IPsec
Encyclopedia
Internet Protocol Security (IPsec) is a protocol suite for securing Internet Protocol
(IP) communications by authenticating
and encrypting
each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication
between agents at the beginning of the session and negotiation of cryptographic key
s to be used during the session.
IPsec is an end-to-end security scheme operating in the Internet Layer
of the Internet Protocol Suite
. It can be used in protecting data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host).
Some other Internet security systems in widespread use, such as Secure Sockets Layer (SSL), Transport Layer Security
(TLS) and Secure Shell
(SSH), operate in the upper layers
of the TCP/IP model. Hence, IPsec protects any application traffic across an IP network. Applications do not need to be specifically designed to use IPsec. The use of TLS/SSL, on the other hand, must be designed into an application to protect the application protocols.
IPsec is a successor of the ISO standard Network Layer Security Protocol (NLSP). NLSP was based on the SP3 protocol that was published by NIST, but designed by the Secure Data Network System project of the National Security Agency
(NSA).
IPsec is officially specified by the Internet Engineering Task Force
(IETF) in a series of Request for Comment documents addressing various components and extensions. It specifies the spelling of the protocol name to be IPsec.
. IPsec uses the following protocols to perform various functions:
and data origin authentication
of IP packets. Further, it can optionally protect against replay attack
s by using the sliding window technique and discarding old packets (see below).
AH operates directly on top of IP, using IP protocol number 51.
The following AH packet diagram shows how an AH packet is constructed and interpreted:
Next Header (8 bits) : Type of the next header, indicating what upper-layer protocol was protected. The value is taken from the list of IP protocol numbers.
Payload Len (8 bits) : The length of this Authentication Header in 4-octet units, minus 2 (a value of 0 means 8 octets, 1 means 12 octets, etcetera). Although the size is measured in 4-octet units, the length of this header needs to be a multiple of 8 octets if carried in an IPv6 packet. This restriction does not apply to an Authentication Header carried in an IPv4 packet.
Reserved (16 bits) : Reserved for future use (all zeroes until then).
Security Parameters Index (32 bits) : Arbitrary value which is used (together with the source IP address) to identify the security association
of the receiving party.
Sequence Number (32 bits) : A monotonic strictly increasing sequence number (incremented by 1 for every packet sent) to prevent replay attack
s. When replay detection is enabled, sequence numbers are never reused because a new security association must be renegotiated before an attempt to increment the sequence number beyond its maximum value.
Integrity Check Value (multiple of 32 bits) : Variable length check value. It may contain padding to align the field to an 8-octet boundary for IPv6
, or a 4-octet boundary for IPv4
.
, and confidentiality
protection of packets. ESP also supports encryption
-only and authentication
-only configurations, but using encryption without authentication is strongly discouraged because it is insecure. Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. However, in Tunnel Mode
, where the entire original IP packet is encapsulated
with a new packet header added, ESP protection is afforded to the whole inner IP packet (including the inner header) while the outer header remains unprotected. ESP operates directly on top of IP, using IP protocol number 50.
The following ESP packet diagram shows how an ESP packet is constructed and interpreted:
Security Parameters Index (32 bits) : Arbitrary value which is used (together with the source IP address) to identify the security association
of the receiving party.
Sequence Number (32 bits) : A monotonically increasing sequence number (incremented by 1 for every packet sent) to protect against replay attack
s. There is a separate counter kept for every security association.
Payload data (variable) : The protected contents of the original IP packet, including any data used to protect the contents (e.g. an Initialisation Vector for the cryptographic algorithm). The type of content that was protected is indicated by the Next Header field.
Padding (0-255 octets) : Padding for encryption, to extend the payload data to a size that fits the encryption's cypher block size, and to align the next field.
Pad Length (8 bits) : Size of the padding in octets.
Next Header (8 bits) : Type of the next header. The value is taken from the list of IP protocol numbers.
Integrity Check Value (multiple of 32 bits) : Variable length check value. It may contain padding to align the field to an 8-octet boundary for IPv6
, or a 4-octet boundary for IPv4
.
as the basis for building security functions into IP. A security association is simply the bundle of algorithms and parameters (such as keys) that is being used to encrypt and authenticate a particular flow in one direction. Therefore, in normal bi-directional traffic, the flows are secured by a pair of security associations.
Security associations are established using the Internet Security Association and Key Management Protocol
(ISAKMP). ISAKMP is implemented by manual configuration with pre-shared secrets, Internet Key Exchange
(IKE and IKEv2), Kerberized Internet Negotiation of Keys
(KINK), and the use of IPSECKEY DNS records.
