Network & Internet Security

Question 1

IPSec Modes of Operation

Answer 1

Transport Mode-IPSec header protects rest of packet and maybe IP header
Tunnel Mode-IPSec header and new IP header protect original payload

Question 2

Security Associations

Answer 2

Contract between sender and receiver
Determines IP protocols, keys, etc.
One for inbound and outbound traffic
Hosts store their SAs in a SA database
Identified by SPI, IP of dest, AH or ESP

Question 3

Anti-Replay Mechanism

Answer 3

SN starts at 0 when new SA is negotiated
++SN when new packet sent
N is largest sequence number seen so far
Packets with SN between N-W+1 and N are accepted only once
Packets with SN <= N-W aren’t accepted at all

Question 4

Authentication Header

Answer 4

Transport Mode-Authenticated except for mutable fields
Tunnel Mode-Authenticated except for mutable fields in the new IP header
MAC computed over entire packet

Question 5

Encapsulation Security Protocol

Answer 5

Transport Mode-Orig IP hdr || ESP hdr || TCP || Data || ESP trlr || ESP auth (opt); auth ESP hdr-ESP trlr; encr TCP-ESP trlr
Tunnel Mode-New IP hdr || ESP hdr || Orig IP hdr || TCP || Data || ESP trlr || ESP auth (opt); auth ESP hdr-ESP trlr; encr Orig IP hdr-ESP trlr