Security IP (II)
CS 4803 Fall 03
Agenda
s
Key Management
x Concepts x Manual Exchange x Internet Key Exchange
IPSec Strengths & Weaknesses s Implementation of IPSec
s
Key Management
AH and ESP require encryption and authentication keys s Process to negotiate and establish IPSec SA's between two entities
s
Concepts
s
PFS: Perfect Forward Secrecy
x Obtaining one key does not give access to all
data, only data protected by that one key x Keys not derived from predecessors
s
Nonces: locally generated pseudorandom numbers
Manual Key Management
Mandatory s Useful when IPSec developers are debugging s Keys exchanged offline (phone, email, etc.) s Set up SPI and negotiate parameters
s
Internet Key Exchange - IKE
s s
Used when an outbound packet does not have an SA Tow phases:
x x
Establish an IKE SA Use that SA to negotiate IPSec SAs
s s s
IKE SA used to define encryption & authentication of IKE traffic Multiple IPSec SAs can be established with one IKE SA IKE SA bidirectional
IKE Phase I Create IKE SA
Negotiate protection suite s Use Diffie-Hellman to establish shared secret s Authenticate the shared secret , IKE SA
s
x Preshared keys (secret) x Digital signatures x Public-keys
Mode Exchanges
s
Phase I
x Main Mode flexible, 6 messages
3
Checks cookies before DH work Open to clogging DoS, doesn't check cookie before DH work
x Aggressive mode faster, 3 messages
3
s
Phase II - Quick Mode
Concepts - Cookies
s
Requirements
x Depend on specific parties x Only the issuing entity can generate acceptable
cookies implies issuer using local secret x Cookie generation and verification must be fast
s
Hash over IP Src/Dest; UDP Src/Dest; local secret
Initiator I Crypto Offered, Cookie CI
Negotiate IKE Crypto parameters
Responder R Crypto Chosen, CR
Exchange to items generate secret
Nonce NI, YI NR, YR
I
Generate SKEYID, DH: K
I R R
Send hash digest so peer can authenticate sender ID , Hash
ID , Hash
Example: Main Mode Preshared
Main Mode Preshared
s s
s
PRF, Pseudo-Random Function SKEYID root secret =PRF(preshared-key,NI|NR) SKEYID_d for IPSec SA =PRF(SKEYID,K|C |C |0)
I R
s
K is the secret generated by DH SKEYID_a for IKE message data auth & integrity = PRF(SKEYID,SKEYID_d|K|C |C |1)
I R
s
SKEYID_e use to encrypt IKE messages
Main Mode Preshared: Hashes
s
To authenticate each other, each entity generates a hash digest that only the peer could know
Hash-I=PRF(SKEYID,YI|YR|CI|CR|Crypto Offer|IDI) Hash-R=PRF(SKEYID,YR|YI|CI|CR|Crypto Offer|IDR)
IKE Phase II Keys
s
Default: no PFS
x Keys for IPSec SA derived from IKE shared
secret
s
With PFS: use nonces
Phase II
What traffic does SA cover ? s Initiator specifies which entries (selectors) in SPD are for this IPSec SA, sends off to responder s Keys and SA attributes communicated with the Phase I - IKE SA
s
x Passes encrypted & authenticated
...