In order to decide what protection is to be provided for an outgoing packet, IPsec uses the Security Parameter Index
(SPI), an index to the security association database (SADB), along with the destination address in a packet header, which together uniquely identify a security association for that packet. A similar procedure is performed for an incoming packet, where IPsec gathers decryption and verification keys from the security association database.
For multicast, a security association is provided for the group, and is duplicated across all authorized receivers of the group. There may be more than one security association for a group, using different SPIs, thereby allowing multiple levels and sets of security within a group. Indeed, each sender can have multiple security associations, allowing authentication, since a receiver can only know that someone knowing the keys sent the data. Note that the relevant standard does not describe how the association is chosen and duplicated across the group; it is assumed that a responsible party will have made the choice.
, as this will invalidate the hash value. The transport
and application
layers are always secured by hash, so they cannot be modified in any way (for example by translating the port
numbers). Transport mode is used for host-to-host communications.
A means to encapsulate IPsec messages for NAT traversal
has been defined by RFC
documents describing the NAT-T
mechanism.
s for network-to-network communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access), and host-to-host communications (e.g. private chat).
Tunnel mode supports NAT traversal.
Refer to RFC 4835 for details.
negotiation carried out from user-space. Existing IPsec implementations often include both.
There exist a number of implementations of IPsec and ISAKMP/IKE protocols. These include:
and must be available in all standards-compliant implementations of IPv6
; it is optional for IPv4
implementations. However, because of the slow deployment of IPv6, IPsec is most commonly used to secure IPv4 traffic. IPsec protocols were originally defined in RFC 1825 and RFC 1829, published in 1995. In 1998, these documents were superseded by RFC 2401 and RFC 2412 with incompatible aspects, although they were conceptually identical. In addition, a mutual authentication and key exchange protocol Internet Key Exchange
(IKE) was defined to create and manage security associations. In December 2005, new standards were defined in RFC 4301 and RFC 4309 which are largely a superset of the previous editions with a second version of the Internet Key Exchange standard IKEv2. These third-generation documents standardized the abbreviation of IPsec to uppercase “IP” and lowercase “sec”. It is unusual to see any product that offers support for RFCs 1825 and 1829. “ESP” generally refers to RFC 2406, while ESPbis refers to RFC 4303.
Since mid-2008, an IPsec Maintenance and Extensions working group is active at the IETF.
Internet Protocol
The Internet Protocol is the principal communications protocol used for relaying datagrams across an internetwork using the Internet Protocol Suite...
(IP) communications by authenticating
Authentication
Authentication is the act of confirming the truth of an attribute of a datum or entity...
and encrypting
Encryption
In cryptography, encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information...
each IP packet of a communication session. IPsec also includes protocols for establishing mutual authentication
Mutual authentication
Mutual authentication or two-way authentication refers to two parties authenticating each other suitably. In technology terms, it refers to a client or user authenticating themselves to a server and that server authenticating itself to the user in such a way that both parties are assured of the...
between agents at the beginning of the session and negotiation of cryptographic key
Key (cryptography)
In cryptography, a key is a piece of information that determines the functional output of a cryptographic algorithm or cipher. Without a key, the algorithm would produce no useful result. In encryption, a key specifies the particular transformation of plaintext into ciphertext, or vice versa...
s to be used during the session.
IPsec is an end-to-end security scheme operating in the Internet Layer
Internet layer
The internet layer or IP layer is a group of internetworking methods in the Internet protocol suite, commonly also called TCP/IP, which is the foundation of the Internet...
of the Internet Protocol Suite
Internet protocol suite
The Internet protocol suite is the set of communications protocols used for the Internet and other similar networks. It is commonly known as TCP/IP from its most important protocols: Transmission Control Protocol and Internet Protocol , which were the first networking protocols defined in this...
. It can be used in protecting data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host).
Some other Internet security systems in widespread use, such as Secure Sockets Layer (SSL), Transport Layer Security
Transport Layer Security
Transport Layer Security and its predecessor, Secure Sockets Layer , are cryptographic protocols that provide communication security over the Internet...
(TLS) and Secure Shell
Secure Shell
Secure Shell is a network protocol for secure data communication, remote shell services or command execution and other secure network services between two networked computers that it connects via a secure channel over an insecure network: a server and a client...
(SSH), operate in the upper layers
Upper layer protocol
In computer networking, the term upper layer protocol refers to a more abstract protocol when performing encapsulation, in particular it is often used to describe the protocols above the network layer....
of the TCP/IP model. Hence, IPsec protects any application traffic across an IP network. Applications do not need to be specifically designed to use IPsec. The use of TLS/SSL, on the other hand, must be designed into an application to protect the application protocols.
