Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS4203: Computer Security > IPSec > Flashcards

IPSec Flashcards

1
Q

What protocol was TLS based on?

A

SSL 3.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What algorithms does TLS use for key exchange?

A

RSA or Diffie-Helman

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How is authentication done in TLS?

A

Using RSA or digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the process of SSL/TLS authentication?

A

Browser requests web server identifies itself
Server sends browser SSL Certificate
Browser checks if it trusts the SSL certificate, and responds
Server responds with signed acknowledgement and starts SSL encrypted session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is HMAC?

A

Keyed-Hashing for Message Authentication Code.

Same as MAC except uses a key for extra authentication

Can use intermediate CA”s to verify signatures rather than going back to root.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What properties of a network are vulnerable?

A 
Precursors
Authentication
Confidentiality
Integrity
Availability
Programming Flaws
Mobile Agents
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What attack vectors are there for authentication?

A

Impersonation
Eavesdropping
Spoofing
Session Hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What attack vectors are there for confidentiality?

A 
Protocol Flaws
Eavesdropping
Wiretap
Misdelivery
Exposure
Traffic Flow Analysis
Cookies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What attack vectors are there for integrity?

A 
Protocol Flaws
Wiretap
Falsification of messages
Network Noise
DNS attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What attack vectors are there for availability on a network?

A 
Protocol flaws
Component Failure
DoS
Traffic Redirection
Ping of Death
Smurf
Syn flood
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What programming flaws are commonly seen that lead to vulnerabilities?

A

Buffer overflows
Addressing errors
Language vulnerabilities
Viruses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is IPSec?

A

Internet Protocol Security

Framework of open standards for ensuring private, secure communications over IP networks.

Uses cryptographic security services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the IPSec suite provide?

A

Protection against private network and internet attack through end-to-end security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does IPSec allow for?

A

Protection of communications between workgroups, LANs, Domain clients and servers, extranets and roving clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What was IPSec developed to address?

A

The needs for data security, integrity, authentication and protection for network connections which are connectionless and stateless.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does IPSec allowing the transmission of?

A

Packets sent with cryptography.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the drawback of applying cryptography to every packet?

A

Each packet must be treated as an independent entity

There is no guaranteed delivery

No packet order maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the benefits of IPSec?

A

All IP datagrams are covered

No need to re-engineer applications

Transparent to the upper layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the two basic modes of use of IPSec?

A

Transport mode

Tunnel mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does transport mode work?

A

IPsec-aware hosts as endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How does tunnel mode work?

A

IPSec-unaware hosts have tunnels established by intermediate gateways or host OS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the AH?

A

Authentication Header

Assures authenticity and integrity of the message.

Uses a message digest to check the integrity of the whole IP datagram and adds an extra header containing the digest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is an ESP?

A

Encapsulated Security Payload

Assures confidentiality, integrity and authenticity of the message by hashing the payload.

24
Q

What happens in tunnel mode?

A

A new IP header is put at the front of the message.

25
Q

What does the AH provide?

A

Connectionless data integrity and data origin authentication.

Creates stateful channel using sequence numbers.

Payload, Source UP, Most of Header, AH sequence number are all authenticated.

Uses MAC and secret key shared between endpoints

26
Q

WHat does ESP provide?

A

One or both of:
Confidentiality for payload
Authentication of payload

Symmetric encryption and MACs based on secret keys are shared between endpoints

27
Q

What does ESP add to datagrams?

A

Header, containing Security Parameters Index which specific algorithms and keys used for IPSec processing

Trailer field, including padding needed for encryption algorithm and MAC hash value

28
Q

How does IPSec transport mode work?

A

IPSec processing performed at endpoints of secure channel

Endpoints must be IPSec-aware

Only source and destination addresses are unencrypted

29
Q

How does IPSec Tunnel mode work?

A

Requires visibility of local network.

Extra overheads in preparation and transit (~20B)

30
Q

What is the SPI in an ESP packet?

A

Security Parameter Index (SPI) which identifies the security association (SA) for the IP packet.

