Demystifying the Ipsec Puzzle

Name: Demystifying the Ipsec Puzzle
Brand: Artech House Publishers
Price: 225.99 EUR
Availability: OnlineOnly

Sheila Frankel(Autor*in)

Artech House Publishers

1. Auflage

Erschienen am 1. April 2002

292 Seiten

E-Book

PDF mit Adobe-DRM

Systemvoraussetzungen

978-1-58053-399-7 (ISBN)

225,99 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Contents vii
Preface xvii
1 Introduction 1
1.1 The TCP/IP Protocol Stack 5
1.2 Introducing IPsec 12
1.3 Summary 13
1.4 Further Reading 14
References 14
2 The First Puzzle Piece: The Authentication Header 15
2.1 Protections Provided by AH 15
2.2 Security Associations and the Security Parameters Index 16
2.3 AH Format 19
2.4 AH Location 20
2.5 AH Modes 21
2.6 Nested Headers 22
2.7 Implementing IPsec Header Processing 23
2.8 AH Processing for Outbound Messages 25
2.9 AH Processing for Inbound Messages 30
2.10 Complications 32
2.11 Auditing 35
2.12 Threat Mitigation 37
2.13 Summary 37
2.14 Further Reading 38
References 38
3 The Second Puzzle Piece: The Encapsulating Security Payload 41
3.1 Protections Provided by ESP 41
3.2 Security Associations and the Security Parameters Index 42
3.3 ESP Header Format 43
3.4 ESP Header Location and Modes 45
3.5 Nested and Adjacent Headers 46
3.6 ESP Header Processing for Outbound Messages 48
3.7 ESP Header Processing for Inbound Messages 49
3.8 Complications 52
3.9 Criticisms and Counterclaims 52
3.10 Threat Mitigation 54
3.11 Why Two Security Headers? 55
3.12 Summary 56
3.13 Further Reading 56
References 57
4 The Third Puzzle Piece: The Cryptographic Algorithms 59
4.1 Underlying Principles 60
4.2 Authentication Algorithms 62
4.3 The ESP Header Encryption Algorithms 68
4.4 Complications 78
4.5 Public Key Cryptography 79
4.6 Conclusion 82
4.7 Further Reading 82
References 83
5 The Fourth Puzzle Piece: The Internet Key Exchange (IKE) 87
5.1 The IKE Two-Step Dance 87
5.2 Payloads and Exchanges 88
5.3 Authentication Methods 88
5.4 Proposals and Counterproposals 90
5.5 Cookies 94
5.6 The Security Association Payload 95
5.7 The Proposal Payload 95
5.8 The Message ID 96
5.9 Nonces 96
5.10 Identities and Identity Protection 97
5.11 Certificates and Certificate Requests 98
5.12 Keys and Diffie-Hellman Exchanges 99
5.13 Notifications 100
5.14 Lifetimes 101
5.15 Vendor IDs 101
5.16 The Phase 1 Negotiation 101
5.17 The Phase 2 Negotiation 112
5.18 New Group Mode 117
5.19 Informational Exchanges 118
5.20 The ISAKMP Header 119
5.21 The Generic Payload Header 120
5.22 The IKE State Machine 121
5.23 The Origins of IKE 122
5.24 An Example 122
5.25 Criticisms and Counterclaims 123
5.26 Threat Mitigation 125
5.27 Summary 125
5.28 Further Reading 126
References 127
6 The Fifth Puzzle Piece: IKE and the Road Warrior 129
6.1 Legacy Authentication Methods 132
6.2 ISAKMP Configuration Method 134
6.3 Extended Authentication 139
6.4 Hybrid Authentication 140
6.5 Challenge-Response for Authenticated Cryptographic Keys 142
6.6 User-Level Authentication 145
6.7 Credential-Based Approaches 145
6.8 Complications 150
6.9 Threat Mitigation 151
6.10 Summary 151
6.11 Further Reading 151
References 152
7 The Sixth Puzzle Piece: IKE Frills and Add-Ons 153
7.1 Renegotiation 154
7.2 Heartbeats 157
7.3 Initial Contact 162
7.4 Dangling SAs 163
7.5 Summary 164
7.6 Further Reading 164
References 164
8 The Glue: PF_KEY 165
8.1 The PF_KEY Messages 166
8.2 A Sample PF_KEY Exchange 171
8.3 Composition of PF_KEY Messages 173
8.4 Complications 177
8.5 Summary 177
8.6 Further Reading 177
Reference 177
9 The Missing Puzzle Piece: Policy Setting and Enforcement 179
9.1 The Security Policy Database 180
9.2 The Policy Problem 187
9.3 Revisiting the Road Warrior 193
9.4 IPsec Policy Solutions 194
9.5 Summary 204
9.6 Further Reading 204
References 204
10 The Framework: Public Key 207
10.1 PKI Functional Components 208
10.2 The PKI World View 210
10.3 The Life Cycle of a Certificate 211
10.4 PKI Protocol-Related Components 212
10.5 Certificates and CRLs 215
10.6 Certificate Formats 216
10.7 Certificate Contents 218
10.8 IKE and IPsec Considerations 222
10.9 Summary 225
10.10 Further Reading 225
References 226
11 The Unsolved Puzzle: Secure IP Multicast 229
11.1 Some Examples 230
11.2 Multicast Logistics 231
11.3 Functional Requirements 232
11.4 Security Requirements 233
11.5 Whither IP Multicast Security? 239
11.6 Summary 240
11.7 Further Reading 240
References 241
12 The Whole Puzzle: Is IPsec the Correct Solution? 243
12.1 Advantages of IPsec 244
12.2 Disadvantages of IPsec 245
12.3 Alternatives to IPsec 245
12.4 IPsec Today 247
12.5 The Future of IPsec 247
12.6 Summary 249
12.7 Further Reading 249
References 249
List of Acronyms and Abbreviations 251
About the Author 261
Index 263

Systemvoraussetzungen

Als PDF speichern Als Link merken