IPsec is a successor of the ISO standard Network Layer Security Protocol (NLSP). NLSP was based on the SP3 protocol that was published by NIST, but designed by the Secure Data Network System project of the National Security Agency
National Security Agency
The National Security Agency/Central Security Service is a cryptologic intelligence agency of the United States Department of Defense responsible for the collection and analysis of foreign communications and foreign signals intelligence, as well as protecting U.S...
(NSA).
IPsec is officially specified by the Internet Engineering Task Force
Internet Engineering Task Force
The Internet Engineering Task Force develops and promotes Internet standards, cooperating closely with the W3C and ISO/IEC standards bodies and dealing in particular with standards of the TCP/IP and Internet protocol suite...
(IETF) in a series of Request for Comment documents addressing various components and extensions. It specifies the spelling of the protocol name to be IPsec.
Security architecture
The IPsec suite is an open standardOpen standard
An open standard is a standard that is publicly available and has various rights to use associated with it, and may also have various properties of how it was designed . There is no single definition and interpretations vary with usage....
. IPsec uses the following protocols to perform various functions:
- Authentication Headers (AH) provide connectionless integrityIntegrityIntegrity is a concept of consistency of actions, values, methods, measures, principles, expectations, and outcomes. In ethics, integrity is regarded as the honesty and truthfulness or accuracy of one's actions...
and data origin authenticationAuthenticationAuthentication is the act of confirming the truth of an attribute of a datum or entity...
for IP datagrams and provides protection against replay attackReplay attackA replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet...
s.
- Encapsulating Security Payloads (ESP) provide confidentialityConfidentialityConfidentiality is an ethical principle associated with several professions . In ethics, and in law and alternative forms of legal resolution such as mediation, some types of communication between a person and one of these professionals are "privileged" and may not be discussed or divulged to...
, data origin authenticationAuthenticationAuthentication is the act of confirming the truth of an attribute of a datum or entity...
, connectionless integrityIntegrityIntegrity is a concept of consistency of actions, values, methods, measures, principles, expectations, and outcomes. In ethics, integrity is regarded as the honesty and truthfulness or accuracy of one's actions...
, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality.
- Security Associations (SA)Security associationA Security Association is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and parameters for the network data to be passed over the...
provide the bundle of algorithms and data that provide the parameters necessary to operate the AH and/or ESP operations. The Internet Security Association and Key Management ProtocolInternet Security Association and Key Management ProtocolISAKMP is a protocol defined by RFC 2408 for establishing Security Associations and cryptographic keys in an Internet environment...
(ISAKMP) provides a framework for authentication and key exchange, with actual authenticated keying material provided either by manual configuration with pre-shared keys, Internet Key ExchangeInternet key exchangeInternet Key Exchange is the protocol used to set up a security association in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP...
(IKE and IKEv2), Kerberized Internet Negotiation of KeysKerberized Internet Negotiation of KeysKerberized Internet Negotiation of Keys is a protocol defined in RFC 4430 used to set up an IPsec security association , similar to Internet Key Exchange , utilizing the Kerberos protocol to allow trusted third parties to handle authentication of peers and management of security policies in a...
(KINK), or IPSECKEY DNS records.
Authentication Header
Authentication Header (AH) is a member of the IPsec protocol suite. AH guarantees connectionless integrityData integrity
Data Integrity in its broadest meaning refers to the trustworthiness of system resources over their entire life cycle. In more analytic terms, it is "the representational faithfulness of information to the true state of the object that the information represents, where representational faithfulness...
and data origin authentication
Authentication
Authentication is the act of confirming the truth of an attribute of a datum or entity...
of IP packets. Further, it can optionally protect against replay attack
Replay attack
A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet...
s by using the sliding window technique and discarding old packets (see below).
- In IPv4IPv4Internet Protocol version 4 is the fourth revision in the development of the Internet Protocol and the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet...
, the AH protects the IP payload and all header fields of an IP datagram except for mutable fields (i.e. those that might be altered in transit). Mutable (and therefore unauthenticated) IP header fields are DSCP/TOSType of ServiceThe type of service field in the IPv4 header has had various purposes over the years, and has been defined in different ways by five RFCs...
, ECNExplicit Congestion NotificationExplicit Congestion Notification is an extension to the Internet Protocol and to the Transmission Control Protocol and is defined in RFC 3168 . ECN allows end-to-end notification of network congestion without dropping packets. ECN is an optional feature that is only used when both endpoints...
, Flags, FragmentIP fragmentationThe Internet Protocol implements datagram fragmentation, so that packets may be formed that can pass through a link with a smaller maximum transmission unit than the original datagram size....