31
Q

What is the ESP header made up of?

A

Security Parameter Index (SPI) and sequence number.

32
Q

What is an SA and what does it do?

A

A Security Association is a one-way relationship between sender and receiver.

Specifies the processing to be applied to the datagram from sender tor receiver.

33
Q

What do IPSEC connections require?

A

Internet Security Association and Key Management (ISAKMP)

IPSec Security Assosication

34
Q

How is ISAKMP implemented?

A

Diffie-Hellman, IKE, RSA for Key exchange

Pre-shared key, digital signature, public key etc for Authentication

35
Q

What does an IPSec packet consist of?

A 
Initiator's SPI
Responder's SPI
Message Length
SA Payload
Proposal Payload
Transform Payload
36
Q

How do transport mode SAs work?

A

Operates between hosts

Original IP addresses are readable and hosts do their own AH encapsulation

37
Q

What are the risks of Transport Mode?

A

IPSec sits within the original IP header, allowing the attacker to make intelligent guesses as to where servers are on a network and build a network picture.

38
Q

How do tunnel mode SAs work?

A

Operates normally between Security Gateways - used in VPNs

Gateways provide AH/ESP services to other hosts.

39
Q

Why are tunnel mode SAs more secure?

A

As new IP headers unrelated to sender/receiver are the only thing exposed.

40
Q

Why are SAs created in pairs?

A

Because it’s unidirectional, so need to have a way to send and respond.

41
Q

How are SAs created?

A 
SPI
Source address
Destination address
Security protocol
Algorithm type
Keys
Key lifetimes
Initialisation vectors (IVs)
Sequence number
Anti-replay
mode of transport
42
Q

How are the list of active SAs stored?

A

In the SAD database

43
Q

What key exchange protocol is used for SAs?

A

Internet Key Exchange (IKE)

44
Q

How is SAD searched?

A

Matches the “Longest” SA identifier (The best match).

1) Search SAD for SPI, Destination address and source address.
2) search SAD for SPI, Destination address
3) Search SAD for SPI
4) Discard packet

45
Q

What rules do IPSec aware hosts need and why?

A

Rules are required for processing packets.
Need to know:
What packets should be dropped, passed, encrypted or MACed?

Which key and algorithm to apply

46
Q

Where are the rules stored for SAs?

A

Security Policy Database.

Consulted for each outbound and inbound packet.

47
Q

How are rules looked up in the SPD?

A

Match can be based on
source and destination addresses
Transport layer protocol
Transport layer port numbers.

A match identifies SA or a group of SAs

48
Q

What is a limitation of IPSec?

A

Needs a lot of symmetric keys, one for each SA.

49
Q

What are the five steps of IPSec?

A

1) Host A send traffic to host B
2) Router A and B negotiate IKE phase one session (IKE SA to Ike SA)
3) Router A and B negotiate IKE Phase 2 sessions (IPSec SA to IPSec SA)
4) Information exchanged over tunnel
5) Terminate

50
Q

What security does IKE provide?

A 
Entity authentication of participants
Establishment  of fresh shared secret
Derivations of further keys
Secure negotiation of Algorithms.
DoS resistance
51
Q

What are the different tunnel modes?

A

VPN

PPTP/L2TP

52
Q

What is a VPN?

A

Creates secure IP Tunnel that encrypts IP messages with a private address structure

53
Q

What is PPTP?

A

Point-to-point tunneling, encrypts the whole message which hides the private IP addresses

54
Q

How do SSL and IPsec differ in what they can connect?

A

SSL connects applications streams

IPSec can connect remote networks and hosts

55
Q

What type of applications can IPSec and SSL connct?

A

IPSec can connect IP applications

SSL only used for browser or private gate, each of which are setup differently.

56
Q

Where is IPSec more secure than SSL?

A

IPSec can encrypt source and destination addresses, SSL cant.

57
Q

What are the drawbacks of IPSec?

A

May require OS support
Requires clients software
Tunnel mode creates visibility to a server’s network
Requires dedicated network layer connection, need extra resources.

CS4203: Computer Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions