IP Security

IPSEC Objectives
 Band-aid for IPv4
 Spoofing a problem
 Not designed with security or authentication in
mind
 IP layer mechanism for IPv4 and IPv6
 Not all applications need to be security aware
 Mandatory in IPv6, optional in IPv4
 Can be transparent to applications and users
 Resistant to bypass
IPSec Uses
Security Associations
 A one-way relationship between sender &
receiver that affords security for traffic flow
 Can be between
 A pair of hosts
 A host and a security gateway
 A pair of security gateways
 Two basic protocols
 Authentication headers (AH)
 Encapsulating security payload (ESP)
 Architecture & Concepts
 Tunnel vs. Transport mode
 Security association (SA)
 Security parameter index (SPI)
 Security policy database (SPD)
 SA database (SAD)
 Authentication header (AH)
 Encapsulating security payload (ESP)
 Key management
 Transport Mode vs. Tunnel Mode
 Transport mode: host -> host
 Tunnel mode: host->gateway or gateway->gateway

Encrypted Tunnel

Gateway 1 Gateway 2

Encrypted Unen
y pt ed crypt
A nencr ed
B
U

New IP AH or ESP Orig IP TCP Data

Header Header Header
Transport Mode
IP IP IPSec Higher
header options header layer protocol

Real IP ESP
destination
AH

 ESP protects higher layer payload only

 AH can protect IP headers as well as higher
layer payload
Tunnel Mode
Outer IP IPSec Inner IP Higher
header header header layer protocol

Destination ESP Real IP destination

IPSec
entity
AH

 ESP applies only to the tunneled packet

 AH can be applied to portions of the outer
header
 Security Association - SA
 Defined by 3 parameters:
 Security Parameters Index (SPI)
 IP Destination Address
 Security Protocol Identifier
 Have a database of Security Associations
 Determine IPSec processing for senders
 Determine IPSec decoding for destination
 SAs are not fixed! Generated and customized per
traffic flows
 Security Parameters Index - SPI
 Can be up to 32 bits large
 The SPI allows the destination to select the
correct SA under which the received packet
will be processed
 According to the agreement with the sender
 The SPI is sent with the packet by the sender
 SPI + Dest IP address + IPSec Protocol (AH or
ESP) uniquely identifies a SA
SA Database - SAD
 Holds parameters for each SA
 Lifetime of this SA
 AH and ESP information
 Tunnel or transport mode
 Every host or gateway participating in
IPSec has their own SA database
 Security Policy Database - SPD
 What traffic to protect?
 Policy entries define which SA or SA
bundles to use on IP traffic
 Each host or gateway has their own SPD
 Index into SPD by Selector fields
 Dest IP, Source IP, Transport Protocol, IPSec
Protocol, Source & Dest Ports, …
SPD Entry Actions
 Discard
 Do not let in or out
 Bypass
 Outbound: do not apply IPSec
 Inbound: do not expect IPSec
 Protect – will point to an SA or SA bundle
 Outbound: apply security
 Inbound: check that security must have been
applied
SPD Protect Action
 If the SA does not exist…
 Outbound processing: use IKE to generate SA
dynamically
 Inbound processing: drop packet
 Outbound Processing
Outbound packet (on A)
A B
IP Packet
SPD SA
(Policy) Database
Is it for IPSec?
If so, which policy
entry to select?

IPSec processing

… … SPI & IPSec

Packet
Determine the SA
and its SPI

Send to B
 Inbound Processing

Inbound packet (on B) A B

From A
SA Database SPD
SPI & Packet
(Policy)
Use SPI to Was packet properly
index the SAD secured?

Original IP Packet
…
“un-process” …
 Architecture & Concepts
 Tunnel vs. Transport mode
 Security association (SA)
 Security parameter index (SPI)
 Security policy database (SPD)
 SA database (SAD)
 Authentication header (AH)
 Encapsulating security payload (ESP)
 Key management
 Authenticated Header
 Data integrity
 Entire packet has not been tampered with
 Authentication
 Can “trust” IP address source
 Use keyed MAC to authenticate
 Symmetric encryption, e.g, DES
 One-way hash functions with a shared secret key, e.g,
HMAC-MD5-96 or HMAC-SHA-1-96
 Anti-replay feature
 Integrity check value
 IPSec Authenticated Header
Length of the authentication header
SAD

