Redes

IPSEC
Protocols Internet Security Association and Key Management Protocol (ISAKMP) A framework for the negotiation and management of security associations between peers (traverses UDP/500) InternetKey Exchange (IKE) Responsible for key agreement using asymmetric cryptography Encapsulating Security Payload (ESP) Provides data encryption, data integrity, and peer authentication; IP protocol 50Authentication Header (AH) Provides data integrity and peer authentication, but not data encryption; IP protocol 51 IPsec Modes
Original Packet Transport Mode Tunnel Mode L2 IP TCP/UDP
Typepacketlife.net
Encryption Algorithms
Key Length (Bits) Strength

DES Symmetric 3DES Symmetric AES Symmetric RSA Asymmetric

56 168 128/192/256 1024+

Weak Medium Strong Strong

Hashing AlgorithmsLength (Bits) Strength

MD5 128 SHA-1 160 IKE Phases

Medium Strong

Phase 1 A bidirectional ISAKMP SA is established between peers to provide a secure management channel (IKE in main oraggressive mode)
TCP/UDP

L2

IP

ESP/AH

Phase 1.5 (optional) Xauth can optionally be implemented to enforce user authentication
TCP/UDP

L2

New IP

ESP/AH

IP

Transport Mode The ESPor AH header is inserted behind the IP header; the IP header can be authenticated but not encrypted Tunnel Mode A new IP header is created in place of the original; this allows for encryption of theentire original packet Configuration
crypto isakmp policy 10 encryption aes 256 hash sha authentication pre-share group 2 lifetime 3600
ISAKMP Policy

Phase 2 Two unidirectional IPsec SAs areestablished for data transfer using separate keys (IKE quick mode) Terminology Data Integrity Secure hashing (HMAC) is used to ensure data has not been altered in transit Data Confidentiality Encryption isused to ensure data cannot be intercepted by a third party Data Origin Authentication Authentication of the SA peer Anti-replay Sequence numbers are used to detect and discard duplicate packets Hash...