1. IPSec – IP Security Protocol By Archis Raje

2. What is IPSec IP Security – set of extensions developed by IETF to provide privacy and authentication to IP. To protect the contents of an IP datagram, the data is transformed using cryptography.

3. Why do we need IPSec? Because IP is insecure – you can Forge IP address modify packet contents replay old content inspect packet content during transit

4. How does it work? combination of - Cryptographic protocols Security mechanisms

5. What Does IPSec Provide? Access control to network elements. Data origin authentication. Connectionless integrity for protocols such as UDP. Detection and rejection of replayed packets. Use of encryption to provide data confidentiality. Limited traffic flow confidentiality.

6. Since the IPSec services are offered at the network layer of the TCP/IP protocol stack, these services can be used by any of the upper-layer protocols such as TCP, UDP, ICMP and IGMP or any application layer protocol. IPSec provides cryptographic based security for ipv4 and ipv6 datagrams.

7. How? Using two traffic security protocols: Authentication header (AH). Encapsulating security payload (ESP). And through the use of cryptographic-key management procedures and protocols such as - Internet key exchange (IKE) protocol.

8. Together, the security protocols provide - Data confidentiality Limited traffic flow confidentiality Connectionless integrity Data origin authentication Anti-replay service

9. Modes of Operation of AH and ESP Transport mode Tunnel mode

10. Transport Mode Authenticated IP Header AH transformation: IP Header TCP/UDP Header TCP/UDP Header AH Header Upper layer payload Upper layer payload

11. Transport Mode ESP transformation: Encrypted Authenticated IP Header TCP/UDP Header TCP/UDP Header Upper layer payload Upper layer payload ESP Header ESP Trailer ESP auth

12. Tunnel Mode AH transformation: IP Header Upper layer payload Upper layer payload IP Header TCP/UDP Header TCP/UDP Header IP HeaderAH Header Authenticated

13. Tunnel Mode ESP transformation: Encrypted Authenticated IP Header TCP/UDP Header TCP/UDP Header Upper layer payload Upper layer payload ESP Header ESP Trailer ESP auth

14. Communication The IKE protocol is used to negotiate the cryptographic algorithm choices, to be utilized by AH and ESP, and put in place the necessary cryptographic keys that the algorithms require. IPSec can implement different security policy/encryption algorithm for different subnets, nodes, etc. It does this by the use of Security Association (SA).

15. Security Association An agreement between communicating peers on factors such as - IPSec protocol Mode of operation of the protocols (transport mode or tunnel mode) Cryptographic algorithms Cryptographic keys Lifetime of the keys SAs are simplex (unidirectional)

16. SAD – Security Association Database Stores SA parameters communicated by IKE. Contents are –  Sequence number counter.  Sequence counter overflow flag  Anti-replay window  IPSec protocol mode  Path maximum transfer unit (PMTU)  Lifetime of the SA

17. SPD - Security Policy Database Contains policies that are to be applied to the traffic destined to or originated from a given host or network. Contents are –  Destination IP address  Source IP address  Transport layer protocol  System name: FQDN or email id  User ID

18. Drawbacks Complex - has too many options. Prone to Initialization Vector attacks.