Next Header Payload Length

(TCP/UDP) Reserved

…
SPI
Sequence Number

ICV
 Integrity Check Value - ICV
 Keyed Message authentication code (MAC)
calculated over
 IP header field that do not change or are predictable
 Source IP address, destination IP, header length, etc.
 Prevent spoofing
 Mutable fields: time-to-live (TTL), IP header checksum,
etc.
 IPSec protocol header except the ICV value field
 Upper-level data
 Code may be truncated to first 96 bits
AH: Tunnel and Transport Mode
 Original
 Transport Mode
 Cover most of the
original packet
 Tunnel Mode
 Cover entire
original packet
Encapsulating Security Payload (ESP)
 Provide message content confidentiality
 Provide limited traffic flow confidentiality
 Can optionally provide the same authentication
services as AH
 Supports range of ciphers, modes, padding
 Incl. DES, Triple-DES, RC5, IDEA, CAST etc
 A variant of DES most common
 Pad to meet blocksize, for traffic flow
ESP: Tunnel and Transport Mode
 Original

 Transport Mode
 Good for host to
host traffic
 Tunnel Mode
 Good for VPNs,
gateway to gateway
security
 Outbound Packet Processing
 Form ESP header
 Security parameter index (SPI)
 Sequence number
 Pad as necessary
 Encrypt result [payload, padding, pad length,
next header]
 Apply authentication (optional)
 Allow rapid detection of replayed/bogus packets
 Allow potential parallel processing - decryption &
verifying authentication code
 Integrity Check Value (ICV) includes whole ESP
packet minus authentication data field
 Original IP Header
ESP Transport Example
Authentication coverage SPI
Sequence Number

Payload (TCP Header and Data)

Encrypted

Variable Length

Padding (0-255 bytes)

Pad Next
Length Header

Integrity Check Value

Inbound Packet Processing...
 Sequence number checking
 Duplicates are rejected!
 Packet decryption
 Decrypt quantity [ESP payload,padding,pad
length,next header] per SA specification
 Processing (stripping) padding per encryption
algorithm
 Reconstruct the original IP datagram
 Authentication verification (option)
 Architecture & Concepts
 Tunnel vs. Transport mode
 Security association (SA)
 Security parameter index (SPI)
 Security policy database (SPD)
 SA database (SAD)
 Authentication header (AH)
 Encapsulating security payload (ESP)
 Key management
 Key Management
 Handles key generation & distribution
 Typically need 2 pairs of keys
 2 per direction for AH & ESP
 Manual key management
 Sysadmin manually configures every system
 Automated key management
 Automated system for on demand creation of keys
for SA’s in large systems
 NATs
 Network address translation = local, LAN-specific
address space translated to small number of globally
routable IP addresses
 Motivation:
 Scarce address space
 cost: about $9k/year for up to 262,000 addresses
 Security: prevent unsolicited inbound requests
 Prevalence of NATs
 Claim: 50% of broadband users are behind NATs
 All Linksys/D-Link/Netgear home routers are NATs
 NAT types
 All use net-10/8 (10.*.*.*) or 192.168/16
 Address translation
 Address-and-port translation (NAPT)
 most common form today, still called NAT
 one external (global) IP address
 Change IP header and TCP/UDP headers
 Will it work with IPSec?
 NAT Example
Messages sent between host B
IAP’s Point of Presence to another host on the Internet
Host B original source socket:
192.168.0.101 port 1341
Host B translated socket:
68.40.162.3 port 5280

A B C

Router with NAT

External IP: 68.40.162.3 Router assigns internal
Internal IP: 192.168.0.0 IPs to hosts on LAN :
A: 192.168.0.100
B: 192.168.0.101
C: 192.168.0.102
Backup Slides
SA Bundle
 More than 1 SA can apply to a packet
 Example: ESP does not authenticate new IP
header. How to authenticate?
 Use SA to apply ESP w/o authentication to
original packet
 Use 2nd SA to apply AH
 Outbound Packet Processing...
 Integrity Check Value (ICV) calculation
 ICV includes whole ESP packet minus
authentication data field
 Implicit padding of ‘0’s between next header and
authentication data is used to satisfy block size
requirement for ICV algorithm
Inbound Packet Processing
 Sequence number checking
 Anti-replay is used only if authentication is
selected
 Sequence number should be the first ESP check
on a packet upon looking up an SA
 Duplicates are rejected!

Check bitmap, verify if new

reject verify
Sliding Window
0 size >= 32
Anti-replay Feature
 Optional
 Information to enforce held in SA entry
 Sequence number counter - 32 bit for
outgoing IPSec packets
 Anti-replay window
 32-bit
 Bit-map for detecting replayed packets
Anti-replay Sliding Window
 Window should not be advanced until the
packet has been authenticated
 Without authentication, malicious packets
with large sequence numbers can advance
window unnecessarily
 Valid packets would be dropped!
 ESP Processing - Header
Location...
IPv4
New ESP Orig ESP ESP
TCP Data
IP hdr hdr IP hdr trailer Auth

IPv6
New New ESP Orig Orig ESP ESP
TCP Data
IP hdr ext hdr hdr IP hdr ext hdr trailer Auth

 Tunnel mode IPv4 and IPv6