Offset, TTLTime to liveTime to live is a mechanism that limits the lifespan of data in a computer or network. TTL may be implemented as a counter or timestamp attached to or embedded in the data. Once the prescribed event count or timespan has elapsed, data is discarded. In computer networking, TTL prevents a data...
and Header ChecksumChecksumA checksum or hash sum is a fixed-size datum computed from an arbitrary block of digital data for the purpose of detecting accidental errors that may have been introduced during its transmission or storage. The integrity of the data can be checked at any later time by recomputing the checksum and...
. - In IPv6IPv6Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...
, the AH protects the AH itself, the Destination Options extension header after the AH, and the IP payload. It also protects the fixed IPv6 header and all extension headers before the AH, except for the mutable fields: DSCP, ECNExplicit Congestion NotificationExplicit Congestion Notification is an extension to the Internet Protocol and to the Transmission Control Protocol and is defined in RFC 3168 . ECN allows end-to-end notification of network congestion without dropping packets. ECN is an optional feature that is only used when both endpoints...
, Flow Label, and Hop Limit.
AH operates directly on top of IP, using IP protocol number 51.
The following AH packet diagram shows how an AH packet is constructed and interpreted:
| Offsets | Octet16 | 0 | 1 | 2 | 3 | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Octet16 | Bit10 | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 |
| 0 | 0 | Next Header | Payload Len | Reserved | |||||||||||||||||||||||||||||
| 4 | 32 | Security Parameters Index (SPI) | |||||||||||||||||||||||||||||||
| 8 | 64 | Sequence Number | |||||||||||||||||||||||||||||||
| C | 96 | Integrity Check Value (ICV) … |
|||||||||||||||||||||||||||||||
| … | … | ||||||||||||||||||||||||||||||||
Next Header (8 bits) : Type of the next header, indicating what upper-layer protocol was protected. The value is taken from the list of IP protocol numbers.
Payload Len (8 bits) : The length of this Authentication Header in 4-octet units, minus 2 (a value of 0 means 8 octets, 1 means 12 octets, etcetera). Although the size is measured in 4-octet units, the length of this header needs to be a multiple of 8 octets if carried in an IPv6 packet. This restriction does not apply to an Authentication Header carried in an IPv4 packet.
Reserved (16 bits) : Reserved for future use (all zeroes until then).
Security Parameters Index (32 bits) : Arbitrary value which is used (together with the source IP address) to identify the security association
Security association
A Security Association is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and parameters for the network data to be passed over the...
of the receiving party.
Sequence Number (32 bits) : A monotonic strictly increasing sequence number (incremented by 1 for every packet sent) to prevent replay attack
Replay attack
A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet...
s. When replay detection is enabled, sequence numbers are never reused because a new security association must be renegotiated before an attempt to increment the sequence number beyond its maximum value.
Integrity Check Value (multiple of 32 bits) : Variable length check value. It may contain padding to align the field to an 8-octet boundary for IPv6
IPv6
Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...
, or a 4-octet boundary for IPv4
IPv4
Internet Protocol version 4 is the fourth revision in the development of the Internet Protocol and the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet...
.
Encapsulating Security Payload
Encapsulating Security Payload (ESP) is a member of the IPsec protocol suite. In IPsec it provides origin authenticity, integrityIntegrity
Integrity is a concept of consistency of actions, values, methods, measures, principles, expectations, and outcomes. In ethics, integrity is regarded as the honesty and truthfulness or accuracy of one's actions...
, and confidentiality
Confidentiality
Confidentiality is an ethical principle associated with several professions . In ethics, and in law and alternative forms of legal resolution such as mediation, some types of communication between a person and one of these professionals are "privileged" and may not be discussed or divulged to...
protection of packets. ESP also supports encryption
Encryption
In cryptography, encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information...
-only and authentication
Authentication
Authentication is the act of confirming the truth of an attribute of a datum or entity...
-only configurations, but using encryption without authentication is strongly discouraged because it is insecure. Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet. However, in Tunnel Mode
Tunneling protocol
Computer networks use a tunneling protocol when one network protocol encapsulates a different payload protocol...
, where the entire original IP packet is encapsulated
Information hiding
In computer science, information hiding is the principle of segregation of the design decisions in a computer program that are most likely to change, thus protecting other parts of the program from extensive modification if the design decision is changed...
with a new packet header added, ESP protection is afforded to the whole inner IP packet (including the inner header) while the outer header remains unprotected. ESP operates directly on top of IP, using IP protocol number 50.
