IPsec is an #Network Layer security framework for secure communications over Internet Protocol (IP)# network. This means it could protect every application or Protocol#, including those that are security-ignorant (doesn’t design around security), running on top of IP (IPv4 or IPv6#, however, both of them are not compatible to each other). It is common having it to have secure access over the Internet, extranet and intranet connectivity with partners or just to enhance the security especially in electronic commerce. It provides Authentication#, Confidentiality#, and key management (secure key exchanges) services.
Note: Since IPsec is transparent to application, there is no need to retrain the user to use IPsec. Thus, it is able to provide security for individual applications and users with little refitting efforts.
Note: IPsec could be used for router advertisement to prevent forged routing update.
The security architecture of IPsec is defined by RFC 4301 which includes the need of tunnel/transport mode and SA with database implementation. Further standardisation are done in RFC 2401, RFC 2402, RFC 2406, and RFC 2408, which makes IPsec mandatory in #IPv6 Address and optional in IPv4 Address (which needs additional application). IPsec’s implementation must support four cases of Security Association (SA)#:
- Case 1 security is provided between end systems.
- Case 2 security is provided between gateways.
- Case 3 security builds on Case 2 by adding end-to-end security.
- Case 4 provides a remote host to securely access an organisation’s firewall over Internet and then gain access to the internal resources behind it.
The data encapsulation is done by two extension headers (append to the IP header): Authentication Header (AH) and Encapsulating Security Payload (ESP), defined by RFC 4303 and RFC 4302 respectively. AH provides Access Control#, Authentication# (including the IP Address#) and Connectionless Data Integrity# services using Message Authentication Code (MAC# /HMAC) where both parties must share secret key. It guards against address spoofing attacks and Replay Attack. ESP provides Confidentiality# services over message contents and traffic flow (but limited) and optionally support Access Control# services like in AH using MAC. It can also guard against Replay Attack#. The users can design which kind of ciphers, modes, and padding to be used in ESP. The IPsec could be set up to have AH only or ESP only or both.
To authenticate key, IPsec uses a protocol called Internet Key Exchange (IKE) which is used to establish a Security Association (SA)# for AH and ESP. If IKE is broken, both AH and ESP provide no protection over the IP packet.
There are two protocol modes available in IPsec: transport mode and tunnel mode. Transport mode provides End-to-end security# which only protects the IP packet payload. Tunnel mode provides gateway-to-gateway (usually Router owned by the same corporation) security which protects the entire IP packet. However, the traffic after the gateway will not be protected under tunnel mode, and it can’t be set up by normal user. The authentication and encryption will be done slightly different in each mode. In transport mode, authentication and encryption will only be done on the payload (could be susceptible to Traffic Analysis#) and sometimes include a portion of IP header (if using AH only) and IPv6 extension headers. In tunnel mode, authentication and encryption must be done on the entire packet (in AH only tunnel mode SA, it will authenticate a portion of IP header and IPv6 extension headers too). Both mode could be stacked to each other in order to satisfy four cases of SA.
IPsec’s implementations and/or applications:
- Virtual Private Network (VPN)# (tunnel mode)
- OpenSwan (outdated)
- strongSwan