De-Mystifying the IPsec Puzzle

Now that the Internet has blossomed into the "Information Superhighway" with its traffic and drivers becoming increasingly diverse, security has emerged as a primary concern. This innovative, new book offers you a global, integrated approach to providing Internet Security at the network layer. You get a detailed presentation of the revolutionary IPsec technology used today to create Virtual Private Networks and, in the near future, to protect the infrastructure of the Internet itself.

Sheila Frankel is a computer scientist at the National Institute of Standards and Technology (NIST)

Preface

xvii

Introduction

1

(14)

The TCP/IP Protocol Stack

5

(7)

IP Packets

7

(3)

IP Packetization and Fragmentation

10

(2)

Introducing IPsec

12

(1)

Summary

13

(1)

Further Reading

14

(1)

References

14

(1)

The First Puzzle Piece: The Authentication Header

15

(26)

Protections Provided by AH

15

(1)

Security Associations and the Security Parameters Index

16

(3)

AH Format

19

(1)

AH Location

20

(1)

AH Modes

21

(1)

Nested Headers

22

(1)

Implementing IPsec Header Processing

23

(2)

AH Processing for Outbound Messages

25

(5)

AH Processing for Inbound Messages

30

(2)

Complications

32

(3)

Auditing

35

(2)

Threat Mitigation

37

(1)

Summary

37

(1)

Further Reading

38

(3)

References

38

(3)

The Second Puzzle Piece: The Encapsulating Security Payload

41

(18)

Protections Provided by ESP

41

(1)

Security Associations and the Security Parameters Index

42

(1)

ESP Header Format

43

(2)

ESP Header Location and Modes

45

(1)

Nested and Adjacent Headers

46

(2)

ESP Header Processing for Outbound Messages

48

(1)

ESP Header Processing for Inbound Messages

49

(3)

Complications

52

(1)

Criticisms and Counterclaims

52

(2)

Threat Mitigation

54

(1)

Why Two Security Headers?

55

(1)

Summary

56

(1)

Further Reading

56

(3)

References

57

(2)

The Third Puzzle Piece: The Cryptographic Algorithms

59

(28)

Underlying Principles

60

(2)

Authentication Algorithms

62

(6)

The MD5 Algorithm

64

(1)

The SHA-1 Algorithm

65

(1)

The HMAC Algorithm

66

(2)

Other Authentication Algorithms

68

(1)

The ESP Header Encryption Algorithms

68

(10)

The DES Algorithm

70

(2)

The Triple DES Algorithm

72

(4)

Other Encryption Algorithms

76

(1)

The AES Algorithm

77

(1)

Complications

78

(1)

Public Key Cryptography

79

(3)

Digital Signatures

80

(1)

Other Public Key Operations

80

(1)

The Diffie-Hellman Exchange

80

(2)

Conclusion

82

(1)

Further Reading

82

(5)

References

83

(4)

The Fourth Puzzle Piece: The Internet Key Exchange (IKE)

87

(42)

The IKE Two-Step Dance

87

(1)

Payloads and Exchanges

88

(1)

Authentication Methods

88

(2)

Proposals and Counterproposals

90

(4)

Cookies

94

(1)

The Security Association Payload

95

(1)

The Proposal Payload

95

(1)

The Message ID

96

(1)

Nonces

96

(1)

Identities and Identity Protection

97

(1)

Certificates and Certificate Requests

98

(1)

Keys and Diffie-Hellman Exchanges

99

(1)

Notifications

100

(1)

Lifetimes

101

(1)

Vendor IDs

101

(1)

The Phase 1 Negotiation

101

(11)

Main Mode

102

(6)

Aggressive Mode

108

(2)

Base Mode

110

(2)

The Phase 2 Negotiation

112

(5)

Quick Mode

113

(3)

The Commit Bit

116

(1)

New Group Mode

117

(1)

Informational Exchanges

118

(1)

The ISAKMP Header

119

(1)

The Generic Payload Header

120

(1)

The IKE State Machine

121

(1)

The Origins of IKE

122

(1)

An Example

122

(1)

Criticisms and Counterclaims

123

(2)