The following ESP packet diagram shows how an ESP packet is constructed and interpreted:
| Offsets | Octet16 | 0 | 1 | 2 | 3 | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Octet16 | Bit10 | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 |
| 0 | 0 | Security Parameters Index (SPI) | |||||||||||||||||||||||||||||||
| 4 | 32 | Sequence Number | |||||||||||||||||||||||||||||||
| 8 | 64 | Payload data | |||||||||||||||||||||||||||||||
| … | … | ||||||||||||||||||||||||||||||||
| … | … | ||||||||||||||||||||||||||||||||
| … | … | Padding (0-255 octets) | |||||||||||||||||||||||||||||||
| … | … | Pad Length | Next Header | ||||||||||||||||||||||||||||||
| … | … | Integrity Check Value (ICV) … |
|||||||||||||||||||||||||||||||
| … | … | ||||||||||||||||||||||||||||||||
Security Parameters Index (32 bits) : Arbitrary value which is used (together with the source IP address) to identify the security association
Security association
A Security Association is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and parameters for the network data to be passed over the...
of the receiving party.
Sequence Number (32 bits) : A monotonically increasing sequence number (incremented by 1 for every packet sent) to protect against replay attack
Replay attack
A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet...
s. There is a separate counter kept for every security association.
Payload data (variable) : The protected contents of the original IP packet, including any data used to protect the contents (e.g. an Initialisation Vector for the cryptographic algorithm). The type of content that was protected is indicated by the Next Header field.
Padding (0-255 octets) : Padding for encryption, to extend the payload data to a size that fits the encryption's cypher block size, and to align the next field.
Pad Length (8 bits) : Size of the padding in octets.
Next Header (8 bits) : Type of the next header. The value is taken from the list of IP protocol numbers.
Integrity Check Value (multiple of 32 bits) : Variable length check value. It may contain padding to align the field to an 8-octet boundary for IPv6
IPv6
Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...
, or a 4-octet boundary for IPv4
IPv4
Internet Protocol version 4 is the fourth revision in the development of the Internet Protocol and the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet...
.
Security association
The IP security architecture uses the concept of a security associationSecurity association
A Security Association is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and parameters for the network data to be passed over the...
as the basis for building security functions into IP. A security association is simply the bundle of algorithms and parameters (such as keys) that is being used to encrypt and authenticate a particular flow in one direction. Therefore, in normal bi-directional traffic, the flows are secured by a pair of security associations.
Security associations are established using the Internet Security Association and Key Management Protocol
Internet Security Association and Key Management Protocol
ISAKMP is a protocol defined by RFC 2408 for establishing Security Associations and cryptographic keys in an Internet environment...
(ISAKMP). ISAKMP is implemented by manual configuration with pre-shared secrets, Internet Key Exchange
Internet key exchange
Internet Key Exchange is the protocol used to set up a security association in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP...
(IKE and IKEv2), Kerberized Internet Negotiation of Keys
Kerberized Internet Negotiation of Keys
Kerberized Internet Negotiation of Keys is a protocol defined in RFC 4430 used to set up an IPsec security association , similar to Internet Key Exchange , utilizing the Kerberos protocol to allow trusted third parties to handle authentication of peers and management of security policies in a...
(KINK), and the use of IPSECKEY DNS records.
In order to decide what protection is to be provided for an outgoing packet, IPsec uses the Security Parameter Index
Security Parameter Index
The Security Parameter Index is an identification tag added to the header while using IPsec for tunneling the IP traffic. This tag helps the kernel discern between two traffic streams where different encryption rules and algorithms may be in use....
(SPI), an index to the security association database (SADB), along with the destination address in a packet header, which together uniquely identify a security association for that packet. A similar procedure is performed for an incoming packet, where IPsec gathers decryption and verification keys from the security association database.
For multicast, a security association is provided for the group, and is duplicated across all authorized receivers of the group. There may be more than one security association for a group, using different SPIs, thereby allowing multiple levels and sets of security within a group. Indeed, each sender can have multiple security associations, allowing authentication, since a receiver can only know that someone knowing the keys sent the data. Note that the relevant standard does not describe how the association is chosen and duplicated across the group; it is assumed that a responsible party will have made the choice.
Modes of operation
IPsec can be implemented in a host-to-host transport mode, as well as in a network tunnel mode.Transport mode
In transport mode, only the payload (the data you transfer) of the IP packet is usually encrypted and/or authenticated. The routing is intact, since the IP header is neither modified nor encrypted; however, when the authentication header is used, the IP addresses cannot be translatedNetwork address translation
In computer networking, network address translation is the process of modifying IP address information in IP packet headers while in transit across a traffic routing device....
, as this will invalidate the hash value. The transport
Transport layer
In computer networking, the transport layer or layer 4 provides end-to-end communication services for applications within a layered architecture of network components and protocols...
and application
Application layer
The Internet protocol suite and the Open Systems Interconnection model of computer networking each specify a group of protocols and methods identified by the name application layer....
layers are always secured by hash, so they cannot be modified in any way (for example by translating the port
TCP and UDP port
In computer networking, a port is an application-specific or process-specific software construct serving as a communications endpoint in a computer's host operating system. A port is associated with an IP address of the host, as well as the type of protocol used for communication...
numbers). Transport mode is used for host-to-host communications.
A means to encapsulate IPsec messages for NAT traversal
NAT traversal
NAT traversal is a general term for techniques that establish and maintain Internet protocol connections traversing network address translation gateways. Network address translation breaks end-to-end connectivity. Intercepting and modifying traffic can only be performed transparently in the...
has been defined by RFC
Request for Comments
In computer network engineering, a Request for Comments is a memorandum published by the Internet Engineering Task Force describing methods, behaviors, research, or innovations applicable to the working of the Internet and Internet-connected systems.Through the Internet Society, engineers and...
documents describing the NAT-T
NAT-T
NAT-T is a method of enabling IPsec-protected IP datagrams to pass through network address translation . RFC 3947 defines the negotiation during the Internet key exchange phase and RFC 3948 defines the UDP encapsulation.An IP packet is modified while passing through a network address translator...
mechanism.
Tunnel mode
In tunnel mode, the entire IP packet is encrypted and/or authenticated. It is then encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create virtual private networkVirtual private network
A virtual private network is a network that uses primarily public telecommunication infrastructure, such as the Internet, to provide remote offices or traveling users access to a central organizational network....
s for network-to-network communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access), and host-to-host communications (e.g. private chat).
Tunnel mode supports NAT traversal.
Cryptographic algorithms
Cryptographic algorithms defined for use with IPsec include:- HMACHMACIn cryptography, HMAC is a specific construction for calculating a message authentication code involving a cryptographic hash function in combination with a secret key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message...
-SHA1 for integrity protection and authenticity. - TripleDES-CBC for confidentiality
- AESAdvanced Encryption StandardAdvanced Encryption Standard is a specification for the encryption of electronic data. It has been adopted by the U.S. government and is now used worldwide. It supersedes DES...
-CBC for confidentiality.
Refer to RFC 4835 for details.
Software implementations
IPsec support is usually implemented in the kernel with key management and ISAKMP/IKEInternet key exchange
Internet Key Exchange is the protocol used to set up a security association in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP...
negotiation carried out from user-space. Existing IPsec implementations often include both.
There exist a number of implementations of IPsec and ISAKMP/IKE protocols. These include:
- NRLUnited States Naval Research LaboratoryThe United States Naval Research Laboratory is the corporate research laboratory for the United States Navy and the United States Marine Corps and conducts a program of scientific research and development. NRL opened in 1923 at the instigation of Thomas Edison...
IPsec, one of the original sources of IPsec code. - OpenBSDOpenBSDOpenBSD is a Unix-like computer operating system descended from Berkeley Software Distribution , a Unix derivative developed at the University of California, Berkeley. It was forked from NetBSD by project leader Theo de Raadt in late 1995...
, with its own code derived from a BSD/OS implementation written by John Ioannidis and Angelos D. Keromytis in 1996. - The KAMEKAME projectThe KAME project was a joint effort of six organizations in Japan which aimed to provide a free IPv6 and IPsec protocol stack implementation for variants of the BSD Unix computer operating-system...
stack, that is included in Mac OS XMac OS XMac OS X is a series of Unix-based operating systems and graphical user interfaces developed, marketed, and sold by Apple Inc. Since 2002, has been included with all new Macintosh computer systems...
, NetBSDNetBSDNetBSD is a freely available open source version of the Berkeley Software Distribution Unix operating system. It was the second open source BSD descendant to be formally released, after 386BSD, and continues to be actively developed. The NetBSD project is primarily focused on high quality design,...
and FreeBSDFreeBSDFreeBSD is a free Unix-like operating system descended from AT&T UNIX via BSD UNIX. Although for legal reasons FreeBSD cannot be called “UNIX”, as the direct descendant of BSD UNIX , FreeBSD’s internals and system APIs are UNIX-compliant...
. - "IPsec" in Juniper Operating SystemsJUNOSJuniper Junos is the software or the network operating system used in Juniper Networks hardware systems. It is an operating system that is used in Juniper's routing, switching and security devices. Juniper offers a Software Development Kit to partners and customers to allow additional customization...
- "IPsec" in Cisco IOS SoftwareCisco IOSCisco IOS is the software used on the vast majority of Cisco Systems routers and current Cisco network switches...
