u5.13 Managing IPSEC Keys

u5.13 Managing IPSEC Keys

1. ESP & AH contain an SPI which references the SA

   • SPI = Security parameters Index exists in IPSEC headers
     • SPI is an index to a table of keys
       • keys are used for the crypto processes for providing confidentiality and authentication
         • details about the keys are held in a table called a Security Association = SA
   • Any host / gateway that needs to process the IPSEC datagram uses the SPI to retrieve all the stored SA data it needs to complete the processing
     • SA must be established before any IPSEC processing can take place

2. SA can be setup as follows

   • Manually
     • Useful in a small IPSEC community but requires the manual configuration and exchange of keys.
   • Automatically
     • Using the collection of key management protocols that form IKE (IPSEC key exchange).
   • User based keyring
     • this approach is unlikely because the user is usually far removed from the construction of the IPSEC channel.

3. Outbound processing

   • Datagram is passed down to the NW layer of the internet model
     • If policy defines that IPSEC processing is to be done, then an SA must be created if one is not already established
       • An SA carries all the information to enable the cryptographic processing for encryption and message authentication of the datagram
         • Initialisation vectors (IV) are included in each datagram in case the previous packet failed to arrive, so that the starting point for the encryption is known at the destination.
           • The newly assembled datagram is then passed down to the next layer of the Internet model, or if there is another stage of IPSEC processing required, the cycle is repeated.

4. Inbound processing

   • policy is checked to see if such a datagram can be processed
     • If not the packet is dropped
     • Next the SA is checked and it should exist because live IPSEC traffic is being sent
       • The encryption keys are located through the SA and the datagram is deciphered and the MAC checked
         • If needed a security error is raised, otherwise if no error is raised the assembled datagram is passed for normal processing

5. Message authentication

   • The MAC provides the message integrity service. It is a means for each party to ensure that the datagram has not been altered en route.
     • message authentication is used for all predictable fields
       • but is not used for the fields that are dynamically assigned en route during transmission.
         • Can not protect is packet changes hop by hop