Implementing and Testing IPsec: NIST’s Contributions and Future Developments Sheila Frankel Systems and Network Security Group NIST

RSA Jan. 20, IPsec : Security a) foundation : house b) hammer : nail c) electron : chemistry d) government : progress An SAT-type Analogy: The Question

RSA Jan. 20, Topics Overview of IPsec NIST’s IPsec Reference Implementations NIST’s IPsec Web-Based Interoperability Tester (IPsec-WIT) Current Status of IPsec Future Directions of IPsec

RSA Jan. 20, At Which Network Layer Should Security Be Provided? Application Layer Transport (Sockets) Layer Internet Layer

RSA Jan. 20, Why Internet Layer Security? Implement once, in a consistent manner, for multiple applications Centrally-controlled access policy Enable multi-level, layered approach to security

RSA Jan. 20, Internet Packet Format IP Header Upper Protocol Headers and Packet Data

RSA Jan. 20, Types of Security Provided by IPsec Data Origin Authentication Connectionless Integrity Replay Protection Confidentiality (Encryption) Traffic Flow Confidentiality

RSA Jan. 20, Authentication Header (AH) Data origin authentication Connectionless integrity Replay protection (optional) Transport or tunnel mode Mandatory algorithms: –HMAC-MD5 –HMAC-SHA1 –Other algorithms optional

RSA Jan. 20, Internet Packet Format with AH IP Header AH Header Upper Protocol Headers and Packet Data Tunnel Mode New IP Header Old IP Header AH Header Upper Protocol Headers and Packet Data Transport Mode

RSA Jan. 20, Encapsulating Security Payload (ESP) Confidentiality Limited traffic flow confidentiality (tunnel mode only) Data origin authentication Connectionless integrity Replay protection (optional) Transport or tunnel mode

RSA Jan. 20, Encapsulating Security Payload (ESP) (continued) Mandatory algorithms: –DES-CBC –HMAC-MD5 –HMAC-SHA1 –Null Authentication algorithm –Null Encryption algorithm –Other algorithms optional

RSA Jan. 20, Internet Packet Format with ESP IP Header ESP Header Upper Protocol Headers and Packet Data Tunnel Mode New IP Header Old IP Header ESP Header Upper Protocol Headers and Packet Data Transport Mode

RSA Jan. 20, Transport vs. Tunnel Mode

RSA Jan. 20, Constructs Underlying IP Security Security Association (SA) Security Association Database (SAD) Security Parameter Index (SPI) Security Policy Database (SPD)

RSA Jan. 20, Internet Key Exchange (IKE) Negotiate: –Communication Parameters –Security Features Authenticate Communicating Peer Protect Identity Generate, Exchange, and Establish Keys in a Secure Manner Delete Security Associations

RSA Jan. 20, Internet Key Exchange (IKE) (continued) Threat Mitigation –Denial of Service –Replay –Man in Middle –Perfect Forward Secrecy Usable by IPsec and other domains

RSA Jan. 20, Internet Key Exchange (IKE) (continued) Components: –Internet Security Association and Key Management Protocol (ISAKMP) –Internet Key Exchange (IKE, aka ISAKMP/Oakley) –IP Security Domain of Interpretation (IPsec DOI)

RSA Jan. 20, IKE Negotiations - Phase 1 Purpose: Establish ISAKMP SA (“Secure Channel”) Steps (4-6 messages exchanged): –Negotiate Security Parameters –Diffie-Hellman Exchange –Authenticate Identities Main Mode vs. Aggressive Mode

RSA Jan. 20, IKE Negotiations - Phase 2 Purpose: Establish IPsec SA Steps (3-5 messages exchanged): –Negotiate Security Parameters –Optional Diffie-Hellman Exchange –Final Verification Quick Mode

RSA Jan. 20, NIST’s Contributions to IPsec Cerberus - Linux-based reference implementation of Ipsec PlutoPlus - Linux-based reference implementation of IKE IPsec-WIT - Web-based IPsec interoperability test facility

RSA Jan. 20, NIST’s Contributions to Ipsec (continued) Goals: –Enable smaller industry vendors to jump-start their entry into IPsec –Facilitate ongoing interoperability testing of multiple IPsec implementations

RSA Jan. 20, IPsec-WIT: Motivation Inter-operability of multiple implementations essential for IPsec to succeed Existing test modalities –Interoperability “Bake-offs” –Pre-planned Web-based interoperability testing Needed: spontaneous Web-based testing

