1. Network Layer Security Howie Weiss (NASA/JPL/SPARTA/Cobham/Parsons) Boulder, CO November 2011

2. Agenda CCSDS Network Layer Security IPSec+IKE Profile for CCSDS
What is included?
What is excluded?
How is it used?
Review WG results from Berlin meeting

3. What is Network Layer Security?
Space extensions to FTP
SCPS-FP
FTP
Features
FTP
Other Apps
Space extensions to the Socket Interface
SCPS-TP “TCP
Tranquility”
options
TCP
Options
TCP
UDP
Space-optimized
IPSec variant
SCPS-SP
IPSec
IKE
Common Network-
Layer Interface
Space-optimized
IP variant
SCPS-NP IP
Space Link Subnet: CCSDS Data Link

4. IPSec: one protocol, many options
Tunnel mode vs. transport mode
Default cipher suite (encryption + auth + mode)
Authenticated encryption?
Null encryption (authentication-only)?
ESP w/null encrypt or AH?
What would be allowed?
Anti-replay option
Keying and rekeying
Pre-placed keys?
IKE auto rekey
Automatic when keys expire – regardless of mission state?
Rekey “now” button?

5. Issues to be resolved Transport or tunnel mode or both? Tunnel mode
ESP-only? AH-only?
ESP-only
ESP + AH? No
Authentication-only w/o encryption allowed? (null encryption)
Yes
Authenticated Encryption or Encryption w/o auth allowed?
AEAD Yes, warning that encryption-only is unsafe
Keying and rekeying questions
Automated vs. manual
IKEv1 or IKEv2
IKEv2 w/rekey commanding “button”
Push-to-rekey
Push-to-inhibit rekey
Manual keying allowed
SA lifetimes
Policy Management
Silent for now
Define default cipher suite(s)
Follow algorithm document + IKE & IPsec RFCs
Compression
Optional IPcomp

6. Transport vs. Tunnel Mode
Transport Mode:
Single IP header
End-to-End mode (writer-2-reader)
Not generally used commercially
Tunnel Mode:
Dual IP headers – entire IP packet is encapsulated
Allows Gateway-to-Gateway mode
Allows IPSec to be outboard in security gateways
E.g., commercial VPNs
Recommendation for CCSDS:
Tunnel Mode

7. IPSec is TWO Protocols AH: IP Authentication Header (RFC 4302)
connectionless integrity
data origin authentication.
optional replay protection
No confidentiality
ESP: Encapsulating Security Payload (RFC 4303)
confidentiality,
data origin authentication,
connectionless integrity,
anti-replay protection (w/automated key management),
limited traffic flow confidentiality.
Provides encryption-only service for confidentiality
Provides integrity-only service
Provides confidentiality + integrity service

8. AH Authenticated (108 bytes)
AH Packet Format
AH (IP protocol 51)
total length 152 bytes
IPv4
Header
20 bytes AH
24 bytes
ICMP
8 bytes
Data
80 bytes
AH Authenticated (108 bytes)
Next
Header
=IPIP
1 byte
Length
(this header)
Pad
2 bytes AH
SPI
4 bytes
Seq #
ICV
12 bytes

9. ESP Authenticated (132 bytes)
ESP w/Null Encryption
ESP (IP protocol 50)
total length 152 bytes
IPv4
Header
20 bytes
ESP
Null Encrypted Payload
132 bytes
ESP
SPI
4 bytes
Seq #
IPv4 Header
20 bytes
ICMP
(8 bytes hdr +
80 bytes data)
88 bytes
Pad
varies per RFC 2406
- in this example
2 bytes
Len
1 byte
Next
Hdr
Authentication
Data
varies: 8, 12,or 16 byte
12 bytes
ESP Header
ESP Trailer
ESP Auth
ESP Authenticated (132 bytes)

10. ESP Authenticated (140 bytes)
ESP w/AES-GCM
ESP (IP protocol 50)
total length 160 bytes
IPv4
Header
20 bytes
ESP
AES128 Encrypted Payload
140 bytes
Encrypted (128 bytes)
ESP
SPI
4 bytes
Seq # IV
8 bytes
IPv4
Header
20 bytes
ICMP
(8 bytes hdr +
80 bytes data)
88 bytes
Pad
varies per RFC 2406
- in this example
2 bytes
Len
1 byte
Next
Hdr
Authentication
Data
varies: 8, 12,or 16 bytes
12 bytes
ESP Header
ESP Trailer
ESP Auth
ESP Authenticated (140 bytes)

