[Day 11] 3. IPSec

IPSec (Internet Protocol Security)

IPSec is a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet within a communication session. It ensures confidentiality, integrity, and authenticity of data sent over untrusted networks, such as the internet.

Key Features of IPSec

1. Authentication: Verifies that the communication comes from a trusted source.
2. Encryption: Protects the data to ensure confidentiality.
3. Data Integrity: Ensures the data has not been tampered with during transmission.
4. Anti-Replay Protection: Detects and rejects duplicated packets to prevent replay attacks.

Internet Engineering Task Force (IETF) Protocol Suite

The Internet Engineering Task Force (IETF) provides a standard suite of protocols to ensure security at the IP layer (network layer) between two communicating endpoints. This framework is commonly referred to as IPSec.

---

Sub-protocols

Encapsulating Security Payload (ESP) Protocol

• Defines the method for encrypting data within IP packets.
• Encryption comes with a digital signature (ICV-Integrity Check Value) to ensure data integrity and authenticity.

Authentication Header (AH) Protocol

• Defines the method for digitally signing IP packets.
• Ensures data integrity and authentication without encryption.

Summary

• ESP: Main job is to encrypt data to keep it private. It can also optionally check if the data has been altered and authenticate the sender.
• AH: Main job is to ensure data integrity and authenticate the sender, without encrypting the data.

---

Modes of Operation

1. Tunnel Mode

• Purpose: Encrypts and protects the entire original IP packet by encapsulating it within a new IP packet.
• Use Case:
  • Router-to-router communication.
  • VPN connections between an IPSec client and an IPSec gateway.

Process:

• The entire original IP packet, including headers and payload, is encrypted and encapsulated.
• A new IP header is added, enabling secure transfer between endpoints.

Advantages:

• Ensures the original IP addressing is hidden, improving security.

Visuals for Tunnel Mode:

• IPSec Tunnel Mode: !3. IPSec Tunnel Mode.png
  Illustrates the encapsulation of the original IP packet in Tunnel Mode.

• IPSec Tunnel Mode ESP Header: !3. IPSec Tunnel Mode with ESP Header.png
  Shows the Encapsulating Security Payload (ESP) in Tunnel Mode.

• IPSec Tunnel Mode Authentication Header: !3. IPSec Tunnel Mode with Authentication Header.png Illustrates the use of Authentication Header (AH) for integrity in Tunnel Mode.

---

2. Transport Mode

• Purpose: Encrypts only the payload of the original IP packet while leaving the header intact.
• Use Case:
  • End-to-end communication between two devices, such as a client and a server.

Process:

• Only the data portion of the packet is encrypted.
• The original IP header remains unchanged, allowing for routing without decryption.

Advantages:

• Efficient for devices requiring secure communication while maintaining routing visibility.

Visuals for Transport Mode:

• IPSec Transport Mode: !3. IPSec Transport Mode.png
  Depicts payload encryption in Transport Mode.

• IPSec Transport Mode ESP Header: !3. IPSec Transport Mode with ESP Header.png
  Shows the Encapsulating Security Payload (ESP) applied to the payload only.

• IPSec Transport Mode Authentication Header: !3. IPSec Transport Mode with Authentication Header.png
  Highlights the use of Authentication Header (AH) for integrity in Transport Mode.

---

Conclusion

IPSec is a robust protocol suite for securing communications over IP networks. By offering two distinct modes—Tunnel Mode for securing gateways and Transport Mode for end-to-end encryption—it caters to various security needs, ensuring data privacy and integrity across both large-scale networks and individual devices.

Tunnel Mode

• Usage: Tunnel Mode is generally used when data needs to be securely sent between two different networks (e.g., site-to-site VPNs).

• How It Works: In this mode, the entire original IP packet is encrypted and encapsulated within a new IP packet. This means that even the original packet's header is encrypted, providing a high level of security.

• Typical Scenario: When a company has two different office locations, and it wants to securely connect both office networks over the internet.

Transport Mode

• Usage: Transport Mode is used for end-to-end communication between two devices (e.g., host-to-host communications).

• How It Works: Only the payload (actual data) of the IP packet is encrypted, while the original IP header remains intact. This makes it suitable for protecting data between specific devices.

• Typical Scenario: When a client computer communicates securely with a server, such as for secure remote access.

---

For additional information, visit IPSec Documentation.