- "IPsec" in Microsoft WindowsMicrosoft WindowsMicrosoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
, including Windows XPWindows XPWindows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
, Windows 2000Windows 2000Windows 2000 is a line of operating systems produced by Microsoft for use on personal computers, business desktops, laptops, and servers. Windows 2000 was released to manufacturing on 15 December 1999 and launched to retail on 17 February 2000. It is the successor to Windows NT 4.0, and is the...
, Windows 2003, Windows VistaWindows VistaWindows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
, Windows Server 2008, and Windows 7.- IPsec in Windows Vista and later
- Authentec QuickSec toolkits
- IPsec in Solaris
- IBMIBMInternational Business Machines Corporation or IBM is an American multinational technology and consulting corporation headquartered in Armonk, New York, United States. IBM manufactures and sells computer hardware and software, and it offers infrastructure, hosting and consulting services in areas...
AIX operating systemAIX operating systemAIX AIX AIX (Advanced Interactive eXecutive, pronounced "a i ex" is a series of proprietary Unix operating systems developed and sold by IBM for several of its computer platforms... - IBMIBMInternational Business Machines Corporation or IBM is an American multinational technology and consulting corporation headquartered in Armonk, New York, United States. IBM manufactures and sells computer hardware and software, and it offers infrastructure, hosting and consulting services in areas...
z/OSZ/OSz/OS is a 64-bit operating system for mainframe computers, produced by IBM. It derives from and is the successor to OS/390, which in turn followed a string of MVS versions.Starting with earliest:*OS/VS2 Release 2 through Release 3.8... - IPsec and IKE in HP-UXHP-UXHP-UX is Hewlett-Packard's proprietary implementation of the Unix operating system, based on UNIX System V and first released in 1984...
(HP-UX IPsec) - The LinuxLinuxLinux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
IPsec stack written by Alexey Kuznetsov and David S. MillerDavid S. MillerDavid Stephen Miller is an American software developer working on the Linux kernel, where he is the primary maintainer of networking and the SPARC implementation, and is also involved in other development work...
. - OpenswanOpenswanOpenswan is a complete IPsec implementation for Linux 2.0, 2.2, 2.4 and 2.6 kernels.Openswan began as a fork of the now-defunct FreeS/WAN project, and continues to be released freely under the GNU General Public License. Unlike the FreeS/WAN project, it is not developed exclusively for the Linux...
on LinuxLinuxLinux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
, FreeBSDFreeBSDFreeBSD is a free Unix-like operating system descended from AT&T UNIX via BSD UNIX. Although for legal reasons FreeBSD cannot be called “UNIX”, as the direct descendant of BSD UNIX , FreeBSD’s internals and system APIs are UNIX-compliant...
and Mac OS XMac OS XMac OS X is a series of Unix-based operating systems and graphical user interfaces developed, marketed, and sold by Apple Inc. Since 2002, has been included with all new Macintosh computer systems...
using the native Linux IPsec stack, or its own KLIPS stack. KLIPS offers hardware acceleration and SAref tracking. - strongSwanStrongSwanstrongSwan is a complete IPsec implementation for Linux 2.6 and 3.x kernels.As a descendant of the FreeS/WAN project, it continues to be released under the GPL license. The project is actively maintained by Andreas Steffen who is a professor for Security in Communications at the University of...
on LinuxLinuxLinux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
, FreeBSDFreeBSDFreeBSD is a free Unix-like operating system descended from AT&T UNIX via BSD UNIX. Although for legal reasons FreeBSD cannot be called “UNIX”, as the direct descendant of BSD UNIX , FreeBSD’s internals and system APIs are UNIX-compliant...
, Mac OS XMac OS XMac OS X is a series of Unix-based operating systems and graphical user interfaces developed, marketed, and sold by Apple Inc. Since 2002, has been included with all new Macintosh computer systems...
, and Android using the native IPsec stack.
Standards status
IPsec was developed in conjunction with IPv6IPv6
Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...
and must be available in all standards-compliant implementations of IPv6
IPv6
Internet Protocol version 6 is a version of the Internet Protocol . It is designed to succeed the Internet Protocol version 4...
; it is optional for IPv4
IPv4
Internet Protocol version 4 is the fourth revision in the development of the Internet Protocol and the first version of the protocol to be widely deployed. Together with IPv6, it is at the core of standards-based internetworking methods of the Internet...
implementations. However, because of the slow deployment of IPv6, IPsec is most commonly used to secure IPv4 traffic. IPsec protocols were originally defined in RFC 1825 and RFC 1829, published in 1995. In 1998, these documents were superseded by RFC 2401 and RFC 2412 with incompatible aspects, although they were conceptually identical. In addition, a mutual authentication and key exchange protocol Internet Key Exchange
Internet key exchange
Internet Key Exchange is the protocol used to set up a security association in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP...