Threat Mitigation

125

(1)

Summary

125

(1)

Further Reading

126

(3)

References

127

(2)

The Fifth Puzzle Piece: IKE and the Road Warrior

129

(24)

Legacy Authentication Methods

132

(2)

ISAKMP Configuration Method

134

(5)

Extended Authentication

139

(1)

Hybrid Authentication

140

(2)

Challenge-Response for Authenticated Cryptographic Keys

142

(3)

User-Level Authentication

145

(1)

Credential-Based Approaches

145

(5)

Complications

150

(1)

Threat Mitigation

151

(1)

Summary

151

(1)

Further Reading

151

(2)

References

152

(1)

The Sixth Puzzle Piece: IKE Frills and Add-Ons

153

(12)

Renegotiation

154

(3)

Heartbeats

157

(5)

Initial Contact

162

(1)

Dangling SAs

163

(1)

Summary

164

(1)

Further Reading

164

(1)

References

164

(1)

The Glue: PF_KEY

165

(14)

The PF_KEY Messages

166

(5)

A Sample PF_KEY Exchange

171

(2)

Composition of PF_KEY Messages

173

(4)

Complications

177

(1)

Summary

177

(1)

Further Reading

177

(2)

Reference

177

(2)

The Missing Puzzle Piece: Policy Setting and Enforcement

179

(28)

The Security Policy Database

180

(7)

The Policy Problem

187

(6)

Policy Configuration

187

(1)

Policy Servers

188

(1)

Gateway Discovery

188

(1)

Policy Discovery

189

(1)

Policy Exchange

190

(1)

Policy Resolution

191

(1)

Policy Decorrelation

191

(2)

Policy Compliance Checking

193

(1)

Revisiting the Road Warrior

193

(1)

IPsec Policy Solutions

194

(10)

The IPsec Configuration Policy Model

195

(1)

The IPsec Policy Information Base

196

(1)

The Security Policy Protocol

196

(4)

The Security Policy Specification Language

200

(1)

The KeyNote Trust Management System

201

(2)

An Overall Plan

203

(1)

Summary

204

(1)

Further Reading

204

(3)

References

204

(3)

The Framework: Public Key Infrastructure (PKI)

207

(22)

PKI Functional Components

208

(2)

The PKI World View

210

(1)

The Life Cycle of a Certificate

211

(1)

PKI Protocol-Related Components

212

(3)

Certificates and CRLs

215

(1)

Certificate Formats

216

(2)

Certificate Contents

218

(4)

IKE and IPsec Considerations

222

(3)

Summary

225

(1)

Further Reading

225

(4)

References

226

(3)

The Unsolved Puzzle: Secure IP Multicast

229

(14)

Some Examples

230

(1)

Multicast Logistics

231

(1)

Functional Requirements

232

(1)

Security Requirements

233

(6)

Key Management

234

(2)

Secrecy

236

(1)

Data Integrity

236

(1)

Source Authentication

236

(1)

Order of Cryptographic Operations

237

(1)

Membership Management

237

(1)

Access-Related Issues

238

(1)

Policy Determination

238

(1)

Anony mity

238

(1)

Nonrepudiation

239

(1)

Service Availability

239

(1)

Firewall Traversal

239

(1)

Piracy

239

(1)

Whither IP Multicast Security?

239

(1)

Summary

240

(1)

Further Reading

240

(3)

References

241

(2)

The Whole Puzzle: Is IPsec the Correct Solution?

243

(8)

Advantages of IPsec

244

(1)

Disadvantages of IPsec

245

(1)

Alternatives to IPsec

245

(2)

Transport Layer Security Protocol

245

(1)

Layer 2 Tunneling Protocol

245

(2)

Point-to-Point Tunneling Protocol

247

(1)

IPsec Today

247

(1)

The Future of IPsec

247

(2)

Summary

249

(1)

Further Reading

249

(2)

References

249

(2)

List of Acronyms and Abbreviations

251

(10)

About the Author

261

(2)

Index

263

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

De-Mystifying the IPsec Puzzle

Summary

Author Biography

Table of Contents

Supplemental Materials