Science
CSC Computer 774 -- Network Security
Topic 3: Internet Key Management
Dr. Peng Ning
CSC 774 Network Security
1
Outline
Key Management
Security Principles Center-based Key Management Certificate-based Key Management
Internet Key Management
Manual Exchange SKIP Oakley ISAKMP
Computer Science
Dr. Peng Ning CSC 774 Network Security 2
Key Management
Why do we need Internet key management
AH and ESP require encryption and authentication keys
Process to negotiate and establish IPsec SAs between two entities
Computer Science
Dr. Peng Ning
CSC 774 Network Security
3
Security Principles
Basic security principle for session keys
Compromise of a session key
Doesnt permit reuse of the compromised session key. Doesnt compromise future session keys and long-term keys.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
4
Security Principles (Contd)
Perfect forward secrecy (PFS)
Compromise of current keys (session key or longterm key) doesnt compromise past session keys. Concern for encryption keys but not for authentication keys. Not really perfect in the same sense as perfect secrecy for one-time pad.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
5
Review of IPsec
IPsec module 1 SPD IKE SAD IPsec IKE IPsec SAD IPsec module 2 SPD
SA
SPD: Security Policy Database; IKE: Internet Key Exchange; SA: Security Association; SAD: Security Association Database.
Computer Science
Dr. Peng Ning CSC 774 Network Security 6
Review of IPsec (Contd)
Two Protocols (Mechanisms)
Authentication Header (AH) Encapsulating Security Payload (ESP)
Computer Science
Dr. Peng Ning
CSC 774 Network Security
7
IPsec Architecture (Contd)
Can be implemented in
Host or gateway
Can work in two Modes
Tunnel mode Transport mode
Computer Science
Dr. Peng Ning
CSC 774 Network Security
8
Tunnel Mode
Encrypted Tunnel
Gateway
pted ncry Une
Gateway Encrypted
A
Unen crypt ed
B
New IP Header
AH or ESP Header
Orig IP Header
TCP Data
Computer Science
Dr. Peng Ning
CSC 774 Network Security
9
Transport Mode
A
Encrypted/Authenticated
B
New IP Header
AH or ESP Header
TCP Data
Computer Science
Dr. Peng Ning
CSC 774 Network Security
10
Internet Key Management
Manual key management
Mandatory Useful when IPsec developers are debugging Keys exchanged offline (phone, email, etc.) Set up SPI and negotiate parameters
Computer Science
Dr. Peng Ning
CSC 774 Network Security
11
Internet Key Management (Contd)
Automatic key management
Two major competing proposals Simple Key Management for Internet Protocols (SKIP) ISAKMP/OAKLEY
Photuris Ephemeral D-H + authentication + Cookie The first to use cookie to thwart DOS attacks SKEME (extension to Photuris) Oakley (RFC 2412) ISAKMP (RFC 2408) ISAKMP/OAKLEY IKE (RFC 2409)
Computer Science
Dr. Peng Ning CSC 774 Network Security 12
Automatic Key Management
Key distribution and management combined
SKIP
Key establishment protocol
Oakley
focus on key exchange
Key management
Internet Security Association & Key Management Protocol (ISAKMP)
Focus on SA and key management Clearly separated from key exchange.
Computer Science
Dr. Peng Ning CSC 774 Network Security 13
SKIP
Idea
IP is connectionless in nature Using security association forces a pseudo session layer underneath IP Proposal: use sessionless key establishment and management
Pre-distributed and authenticated D-H public key Packet-specific encryption keys are included in the IP packets
Computer Science
Dr. Peng Ning
CSC 774 Network Security
14
SKIP (Contd)
Two types of keys: 1. KEK 2. Packet key Bobs certificate
Certificate repository
Alices certificate
Alice
Kp encrypted with KEK.
Computer Science
Bob
Payload encrypted with Kp.
Dr. Peng Ning CSC 774 Network Security 15
SKIP (Contd)
KEK should be changed periodically
Minimize the exposure of KEK Prevent the reuse of compromised packet keys
SKIPs approach
KEK = h (KAB, n), where h is a one-way hash function, KAB is the the long term key between A and B, and n is a counter.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
16
SKIP (Contd)
Limitations
No Perfect Forward Secrecy
Can be modified to provide PFS, but it will lose the sessionless property.
No concept of SA; difficult to work with the current IPsec architecture
Not the standard, but remains as an alternative.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
17
Oakley
Oakley is a refinement of the basic DiffieHellman key exchange protocol. Why need refinement?
