Demystifying the IPSec Puzzle

Contents  vii......Page 8
Preface  xvii......Page 18
1  Introduction  1......Page 20
1.1  The TCP/IP Protocol Stack  5......Page 24
1.2  Introducing IPsec  12......Page 31
1.3  Summary  13......Page 32
References  14......Page 33
2.1  Protections Provided by AH  15......Page 34
2.2  Security Associations and the Security Parameters Index  16......Page 35
2.3  AH Format  19......Page 38
2.4  AH Location  20......Page 39
2.5  AH Modes  21......Page 40
2.6  Nested Headers  22......Page 41
2.7  Implementing IPsec Header Processing  23......Page 42
2.8  AH Processing for Outbound Messages  25......Page 44
2.9  AH Processing for Inbound Messages  30......Page 49
2.10  Complications  32......Page 51
2.11  Auditing  35......Page 54
2.13  Summary  37......Page 56
References  38......Page 57
3.1  Protections Provided by ESP  41......Page 60
3.2  Security Associations and the Security Parameters Index  42......Page 61
3.3  ESP Header Format  43......Page 62
3.4  ESP Header Location and Modes  45......Page 64
3.5  Nested and Adjacent Headers  46......Page 65
3.6  ESP Header Processing for Outbound Messages  48......Page 67
3.7  ESP Header Processing for Inbound Messages  49......Page 68
3.9  Criticisms and Counterclaims  52......Page 71
3.10  Threat Mitigation  54......Page 73
3.11  Why Two Security Headers?  55......Page 74
3.13  Further Reading  56......Page 75
References  57......Page 76
4  The Third Puzzle Piece: The Cryptographic Algorithms  59......Page 78
4.1  Underlying Principles  60......Page 79
4.2  Authentication Algorithms  62......Page 81
4.3  The ESP Header Encryption Algorithms  68......Page 87
4.4  Complications  78......Page 97
4.5  Public Key Cryptography  79......Page 98
4.7  Further Reading  82......Page 101
References  83......Page 102
5.1  The IKE Two-Step Dance  87......Page 106
5.3  Authentication Methods  88......Page 107
5.4  Proposals and Counterproposals  90......Page 109
5.5  Cookies  94......Page 113
5.7  The Proposal Payload  95......Page 114
5.9  Nonces  96......Page 115
5.10  Identities and Identity Protection  97......Page 116
5.11  Certificates and Certificate Requests  98......Page 117
5.12  Keys and Diffie-Hellman Exchanges  99......Page 118
5.13  Notifications  100......Page 119
5.16  The Phase 1 Negotiation  101......Page 120
5.17  The Phase 2 Negotiation  112......Page 131
5.18  New Group Mode  117......Page 136
5.19  Informational Exchanges  118......Page 137
5.20  The ISAKMP Header  119......Page 138
5.21  The Generic Payload Header  120......Page 139
5.22  The IKE State Machine  121......Page 140
5.24  An Example  122......Page 141
5.25  Criticisms and Counterclaims  123......Page 142
5.27  Summary  125......Page 144
5.28  Further Reading  126......Page 145
References  127......Page 146
6  The Fifth Puzzle Piece: IKE and the Road Warrior  129......Page 148
6.1  Legacy Authentication Methods  132......Page 151
6.2  ISAKMP Configuration Method  134......Page 153
6.3  Extended Authentication  139......Page 158
6.4  Hybrid Authentication  140......Page 159
6.5  Challenge-Response for Authenticated Cryptographic Keys  142......Page 161
6.7  Credential-Based Approaches  145......Page 164
6.8  Complications  150......Page 169
6.11  Further Reading  151......Page 170
References  152......Page 171
7  The Sixth Puzzle Piece: IKE Frills and Add-Ons  153......Page 172
7.1  Renegotiation  154......Page 173
7.2  Heartbeats  157......Page 176
7.3  Initial Contact  162......Page 181
7.4  Dangling SAs  163......Page 182
References  164......Page 183
8  The Glue: PF_KEY  165......Page 184
8.1  The PF_KEY Messages  166......Page 185
8.2  A Sample PF_KEY Exchange  171......Page 190
8.3  Composition of PF_KEY Messages  173......Page 192
Reference  177......Page 196
9  The Missing Puzzle Piece: Policy Setting and Enforcement  179......Page 198
9.1  The Security Policy Database  180......Page 199
9.2  The Policy Problem  187......Page 206
9.3  Revisiting the Road Warrior  193......Page 212
9.4  IPsec Policy Solutions  194......Page 213
References  204......Page 223
10  The Framework: Public Key  207......Page 226
10.1  PKI Functional Components  208......Page 227
10.2  The PKI World View  210......Page 229
10.3  The Life Cycle of a Certificate  211......Page 230
10.4  PKI Protocol-Related Components  212......Page 231
10.5  Certificates and CRLs  215......Page 234
10.6  Certificate Formats  216......Page 235
10.7  Certificate Contents  218......Page 237
10.8  IKE and IPsec Considerations  222......Page 241
10.10  Further Reading  225......Page 244
References  226......Page 245
11  The Unsolved Puzzle: Secure IP Multicast  229......Page 248
11.1  Some Examples  230......Page 249
11.2  Multicast Logistics  231......Page 250
11.3  Functional Requirements  232......Page 251
11.4  Security Requirements  233......Page 252
11.5  Whither IP Multicast Security?  239......Page 258
11.7  Further Reading  240......Page 259
References  241......Page 260
12  The Whole Puzzle: Is IPsec the Correct Solution?  243......Page 262
12.1  Advantages of IPsec  244......Page 263
12.3  Alternatives to IPsec  245......Page 264
12.5  The Future of IPsec  247......Page 266
References  249......Page 268
List of Acronyms and Abbreviations  251......Page 270
About the Author  261......Page 280
Index  263......Page 282