P2L10 IPSec and TLS

Question 1

goals of ipsec

Answer 1

verify source of IP packets, integrity of packets, avoid replay of packets

Question 2

IPSec modes

Answer 2

1. transport mode (host to host) and 2. tunnel mode (gateway of one network to gateway of another network)

Question 3

Tunnel packets from gateway A to gateway B

Answer 3

packet is encapsulated in additional headers (source gateway address, destination gateway address, IPSec header)

Question 4

Security mechanisms of IPSec

Answer 4

Key Exchange Protocol, ESP (Encapsulating Security Payload), AH (Authentication Header)

Question 5

ESP

Answer 5

Encrypts and authenticates each packet (applied to payload). Authentication is applied to data in the IPSec header and packet payload (after encryption applied)

Question 6

ESP can provide both confidentiality and integrity protection

Answer 6

true

Question 7

If the authentication option of ESP is chosen, message integrity code is computed before encryption

Answer 7

false

Question 8

To protect the confidentiality and integrity of the whole original IP packet, we can use ESP with the authentication option in tunnel mode

Answer 8

true

Question 9

In AH, the integrity hash covers the IP header

Answer 9

true

Question 10

internet key exchange protocol

Answer 10

needed for IPSec, allows two parties to decide security policies for traffic between them and agree security parameters (algorithms for hashing), establishes shared keys between two parties

Question 11

SPI

Answer 11

used to look up SA in SADB, included in IPSEC header

Question 12

Outbound processing of packet

Answer 12

Question 13

Inbound processing of packet

Answer 13

Question 14

Anti-replay mechanism

Answer 14

Sequence number added to IPSEC header. Only used when AH is present.

A sequence scale is used. If packet contains sequence number below sequence window, it is rejected. If it contains sequence # above, the window is advanced. If # within window, it is checked to see if used before.

Question 15

IKE SA

Answer 15

Internet Key Exchange Security Association. It is bidirectional and used to define encryption and authentication of IKE traffic.

TWO PHASES:

1. Establish IKE SA
2. Use IKE SA to negotiate IPSec SAs

Question 16

IKE Phase 1 steps

Answer 16

1. negotiate protection suite, crypto algorithms
2. Establish shared secret (i.e. diffie helman)
3. authenticate the shared secret (eg pre shared key, digital signatures, public key encryption)

Question 17

More than two parties can participate in Diffie Hellman key exchange: true or false

Answer 17

true

Question 18

PFS

Answer 18

Perfect Forward Secrecy:

in IKE phase II keys are created based on the pre-shared key and new exchanged information. (new nonce values, new diffie hellman keys, etc)

Question 19

TLS session vs connection

Answer 19

Question 20

SSL Record Protocol

Answer 20

Question 21

In most applications of TLS, public keys are used for authentication and key exchange

Answer 21

True