Resource clogging attack Replay attack Man-in-the-middle attack Choice of D-H groups
Computer Science
Dr. Peng Ning
CSC 774 Network Security
18
Resource Clogging Attack
Busy computing Many bogus requests With false source IPs
Stopping requests is difficult
We need to provide services.
Ignoring requests is dangerous
Denial of service attacks
Computer Science
Dr. Peng Ning CSC 774 Network Security 19
Resource Clogging Attack (Contd)
Counter measure
If we cannot stop bogus requests, at least we should know from where the requests are sent. Cookies are used to thwart resource clogging attack Thwart, not prevent
Computer Science
Dr. Peng Ning
CSC 774 Network Security
20
Resource Clogging Attack (Contd)
Cookie
Each side sends a pseudo-random number, the cookie, in the initial message, which the other side acknowledges. The acknowledgement must be repeated in the following messages. Do not begin D-H calculation until getting acknowledgement for the other side.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
21
Requirements for cookie generation
The cookie must depend on the specific parties.
Prevent an attacker from reusing cookies.
Impossible to forge
Use secret values
Efficient Cookies are also used for key naming
Each key is uniquely identified the by initiators cookie and the responders cookie.
Computer Science
Dr. Peng Ning CSC 774 Network Security 22
Replay Attack
Counter measure
Use nonce
4. Busy computing 1. Cookie exchange 2. Later exchange Observe
y epla 3. R
Computer Science
Dr. Peng Ning
CSC 774 Network Security
23
Man-in-the-middle-attack
Counter measure
Authentication Depend on other mechanisms.
Pre-shared key. Public key certificates.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
24
Oakley Groups
0 1 2 3 4 5 no group (placeholder or non-DH) MODP, 768-bit modulus MODP, 1024-bit modulus MODP, 1536-bit modulus EC2N over GF(2155) EC2N over GF(2185)
Computer Science
Dr. Peng Ning
CSC 774 Network Security
25
Ephemeral Diffie-Hellman
Short-term public key Short-term public key
Session key is computed on the basis of short-term DH public-private keys. Exchange of these short-term public keys requires authentication and integrity.
Digital signatures. Keyed message digests.
The only protocol known to support Perfect Forward Secrecy.
Computer Science
Dr. Peng Ning CSC 774 Network Security 26
Ephemeral Diffie-Hellman
Question: What happens if the long term key is compromised?
Computer Science
Dr. Peng Ning
CSC 774 Network Security
27
ISAKMP
Oakley
Key exchange protocol Developed to use with ISAKMP
ISAKMP
Security association and key management protocol Defines procedures and packet formats to establish, negotiate, modify, and delete security associations. Defines payloads for security association, key exchange, etc.
Computer Science
Dr. Peng Ning CSC 774 Network Security 28
ISAKMP Message
Fixed format header
64 bit initiator and responder cookies Exchange type (8 bits) Next payload type (8 bits) Flags: encryption, commit, authentication, etc. 32 bit message ID
Resolve multiple phase 2 SAs being negotiated simultaneously
Variable number of payloads
Each has a generic header with
Payload boundaries Next payload type (possible none)
Computer Science
Dr. Peng Ning
CSC 774 Network Security
29
ISAKMP Formats
Computer Science
Dr. Peng Ning
CSC 774 Network Security
30
ISAKMP Phases
Phase 1
Establish ISAKMP SA to protect further ISAKMP exchanges Or use pre-established ISAKMP SA ISAKMP SA identified by initiator cookie and responder cookie
Phase 2
Negotiate security services in SA for target security protocol or application.
Computer Science
Dr. Peng Ning CSC 774 Network Security 31
ISAKMP
Disadvantage
Additional overhead due to 2 phases
Advantages
Same ISAKMP SA can be used to negotiate phase 2 for multiple protocols ISAKMP SA can be used to facilitate maintenance of SAs. ISAKMP SA can simplify phase 2.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
32
ISAKMP Domain Of Interpretation (DOI)
DOI defines
Payload format Exchange types Naming conventions for security policies, cryptographic algorithms
DOI for IPsec has been defined.
Computer Science
Dr. Peng Ning
CSC 774 Network Security
33
ISAKMP Exchange Types
0 none 1 base 2 identity protection 3 authentication only 4 aggressive 5 informational 6-31 reserved 32-239 DOI specific use 240-255 private use
Computer Science
Dr. Peng Ning CSC 774 Network Security 34
ISAKMP Exchange Types
Base exchange
reveals identities
Identity protection exchange
Protects identities at cost of extra messages.
Authentication only exchange
No key exchange
Aggressive exchange
Reduce number of message, but reveals identity
Informational ex...