11. ESP w/AES-GCM + AH AH (IP protocol 51) IPv4 Header AH (ref AH format)
total length 184 bytes
IPv4
Header
20 bytes AH
(ref AH format)
24 bytes
ESP
AES128 Encrypted Payload
140 bytes
AH Authenticated (148 bytes)
Encrypted (128 bytes)
ESP
SPI
4 bytes
Seq # IV
8 bytes
IPv4
Header
20 bytes
ICMP
(8 bytes hdr +
80 bytes data)
88 bytes
Pad
varies per RFC 2406
- in this example
2 bytes
Len
1 byte
Next
Hdr
Authentication
Data
varies: 8, 12, 16 bytes
12 bytes
ESP Header
ESP Trailer
ESP Auth
ESP Authenticated (140 bytes)

12. ESP and/or AH ? AH does not support confidentiality
ESP supports both confidentiality and integrity
Supports null encryption
AH was designed because of export control issues regarding encryption algorithms
AH and ESP can be nested but why?
Too much overhead
Recommendation for CCSDS:
ESP-only

13. Security Services Allowed
Authentication-only mode
CCSDS Recommendation: allow
Needed for commanding w/o need for confidentiality
Authenticated Encryption mode
CCSDS Recommendation: allow (must)
Encryption w/o authentication is shown to be a dangerous practice
Non-authenticated Encryption mode
CCSDS Recommendation: unsafe, not recommended
Operational overhead and mission risk analysis may have need for this but it should not be done without analysis

14. Keying Conformant IPSec must support BOTH automated and manual keying
Automated keying: Internet Key Exchange
Manual keying: ad-hoc (each implementation determines how)
Issues regarding automated keying:
Rekey at “bad” time in the mission timeline
E.g., critical burn maneuver
E.g., critical upload/download
Requires little human intervention
Issues regarding manual keying:
“simple” but requires human resources
Physical distribution and protection required

15. Internet Key Exchange (IKE)
IKE v1 (RFC 2409)
Complicated, robust protocol
Commercially widely used
IKE v2 (RFC 4306)
Simpler than IKEv1 (maybe safer…)
Commercially not widely used, yet.
Requires on-board flight code
More flight code to certify
But do it once and reuse, reuse, reuse

16. rekey IKE Operation IKE rekeys when thresholds are met, for example:
Number of bytes transmitted
Elapsed time
For space, IKE Rekey-Upon-Command is needed
E.g., button-push to rekey
E.g., button-push to inhibit rekey
For space, timers will have to be tweaked vs. commercial (terrestrial) implementations
Recommendation for CCSDS:
IKEv2 w/rekey commanding “button”
Push-to-rekey
Push-to-inhibit rekey
rekey

17. Manual Keying Sometimes simple is enough….
Need ability to preload keys (e.g., 512 keys, 1024 keys) onboard
Maybe have a key upload ability?
Command to change keys
Preload and manage Security Associations (SA)
Recommendation for CCSDS:
Require manual key w/management (testing, ground checkout)

18. Policy Management IPSec supports policies, e.g.:
Security services on a connection
Access controls for connection
No standards for loading, updating, supporting IPSec policies
SNMP-based approaches:
RFC 4807: IPSec Security Policy Database Configuration MIB
IPSec Security Policy IPSec Action MIB (IETF draft)
IPSec Security Policy IKE Action MIB (IETF draft)
Microsoft IPSec Policy Agent Service
KeyNote, ipsecconf, proprietary, etc
What do we want to do?

19. Cipher Suite Follow CCSDS Algorithms document 128-bit key size AES
AES-GCM for authenticated encryption
AES-CMAC, AES-GMAC, HMAC for authentication/integrity

20. Compression Overhead vs. Bandwidth! IPSec adds overhead
Everyone complains about not having enough bandwidth
IP Payload Compression Protocol (IPComp) (RFC 3173)
Commercially supported
Compresses IP datagrams BEFORE security processing on outbound
Decompresses IP datagrams AFTER security processing on inbound
Recommendation for CCSDS:
Optional use of IPComp

21. Summary IPSec: ESP-only Null encryption allowed
Authenticated encryption
Non-authenticated encryption unsafe
IKEv2 w/rekey button
Manual keying w/management
Policy management needed - ?
Cipher suites follow algorithms blue book
Compression (IPComp)