hellman exchange to thwart man-in-the-middle attacks.
ISAKMP
It defines procedures and packet formats to establish, negotiate, modify, and delete
security associations.
As part of SA establishment, IKE defines payloads for exchanging key generation and
authentication data.
These payload formats provide a consistent framework independent of the specific key
exchange protocol, encryption algorithm, and authentication mechanism.
IKE Formats
Minor Version (4 bits): Indicates minor version in use. • Exchange Type (8 bits):
Indicates the type of exchange
Flags (8 bits): Indicates specific options set for this ISAKMP exchange.
Message ID (32 bits): Used to control retransmission of lost packets and matching of
requests and responses.
Length (32 bits): Length of total message (header plus all payloads) in octets.
1. Security Association:
The SA payload is used to begin the establishment of an SA. The payload has a complex,
hierarchical structure.
The payload may contain multiple proposals. Each proposal may contain multiple
protocols.
Each protocol may contain multiple transforms. And each transform may contain multiple
attributes.
These elements are formatted as substructures within the payload as follows.
Proposal: This substructure includes a proposal number, a protocol ID (AH, ESP, or
IKE), an indicator of the number of transforms, and then a transform substructure•
Transform: The transforms are used primarily to define cryptographic algorithms to
be used with a particular protocol.
Attribute: Each transform include attributes that modify or complete the
specification of the transform. An example is key length.
2. Key Exchange payload:
The Key Exchange payload can be used for a variety of key exchange techniques,
including Oakley, Diffie-Hellman, and the RSA-based key exchange used by PGP.
The Key Exchange data field contains the data required to generate a session key and is
dependent on the key exchange algorithm used.
3. Identification Payload:
The Identification payload is used to determine the identity of communicating peers and
may be used for determining authenticity of information. Typically the ID Data field will
contain an IPv4 or IPv6 address.
4. Certificate payload :
The Certificate payload transfers a public-key certificate. The Certificate Encoding field
indicates the type of certificate or certificate-related information, which include the
following:
• PKCS #7 wrapped X.509 certificate
• PGP certificate
• DNS signed key
• X.509 certificate—signature
• X.509 certificate—key exchange
• Kerberos tokens
• Certificate Revocation List (CRL)
• Authority Revocation List (ARL)
• SPKI certificate
5. Certificate Request:
At any point in an IKE exchange, the sender may include a Certificate Request payload
to request the certificate of the other communicating entity.
The payload may list more than one certificate type that is acceptable and more than one
certificate authority that is acceptable.
6. Authentication payload:
The Authentication payload contains data used for message authentication purposes.The
authentication method types so far defined are RSA digital signature, shared-key message
integrity code, and DSS digital signature.
7. Nonce payload :
The Nonce payload contains random data used to guarantee liveness during an exchange
and to protect against replay attacks.
8. Notify payload:
The Notify payload contains either error or status information associated with this SA or
this SA negotiation.
9. Delete payload:
The Delete payload indicates one or more SAs that the sender has deleted from its database
and that therefore are no longer valid.
10. Vendor ID payload:
The Vendor ID payload contains a vendor-defined constant. The constant issued by
vendors to identify and recognize remote instances of their implementations. This
mechanism allows a vendor to experiment with new features while maintaining backward
compatibility.
11. Traffic Selector payload:
The Traffic Selector payload allows peers to identify packet flows for processing by IPsec
services.
12. Traffic Selector payload:
The Encrypted payload contains other payloads in encrypted form. The encrypted payload
format is similar to that of ESP. It may include an IV if the encryption algorithm requires
it and an ICV if authentication is selected.
13. Configuration payload:
The Configuration payload is used to exchange configuration information between IKE
peers.
14. Extensible Authentication Protocol (EAP) payload: The Extensible Authentication
Protocol (EAP) payload allows IKE SAs to be authenticated using EAP,