Cryptography and Network Security pot

Cryptography and Network... Next Header | Payload Length RESERVED Security Parameters Index SPI Sequence Number Authentication Data variable... Transport & Tunnel Modes End-to-end auth

Cryptography and Network

° applicable to use over LANs, across public

& private WANS, & for the Internet

Networking dev ice

with IPSec

packet was sent

° insure no forging o

* many others, grouped by category

¢ mandatory in IPv6, optional in IPv4

e have a database o

° parties must share ase

Next Header | Payload Length RESERVED

Security Parameters Index (SPI)

Sequence Number

Authentication Data (variable)

Transport & Tunnel Modes

End-to-end authentication

End-to-end

Network

End-to-intermediate authentication

Encapsulating Security Payload

Security Parameters Index (SPI)

Combining Security Associations

¢ SA’s can implement either AH or ESP

° to implement both need to combine SA’s

° form a security bundle

° have 4 cases (see next)

Combining Security Associations

One or More SAs Tunnel SA

b.ESP in transport mode

c AH followed by ESP in transport mode(ESP SA inside an AH SA

d any one a, b, c inside an AH or ESP.in tunnel mode

SAˆs1n laree

° has Oakley &

*® can use arith

curve fields

Initiator Cookie

Responder Cookie Next Payload NijVer Exchange Type

Miessage ID

(a) ISAKMP Header

16

(b) Generic Payload Header