IPSec, IKE, ESP, Tunnel, Cryptography

what is ipsec?
ietf standard that employs cryptographic mechanism on network layer:

authentication of every ip packet
verification of data integrity for each packet
confidentiality of packet payload

ipsec acts at network layer, protecting and authenticating ip packet b/w ipsec devices (peer)

IPsec is the only standard layer 3 technology that provides:

confidentiality
data integrity
authentication
replay detection (by comparing sequence number of received packet and a sliding window on destination host)

IPsec include a protocol for exchanging keys, Internet Key Exchange (IKE) and two IPsec IP protocols, Encapsulating Security Payload (ESP) and Authentication Header (AH)

IPsec uses 3 main protocols to create a security framework:

IKE

provides framework for negotiation of security parameters
establishment of authenticated keys

ESP

encryption, authentication and integrity check

AH

provides authentication and integrity check on packets

IPsec header

original frame      L2 - IP - L4 payload
transport mode    L2 - IP - ESP/AH - L4 payload
tunnel mode        L2 - New IP - ESP/AH - IP - L4 payload

IPsec provides

authentication and data integrity (md5 or sha-1 hmac) with AH and ESP
confidentiality (des, 3des, or aes) only with ESP

Authentication - packet was definitely sent by apparent sender
Integrity - packet was not changed

IKE

solves problem of manual and unscalable implementation of ipsec by automating entire key exchange process:

negotiation of SA characteristics
automatic key generation
automatic key refresh
manageable manual configuration

IKE uses mathematical routine called Diffie-Hellamnd exchange to generate symmetrical keys to be used by two IPsec peers. manage negotiation of other security parameters,

SA - an agreement b/w two peers engaging in an ipec exchange and consiss of theese required parameters necessary to establish summessful communication:

Oakley:  a key exchange protocol that defines how to acquire authenticated keying material diffie-hellman key exchange algorithm - basic mechanism for oakley

ISAKMP: protocol framework that defines mechaniics of implementing a key exchange protocol and negotiation of security policy

Skme: a key exchange protocol that define how to derive authenticated keying material with rapid key refreshment

IKE automatically negotiate IPsec SA and enables IPsec secure communication w/o costly manual preconfiguration
IKE feature:

eliminates need to manually specify all of ipsec security paramenters at both peers
allow specificatoin for a lifetime for ipsec sa
allow encryption key to change during ipsec session
allow ipsec to provide anti-replay service
CA support
allow dynamic authentication of peers

IKE phases

phase 1

authenticate peer
negotiate a bidirectional SA
main mode or aggressive mode

phase 1.5

xauth
mode config

phase 2

ipsec sa (negotiated by IKE process (ISAKMP) on behalf of ipsec, which need key material for operation)
quick mode
*two peers already agreed upon transform set, hash method, and otehr parameters during phase 1 negotiation

main mode

1st exchange - establish basic security policy (select proposal)
2nd exchange - pass DH pub key and other data.
all further negotiation is encryped within IKE SA
3rd exchange - authenticate ISAKMP session

quick mode

negotiation is protected within IKE SA
similar to aggressive mode
negotiate SA for data encryption and manages key exchange for IPsec SA

IKE- other function

dead peer detection
nat traversal (encrypt ipsec packet in udp packet)
mode config (push config) and xauth (user authentication)

DH key agreement is a public key encryption method that provides a way for 2 peers to establish a shred secret key that only they know, although they are communicting over an insecure channel

public key - exchanged bw end users
private key - kept secret by original owner

DH public key algothrim states that if user A and user B exchange public keys and a calculation is performed on their individual private key and on the public key of the other peer, the end result of the process is an identical shared key.
shared key is used to encrypt and decrypt data

security is not an issue with DH key exchange. although someone may know a user's public key, shared secret cannot be generated because private key never becomes public knowledge

group2 - DH group2 is used for secure exchange of shared key
crypto isakmp key  -  set shared key to .... when communicating with other router

* IKE p2 tunnel (ipsec tunnel) is negotiated and set up within the protection of an IKE p1 (ISAKMP tunnel).

*HASH
provide data integrity
one way mathematical function
in practice data of arbitrary length is input into hash function and then is processed through, resulting in fixed-length hash
the resultant fixed-length hash is called digest"

[출처] IPsec |작성자 kds20850