1. Virtual Private Networks
Fred Baker

2. What is a VPN
Public networks are used to move information between trusted network segments using shared facilities like frame relay or atm
A VIRTUAL Private Network replaces all of the above utilizing the public Internet Performance and availability depend on your ISP and the Internet

3. Why?

4. HomeNet to the office.

5. VPN Types

6. VPN Implementations

7. VPN as your Intranet

8. What a VPN needs VPNs must be encrypted VPNs must be authenticated
so no one can read it
VPNs must be authenticated
No one outside the VPN can alter the VPN
All parties to the VPN must agree on the security properties

9. VPN Components

10. Parts of a VPN

11. VPN works via crypto/Encapsulation

12. Encryption and Decryption
Clear-Text
Clear-Text
Bob Is a Fink
Bob Is a Fink
8vyaleh31&d
ktu.dtrw8743
$Fie*nP093h
Encryption is the masking of secret or sensitive information such that only an authorized party may view (or decrypt) it
Encryption
Decryption
Cipher Text 43 11 43

13. Basic Crypto – Keys are key

14. 2 Kinds Key Systems

15. Symmetric Key Algorithms
DES—56-bit key
Triple-DES—encrypt, decrypt, encrypt, using either two or three 56-bit keys
IDEA—128-bit key
Blowfish—variable-length key, up to 448 bits 15

16. Public Key Encryption Example
Alice wants to send Bob encrypted data
Alice gets Bob’s public key
Alice encrypts the data with Bob’s public key
Alice sends the encrypted data to Bob
Bob decrypts the data with his private key
Alice
Bob
What is encrypted with the public key can only be decrypted with the private key. Anyone can encrypt with someone’s private key but only the intended recipient can decrypt
What is encrypted with the private key can only be decrypted with the public key. Only the holder of the private key can encrypt, anyone can decrypt—proof of signature.
Message
Encrypted
Message
Message
Encryption
Decrypt
Bob’s Public Key
Bob’s Private Key 13 49 49

17. PKI vs Symmetric Key
PKI easier as you don’t have to manage keys on a per user basis
But MUCH more compute intensive (up to 1000 times faster)
Many systems do a combination I.e. PGP
Use PKI to send a symmetric key
Then use the symmetric key to crypto the data

18. Using Crypto in real life

19. PKI to send Private Keys

20. PKI Certs a way to authenticate

21. Prove the user cert Certificates of authority

22. Digital Signature to verify data not changed in transit

23. PKI the full picture

24. Where you do Crypto

25. Technologies

26. Application Layer: SSL

27. Transport Layer: IPSEC
A standard
is composed of:
Diffie-Huffman key exchange
PKI for the DH exchanges
DES and other bulk encryption
Hash to authenticate packets
Digital Certificates to validate keys

28. Transport Layer: IPSEC VPNs 3 parts

29. Tunnel vs Transport Transport Tunnel
Implemented by the end point systems
Real address to real address
Cannot ‘go through’ other networks
Tunnel
Encapsulation of the original IP packet in another packet
Can ‘go through’ other networks
End systems need not support this
Often PC to a box on the ‘inside’

30. Diffie-Hellman Key Exchange (1976)
By openly exchanging non-secret numbers, two people can compute a unique shared secret number known only to them
Diffie-Hellman Key Generation
By exchanging numbers in the clear, two entities can determine a new unique number known only to them
Result is a shared secret
Neither party can alone control value
Neither party knows—no needs to know—private key of other 45 16 45

31. Modular Exponentiation
Both g and p Are Shared and Well-Known
Generator, g
Modulus (prime), p
Y = gX mod p
Diffie-Hellmann exchange is based upon the concept of modular exponentiation. The prime p denotes a galois field.
The numbers are HUGE—e.g, bits
2^ mod 17

32. Diffie-Hellman Public Key Exchange
Private Value, XA
Public Value, YA
Private Value, XB
Public Value, YB
Alice
Bob
YA =g mod p XA
YB = g mod p XB YA
D-H exchange is in fact two exponentiations
One exponentiation produces a “public value”. Private value is a random (but very large) number
Public numbers are exchanged and another exponentiation is performed.
Each party derives the same shared secret
Susceptible to man-in-the-middle attack YB XA
XA XB XB
YB mod p = g mod p = YA mod p
(shared secret) 46 18 46

33. Security Association is the agreement on how to secure

34. create the ISAKMP SA (Internet Security Association Key Management Protocol)

35. IPSEC Key Exchange (IKE)

36. IKE allows scale as I do not need to hard code passwords for each pair

37. Link Layer: L2TP for VPDN (Vir Pvt Dial Net)

38. PPTP: Free from Microsoft

39. PPTP: Security

40. VPN Comparisons

41. So why have a private network: QOS not fully cooked
Very dependent on your ISP
Real hard to do across ISPs
So no guarantee of performance

42. Other Issues

43. Like Nat

44. Wireless: a new big driver, WAS (Work At Starbucks)

45. Many security protocols, depends on deployer

46. VPN means I don’t care how you connect

47. Example

48. So what could be wrong? VPN clients hit the network stack
May not play well with personal firewalls
Or other software
May not need full access to the target network just encrypted access

49. One answer: clientless VPN
Use SSL as the transport protocol to an appliance
Can add NT authentication to the appliance
Clientless mode: Use web enabled applications over the Internet, the appliance SSLifies web sites
Java Applet: Use an downloadable applet to send traffic over SSL, get more support for applications.
Can work well if you want to have encrypted web based apps without redoing the application
to use SSL you need certs and have to change EVERY link to HTTPs
Also big hit on the server cpu

50. Summary: VPNs Very big in the work access space Wireless
Exploit High speed
Wireless
in the office
public ‘hot spots’ like Borders
Replaces direct dial into the work network
Replace dedicated Business partners
May replace the corporate WAN