RSA Jan. 20, User-Related Objectives Accessible from remote locations Available at any time Require no modification to the tester’s IPsec implementation Allow testers to resume testing at a later time Configurable Well-documented Easy to use

RSA Jan. 20, Implementation Objectives Simultaneous access by multiple users Rapid, modular implementation Easily modified and expanded as IPsec/IKE specifications evolve Built around NIST’s IPsec/IKE Reference Implementations, Cerberus and PlutoPlus

RSA Jan. 20, Implementation Objectives (continued) Require minimal changes to Cerberus and PlutoPlus Operator intervention not required

RSA Jan. 20, IPsec-WIT Architecture IUT WWW-based Tester Control (HTML/CGI) IPsec Encapsulated IP Packets Local IUT Configuration IPsec WIT Linux Kernel HTML Docs., Forms, and HTTP Server IP + NIST Cerberus PERL CGI Test Engine TestSuites Manual SAs and IP/IPsec Packet TracesNISTPlutoPlus Negotiated SAs and SA mgmt. messages Message logging and IKE Configuration Web Browser IKE Negotiation StateFiles

RSA Jan. 20, Implementation Perl cgi-bin tester HTML forms Executable test cases Output –PlutoPlus: tracing the IKE negotiation –Cerberus: dumping the ping packets – expect command: color-coded output

RSA Jan. 20, Implementation (continued) Individual tester files –Tester-specific parameters –Tester’s individual output –Storage and expiration

RSA Jan. 20, Current Capabilities Key establishment: manual or IKE negotiation IKE negotiation: Initiator or Responder Peer authentication: pre-shared secrets ISAKMP hash: MD5 or SHA ISAKMP encryption: DES or 3DES Diffie-Hellman exchange: 1st Oakley group

RSA Jan. 20, Current Capabilities (continued) Configurable port for IKE negotiation IPsec AH algorithms: HMAC-MD5 or HMAC-SHA1 IPsec ESP algorithms: –Encryption: DES, 3DES, IDEA, RC5, Blowfish, or ESP-Null –Authentication (optional): HMAC-MD5 or HMAC-SHA1 –Variable key length for RC5 and Blowfish

RSA Jan. 20, Current Capabilities (continued) IPsec encapsulation mode: transport or tunnel Perfect Forward Secrecy (PFS) Verbosity of IKE/IPsec output configurable IPsec SA tested using “ping” command Transport-mode SA: host-to-host

RSA Jan. 20, Current Capabilities (continued) Tunnel-mode SA:host-to-host or host-to- gateway –Host-to-gateway SA tests communications with tester’s host behind gateway Sample test cases for testers without a working IKE/IPsec implementation Current/cumulative test results can be viewed via browser or ed to tester

RSA Jan. 20, Limitations Re-keying Crash/disaster recovery Complex policy-related scenarios

RSA Jan. 20, Lessons Learned Voluntary interoperability testing is useful and used Interoperability tests can also serve as conformance tests Stateful protocols can be tested using a Web-based tester “Standard” features are more useful than “cutting edge”

RSA Jan. 20, Lessons Learned (continued) Some human intervention is required Productive and informative multi-protocol interaction is challenging Users do the “darnedest” - and most unexpected - things

RSA Jan. 20, Future Horizons - PlutoPlus Additional Diffie-Hellman groups More complex policy options –Multiple proposals –Adjacent SA’s –Nested SA’s Peer authentication: public key PKI interaction and certificate exchanges

RSA Jan. 20, Future Horizons - IPsec-WIT Test IPsec SA’s with UDP/TCP connections, rather than ICMP Better diagnostics from underlying protocols

RSA Jan. 20, Futuristic Horizons Negative testing Robustness testing

RSA Jan. 20, Current Status of IPsec Basic IPsec and IKE functionality defined in RFC’s Add-ons and additional functionality defined in Internet Drafts Numerous IPsec implementations in hardware and software Periodic interoperability/conformance testing at IPsec “Bake-offs”

RSA Jan. 20, Current Status of IPsec (continued) Deployed in Auto Industry Networks (ANX and ENX) Used for Virtual Private Networks (VPNs)

RSA Jan. 20, Future Directions of IPsec PKI profiles for IPsec Policy configuration and control (IPSP) Secure remote access (IPSRA) Transport-friendly ESP (TF-ESP)

RSA Jan. 20, An SAT-type Analogy: The Answer ?? To Be Announced ??

RSA Jan. 20, Contact/Usage Information IPsec-WIT: Cerberus documentation: PlutoPlus documentation: For further information, contact: –Sheila Frankel: –Rob Glenn: