1. Karlstad University IP security Ge Zhang ge.zhang@kau.se

2. Karlstad University Packet-switched network is not Secure! The protocols were designed in the late 70s to early 80s –Very small network (closed environment) All hosts are assumed to be trusted So are the users Therefore, security was not an issue

3. Karlstad University Message transfer over the Internet

4. Karlstad University OSI security architecture Security attacks: any action that compromises the security of information. Security mechanism: A method that is designed to detect, prevent or recover from a security attack Security service: A service that enhances the security of a system

5. Karlstad University Scenario

6. Karlstad University Passive attacks

7. Karlstad University Active attacks

8. Karlstad University Security services Data origin authentication Data confidentiality Anonymity Data integrity Non-repudiation

9. Karlstad University Security mechanism Encipher Digital signature Trusted functionality Detection and prevention …

10. Karlstad University Layered TCP/IP model IPSec is working in IP layer Protect IP packets

11. Karlstad University Goals of IPSec to verify sources of IP packets – Data source authentication to prevent replaying of old packets to protect integrity and/or confidentiality of packets – Data Integrity/Data Encryption

12. Karlstad University IPSec subprotocols ESPAH IKE IPSec Security Policy Encapsulating Security Payload Authentication Header The Internet Key Exchange

13. Karlstad University IPSec—IP Security Provide encryption and integrity protection to IP packets (and authentication of two peers). –AH (Authentication Header) An additional header, provides integrity protection –ESP (Encapsulating Security Payload) Also an addition header, provides encryption and integrity protection –IKE (Internet Key Exchange) Establishing session keys (used for AH & ESP) as well as authentication.

14. Karlstad University IPSec related RFCs A collection of protocols (RFC 2401) –Authentication Header (AH) RFC 2402 –Encapsulating Security Payload (ESP) RFC 2406 –Internet Key Exchange (IKE) RFC 2409 –IP Payload Compression (IPcomp) RFC 3137

15. Karlstad University Transport mode and tunnel mode A->BPayloadA->BPayloadA->BPayloadR1->R2A->BPayload

16. Karlstad University Authentication Header (AH) Provides source authentication –Protects against source spoofing Provides data integrity Protects against replay attacks –Use monotonically increasing sequence numbers NO support for confidentiality!

17. Karlstad University AH Details Use 32-bit increasing sequence number to avoid replay attacks Use cryptographically strong hash algorithms to protect data integrity (96-bit) –Use symmetric key cryptography –HMAC-SHA-96, HMAC-MD5-96

18. Karlstad University AH Protocol (transport & tunnel mode in IPv4) IP headerdata (e.g., TCP, UDP segment) AH header IP header New IP header data (e.g., TCP, UDP segment) AH header Authenticated except for mutable fields

19. Karlstad University IPSec Authentication Header

20. Karlstad University Encapsulating Security Payload (ESP) Provides most that AH offers, and in addition provides data confidentiality –Uses symmetric key encryption

21. Karlstad University ESP Details Same as AH: –Use 32-bit sequence number to counter replaying attacks –Use integrity check algorithms ( protect on different fields) Only in ESP: –Data confidentiality: Uses symmetric key encryption algorithms to encrypt packets

22. Karlstad University ESP Protocol (transport & tunnel mode in IPv4) IP header TCP, UDP segment ESP header ESP trailer ESP authent. encrypted authenticated IP header TCP, UDP segment ESP header ESP trailer ESP authent. encrypted authenticated New IP header ESP in fact puts information both before and after the protected data. For encryption, DATA, padding, padding length and next header are encrypted. For authentication, all fields are included.

23. Karlstad University IPSec ESP Format

24. Karlstad University Anti-replay service Sequence number (from 0 to 2 32 -1) The sender increments the sequence number for each generated packet. How to detect replayed packet? –The receiver maintains an array with 2 32 units to mark which packets have been received. –The receiver only accepts the packets with larger sequence number than the previous one. Both are not good methods, why?

25. Karlstad University Slide window scheme A windows of size W (default W = 64) N: highest sequence number of successfully received packets Three cases –Packets in the window –Packets to the right of the window –Packets to the left of the window 605958575655666564636261 √√√√√ 5453 √√ AB5459 √ 64 √

26. Karlstad University Security Associations (SA) A SA is a one-way relationship between a sender and a receiver that affords security services to the traffic carried on it. –Two ends (from one end  the other end) –A SA is identified by: Security Parameters Index (SPI): a local identifier points to a SA IP destination address Security protocol identifier: AH? Or ESP? –SA parameters: Sequence number counter Anti-replay window AH information (key, algorithms) ESP information (key, algorithms) IPSec protocol mode (Tunnel, transport) …

27. Karlstad University Internet Key Exchange Protocol SA could be created manually, but… Internet Key Exchange Protocol (IKE) –Exchange and negotiate security policies –Establish security sessions Identified as Security Associations (SA) –Key exchange –Key management –Can be used outside IPSec as well

28. Karlstad University Virtual Private Networks (VPNs) Virtual –It is not a physically distinct network Private –Tunnels are encrypted to provide confidentiality Using VPN while traveling

29. Karlstad University Discussion IPSec is not the only solution! –Security features can be added on top of IP! e.g. Kerberos, SSL Confused? –IP, IPSec protocols are very complex! Two modes, three sub protocols –Complexity is the biggest enemy of security

30. Karlstad University Discussion Has it been used? –Yes—primarily used by some VPN vendors But not all routers support it –No—it is not really an end-to-end solution Authentication is too coarse (host based) Default encryption algorithm too weak (DES) Too complex for applications to use

31. Karlstad University Key points Security attack, mechanism and service Classical attacks in the internet IPSec encompasses : authentication, confidentiality and key management AH and ESP Transport mode and tunnel mode Slide window to defend against replay attack VPN