(IKE) was defined to create and manage security associations. In December 2005, new standards were defined in RFC 4301 and RFC 4309 which are largely a superset of the previous editions with a second version of the Internet Key Exchange standard IKEv2. These third-generation documents standardized the abbreviation of IPsec to uppercase “IP” and lowercase “sec”. It is unusual to see any product that offers support for RFCs 1825 and 1829. “ESP” generally refers to RFC 2406, while ESPbis refers to RFC 4303.
Since mid-2008, an IPsec Maintenance and Extensions working group is active at the IETF.
See also
- IPsec Passthrough
- Information securityInformation securityInformation security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction....
- Secure Sockets Layer Virtual Private Network
- Opportunistic encryptionOpportunistic encryptionOpportunistic Encryption refers to any system that, when connecting to another system, attempts to encrypt the communications channel otherwise falling back to unencrypted communications. This method requires no pre-arrangement between the two systems.Opportunistic encryption can be used to...
- Dynamic Multipoint Virtual Private Network
- tcpcryptTcpcryptIn computer networking, tcpcrypt is a transport layer communication encryption protocol. Unlike prior protocols like TLS , tcpcrypt is implemented as a TCP extension. It was designed by a team of six security and networking experts: Andrea Bittau, Mike Hamburg, Mark Handley, David Mazières, Dan...
External links
- All IETF active security WGs
- IETF ipsecme WG ("IP Security Maintenance and Extensions" Working Group)
- IETF btns WG ("Better-Than-Nothing Security" Working Group) (chartered to work on unauthenticated IPsec, IPsec APIs, connection latching)]
- Securing Data in Transit with IPsec WindowsSecurity.com article by Deb Shinder
- IPsec at the Open Directory ProjectOpen Directory ProjectThe Open Directory Project , also known as Dmoz , is a multilingual open content directory of World Wide Web links. It is owned by Netscape but it is constructed and maintained by a community of volunteer editors.ODP uses a hierarchical ontology scheme for organizing site listings...
- IPsec on Microsoft TechNet
- Microsoft IPsec Diagnostic Tool on Microsoft Download Center
- An Illustrated Guide to IPsec by Steve Friedl
- Security Architecture for IP (IPsec) Data Communication Lectures by Manfred Lindner Part IPsec
- Creating VPNs with IPsec and SSL/TLS Linux Journal article by Rami Rosen
Standards
- RFC 2367: PF_KEY Interface
- RFC 2401: Security Architecture for the Internet Protocol (IPsec overview) Obsolete by RFC 4301
- RFC 2403: The Use of HMAC-MD5-96 within ESP and AH
- RFC 2404: The Use of HMAC-SHA-1-96 within ESP and AH
- RFC 2405: The ESP DES-CBC Cipher Algorithm With Explicit IV
- RFC 2409: The Internet Key Exchange
- RFC 2410: The NULL Encryption Algorithm and Its Use With IPsec
- RFC 2412: The OAKLEY Key Determination Protocol
- RFC 2451: The ESP CBC-Mode Cipher Algorithms
- RFC 2857: The Use of HMAC-RIPEMD-160-96 within ESP and AH
- RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
- RFC 3706: A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
- RFC 3715: IPsec-Network Address Translation (NAT) Compatibility Requirements
- RFC 3947: Negotiation of NAT-Traversal in the IKE
- RFC 3948: UDP Encapsulation of IPsec ESP Packets
- RFC 4106: The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
- RFC 4301: Security Architecture for the Internet Protocol
- RFC 4302: IP Authentication Header
- RFC 4303: IP Encapsulating Security Payload
- RFC 4304: Extended Sequence Number (ESN) Addendum to IPsec Domain of Interpretation (DOI) for Internet Security Association and Key Management Protocol (ISAKMP)
- RFC 4306: Internet Key Exchange (IKEv2) Protocol
- RFC 4307: Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)
- RFC 4308: Cryptographic Suites for IPsec
- RFC 4309: Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)
- RFC 4478: Repeated Authentication in Internet Key Exchange (IKEv2) Protocol
- RFC 4543: The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH
- RFC 4555: IKEv2 Mobility and Multihoming Protocol (MOBIKE)
- RFC 4621: Design of the IKEv2 Mobility and Multihoming (MOBIKE) Protocol
- RFC 4718: IKEv2 Clarifications and Implementation Guidelines
- RFC 4806: Online Certificate Status Protocol (OCSP) Extensions to IKEv2
- RFC 4809: Requirements for an IPsec Certificate Management Profile
- RFC 4835: Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 4945: The Internet IP Security PKI Profile of IKEv1/ISAKMP, IKEv2, and PKIX
- RFC 6071: IPsec and IKE Document Roadmap