The IP Security Protocol, Part 2

Encapsulating security payloads, key exchange mechanisms and other components of establishing secure data transfers.
Example Applications

The most straightforward application of IPSec is having two hosts that need to exchange private data over an unsecured IP network (be it the Internet or a LAN). In this case, transport mode ESP IPSec can be employed. The most common IPSec application is the interconnection of remote LANs over the Internet, usually in order to set up a corporate VPN. For this kind of application, since many hosts are involved and configuring IPSec on each one would be awkward, tunnel mode ESP IPSec can be deployed on the LANs gateways. As already noted, this is completely transparent to the hosts.

Another interesting application is the road warrior case. Suppose an employee needs to remotely access a file server on his corporate LAN. IPSec may be configured to use AH, in tunnel mode, from the remote host to the LAN gateway (outer SA). Furthermore, another SA (inner SA) would be set up between the remote host and the local file server, using ESP in transport mode. The outer SA would guarantee the road warrior's authenticity, whereas the inner one would keep data encrypted even within the LAN. This can be useful if some employees are not completely trusted; most computer crimes are committed from within the attacked LAN--not from the outside.

Figure 4 illustrates the road warrior case, highlighting the packet structure in each part of the path.

Conclusions

IPSec importance is growing, but unfortunately its operation imposes a significant burden on the encrypting devices. While this may not be a serious issue for common WAN interconnections, based on T1/E1 links (1.5/2 Mbps), it actually limits the adoption of IPSec in those contexts where preserving bandwidth is an essential requirement and link capacities are around 34/45 Mbps (T3/E3 links) or higher (Fast or even Gigabit Ethernets running at 100/1000 Mbps). Furthermore, certain applications may suffer from the increase in latency (i.e., the time required to pass through an IPSec network device) due to the extra processing.

Resources

Applied Cryptography, by Bruce Schneier, is an excellent and deep introduction to cryptography issues and algorithms.

Cryptonomicom, by Neal Stephenson, is a good novel romance deeply related to cryptography.

IETF RFCs 2401-2411, RFC 2451, and others (available from www.ietf.org), specify the IPSec architecture and its components.

"OpenSSL Programming", Linux Journal, September 2001. Eric Rescorla gives an introduction on how to use SSL in your own programs.

"Problem Areas for the IP Security Protocols", Proc. 6th Usenix Unix Security Symposium, July 1996. Steve Bellovin explains, among other things, why using confidentiality without authentication is dangerous.

RSA Crypto FAQ

"The 101 Uses of OpenSSH: Part II", Linux Journal, February 2001. Mick Bauer introduces the basic concepts of public key cryptography.

Gianluca Insolvibile has been a Linux enthusiast since kernel 0.99pl4. He currently deals with networking and digital video research and development.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Securing my LAN.

Lord Loh.'s picture

I want to secure my LAN from internal attacks. I primarily want to prevent an external notebook PC from being brought in by an employee and be configured to work on the LAN.

I have certain IP based rules for access and deny of resources. If an external device joins my LAN it could assume any IP and gain access to the otherwise denied resource.

One way I see is to put passphrase on every PC. The other is the use of IKE on the LAN. Can a unauthorized machine be prevented from getting a key via IKE?

Re: The IP Security Protocol, Part 2

Anonymous's picture

As a reference performance note, FreeS/Wan (Linux IPSec implementation) plus AES patches
can almost saturate (95%) a 100Mbps link with a P4 1GHz.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState