1. IPv6 Security By Eric Pennington COSC 356 – Network Security Dr. Oblitey 2004-11-30

2. TCP/IP Overview The protocol suite that is used for communications for the Internet The protocol suite that is used for communications for the Internet Adopted en masse across the Arpanet in 1983 as a de facto standard for protocols Adopted en masse across the Arpanet in 1983 as a de facto standard for protocols Replaced the much slower and harder to maintain NCP protocol Replaced the much slower and harder to maintain NCP protocol

3. IPv4 Overview First put forward as an RFC in 1981 First put forward as an RFC in 1981 Combined with TCP shortly thereafter to handle the routing of packets Combined with TCP shortly thereafter to handle the routing of packets It has been used since the early 80s, and is still the most widespread today It has been used since the early 80s, and is still the most widespread today

4. IPv4 Problems Small addressing space Small addressing space 32-bits - 4,294,967,296 unique nodes 32-bits - 4,294,967,296 unique nodes NATs created to help NATs created to help Total lack of security Total lack of security Not originally a problem Not originally a problem Usability over security Usability over security Packets are susceptible to interception and alteration Packets are susceptible to interception and alteration

5. IPv6 Overview Slow in deployment Slow in deployment Much larger addressing space Much larger addressing space 128-bit - 3.4 × 10 38 nodes 128-bit - 3.4 × 10 38 nodes More than we should need More than we should need IPSec – Internet Protocol Security Suite IPSec – Internet Protocol Security Suite Designed to run on both IPv4 and IPv6 Designed to run on both IPv4 and IPv6 Optional for IPv4; Required for IPv6 Optional for IPv4; Required for IPv6

6. IPSec Overview Operates at Level 3 (Network Layer) of the OSI Model Operates at Level 3 (Network Layer) of the OSI Model Two types of security in IPSec Two types of security in IPSec Portal to portal – security provided to several machines by a single node Portal to portal – security provided to several machines by a single node End to end – source/destination computers do the security processing End to end – source/destination computers do the security processing Two modes of operation: Two modes of operation: Transport Mode Transport Mode Tunnel Mode Tunnel Mode

7. IPSec Protocols Authentication Header (AH) Authentication Header (AH) A CRC-like hash value computer and stored in each packet A CRC-like hash value computer and stored in each packet Encapsulating Security Payload (ESP) Encapsulating Security Payload (ESP) Encrypts the packet and stores a header showing the type of encryption, etc. Encrypts the packet and stores a header showing the type of encryption, etc.

8. Transport Mode Only the raw data within the packet is encrypted Only the raw data within the packet is encrypted Security headers placed in-between the data and the regular IP headers Security headers placed in-between the data and the regular IP headers IP headers remain unmodified IP headers remain unmodified

9. Tunnel Mode STunnel on Linux accomplishes the same task (for IPv4) STunnel on Linux accomplishes the same task (for IPv4) Encrypts the entire packet Encrypts the entire packet Even encrypts the headers Even encrypts the headers Encapsulates the old packet within a new packet Encapsulates the old packet within a new packet Adds new security headers Adds new security headers Adds new IP headers Adds new IP headers

10. IPv6 Wares Built-in to Windows (as of Windows XP) Built-in to Windows (as of Windows XP) Built-in to Linux (IPSec as of Kernel 2.6) Built-in to Linux (IPSec as of Kernel 2.6) Built-in to Mac OS X Built-in to Mac OS X Built-in to OpenBSD Built-in to OpenBSD FreeS/WAN – www.freeswan.org FreeS/WAN – www.freeswan.orgwww.freeswan.org Many other free and open source alternatives Many other free and open source alternatives Still no widespread usage Still no widespread usage

11. THE END