VPN Tunnel Establishment
VPN tunnel is established in 2 parts.
Part-1 IKE: Establish encryption keys which is used to secure
data sent on VPN tunnel.
Phase-1: IKE SA(security association) establishment
Phase 2: IPSec/Child SA(security association) establishment
Part-2 IPSec Encrypt data & send in Tunnel or Transport mode.
+---------+ +---------+
| Client | | Gateway |
+---------+ +---------+
----- Phase 1 : IKE SA Establishment -----
---- Phase 2 : CHILD SA/IPsec SA Establishment----
----Encrypted User Traffic---
Phase1: IKE
IKEv1
Phase 1(IKEv1): IKE SA Establishment
This phase is used for IKE
SA(security association)
This is carried either in main mode or aggressive mode
| Main Mode | Aggressive Mode | |
|---|---|---|
| Number of messages | 6 | 3 (quicker than main mode) |
| Bandwidth Consumption | More | Less |
| Identification payloads | sent encrypted | sent unecrypted |
1. IKEv1(Main Mode)
1 SA ---------------------------->
2 <----------- SA
3 KeyExchange,Nonce ---------------------->
4 <----------- KeyExchange,Nonce
5 ID,AUTH ----------------------->
6 <----------- ID,AUTH
IKE SA established
GPH: Generic Payload Header
SAP: SA-Payload
PP: Proposal Payload
TP: Transform Payload
VP: Vendor Payload
KEP: Key exchange Payload (contains Public Key)
NoP: Nonce Payload
Re: Reserved,
NP: Next Payload,
PL: Payload Length
Peer-1 Peer-2
//1st 4 Messages are not Encrypted
//////(Message-1) Initiator proposes Encryption & Authentication algorithms(in 2 TP)//////////////////
--|MAC|IP|UDP|
IKE Hdr{Initiator SPI=e19218, Responder SPI=0, NP=SA, Version=1, Exchange-type=2, Flags=0, MessageID=0, Len=168}
GPH{NP=PP, Res=0, PL=60} + SAP{DOI: IPSec, Situation: 1}
GPH{NP=VP, Res=0, PL=48} + PP{Proposal-no: 1, Protocol-ID=ISAKMP, SPI-Size=0, Number-of-transforms=1}
GPH{NP=TP, Res=0, PL=40} + VP{Vendor-id=knasjnao912knka}
GPH{NP=TP, Res=0, PL=40} + TP{Transform-no: 1, Tranform-ID=KEY_IKE, Res=0,
encryption-Algo=AES-CBC, Key-Length=128, Hash-Algo=SHA2,
Authentication-Method=Pre-shared Key, Life-type=Seconds,
Life-Duration=86400}
GPH{NP=None, Res=0, PL=40} + TP{Transform-no: 2, Tranform-ID=KEY_IKE, Res=0,
encryption-Algo=3DES, Key-Length=128, Hash-Algo=SHA3,
Authentication-Method=Pre-shared Key, Life-type=Seconds,
Life-Duration=86400} ---------->
//////(Message-2) Responder accept the proposal(ie Encryption, Auth) in TP/////////////////////
<--|MAC|IP|UDP|
IKE Hdr {Initiator SPI=e19218, Responder SPI=a0089b, NP=SA, Ver=1, Exchange-type=2, Flags=0, MsgID=0, Len=108}
GPH{NP=PP, Res=0, PL=48} + SAP{DOI: IPSec, Situation: 1 (Identity Only:1, Secrecy:0, Integrity:0}}
GPH{NP=TP, Res=0, PL=48} + PP{Proposal-no: 1, Protocol-ID=ISAKMP, SPI-Size=0, Number-of-transforms=1}
GPH{NP=VP, Res=0, PL=40} + TP{Transform-no: 1, Tranform-ID=KEY_IKE, Res=0,
encryption-Algo=AES-CBC, Key-Length=128, Hash-Algo=SHA2,
Authentication-Method=Pre-shared Key, Life-type=Seconds,
Life-Duration=86400}
GPH{NP=None, Res=0, PL=20} + VP{Vendor-id=knasjnao912knka}
Peer-1: Calculates PUBLIC KEY
Random-no=r=3
Prime=p=13
Integer=q=6
Public-Key=qPow(r)modp=XX
////////(Message-3) Initiator starts DH Key Exchange Process. Send its Public-Key+Nonce(Random no)////////////////
Initiator can ask Responder to select Key exchange algo (DH, RSA other..)
--|MAC|IP|UDP|
IKE Hdr {Initiator SPI=e19218, Responder SPI=a0089b, NP=, Version=1, Exchange-type=2, Flags=0, MessageID=0, Len=284}
GPH{NP=NoP, Res=0, PL=132} + KEP{Public-Key = XX}
GPH{NP=None, Res=0, PL=24} + NoP{nonce(random no) = 3}
Peer-2: Calculates PUBLIC KEY
Random-no=r=10
Prime=p=13
Integer=q=6
Public-Key=qPow(r)modp=YY
//////////(Message-4) Responder responds with his Public-key/////////////////////////////
<--|MAC|IP|UDP|
IKE Hdr {Initiator SPI=e19218, Responder SPI=a0089b, NP=4, Version=1, Exchange-type=2, Flags=0, MsgID=0, Len=304}
GPH{NP=NoP, Res=0, PL=132} + KEP{Public-Key = YY}
GPH{NP=VP, Res=0, PL=24} + NoP{nonce(random no) = 10}
GPH{NP=NAT-D, Res=0, PL=20} + VP{nonce-data=faknjas19231ka}
GPH{NP=12, Res=0, PL=20} + natd-payload{hash-of-address-and-port=kskf1928398ajsdiahs}
Peer-1: Calculates PVT KEY Peer-2: Calculates PVT KEY
Now Both Communicates over Encrypted Channel
/////////(Message-5) Initiator sends responder its IKE identity to authenticate itself/////////
--|MAC|IP|UDP|
IKE Hdr {InitiatorSPI=e19218, ResponderSPI=a0089b, NP=Identification, Version=1, Exchange-type=2, Flags=1, MessageID=0, Len=108}
GPH{NP=HP, Res=0, PL=132} + Encrypted[Identification-Payload{...}]
GPH{NP=None, Res=0, PL=132} + Encrypted[HashPayload{...}]
/////////(Message-6) Responder sends its IKE identity to authenticate itself/////////
<--|MAC|IP|UDP|
IKE Hdr {InitiatorSPI=e19218, ResponderSPI=a0089b, NP=Identification, Version=1, Exchange-type=2, Flags=1, MessageID=0, Len=108}
GPH{NP=HP, Res=0, PL=132} + Encrypted[Identification-Payload{...}]
GPH{NP=None, Res=0, PL=132} + Encrypted[Hash-Payload{...}]
IKE SA Established [DH Key Pair] [Encryption Algo] [Hash Algo]
2. IKEv1 (Aggressive Mode)
Authentication is done using Pre-shared-keys or Certificates
Peer-1(Initiator) Peer-2(Responder)
--(Message-1)
a. Proposes Encryption,Auth Algos in Transform Payload(Same as Main Mode Message-1)
b. Starts DH Key Exchange Process, random no (Same as Main Mode Message-3)
c. Sends Identification,Hash payload //IKE Identity (Same as Main Mode Message-5) -->
Authenticated Peer-1
Calculates Public,Pvt Key //Same as Main Mode// Calculates Public,Pvt Key
<-- Message-2
a. Selected Encryption,Auth Algos in Transform Payload (Same as Main-mode Message-2)
b. Calculated Public Key (Same as Main-mode Message-4)
c. Identification,Hash payload //IKE Identity (Same as Main Mode Message-6) --
Authenticated Peer-2
--(Message-3) Encrypted[I confirms the exchange] --------------------------->
IKE SA Established for securing Phase-2 [DH Key Pair] [Encryption Algo] [Hash Algo]
IKEv1 Phase 2(IPSec SA)
1. Quick Mode
7 HASH,SA,Nonce ----------------->
8 <------------ HASH,SA,Nonce
9 HASH -------------------------->
IPsec SA established
Peer-1 Peer-2
//////Initiator proposes Encryption & Authentication algorithms(in 2 TP)///////
---Message-1------->
|MAC|IP|UDP|
IKE Hdr {Initiator SPI=e19218, Responder SPI=a0089b, Next payload=5, Version=1, <<<version=1(IKEV1)
Exchange-type=32(QuickMode), Flags=1, MessageID=0x12812, Len=156}
Encrypted-data(encrypted using keys exchanged in phase-1)
|- Generic Payload Header + hash_payload
|- Generic Payload Header + SA_payload
|- Generic Payload Header + Nonce_payload
|- Generic Payload Header + Identification_payload
<---Message-2
|MAC|IP|UDP|
IKE Hdr {Initiator SPI=e19218, Responder SPI=a0089b, Next payload=5, Version=1,
Exchange-type=32(QuickMode), Flags=1, MessageID=0x12812, Len=172} + Encrypted-data---
---Message-2
|MAC|IP|UDP|
IKE Hdr {Initiator SPI=e19218, Responder SPI=a0089b, Next payload=5, Version=1,
Exchange-type=32(QuickMode), Flags=1, MessageID=0x12812, Len=172} + Encrypted-data--->
IKEv2
Phase 1. IKE-SA-INIT (2 messages)
Keys exchanges in Phase-1 are used to encrypt Phase-2 keys
Peer1 Peer2
---IKE_SA_INIT (Unencrypted)--->
<-----IKE_SA_INIT(Unencrypted)--
SAP(SA Payload) //See above in IKEv1 Phase-1
PP(Proposal Payload) //See above in IKEv1 Phase-1
TP(Transform Payload) //See above in IKEv1 Phase-1
KEP(Key Exchange Payload) //See above in IKEv1 Phase-1
NP(Nouce Payload) //See above in IKEv1 Phase-1
Peer-1(Initiator) Peer-2(Responder)
//Message 1,2 are not encrypted
----|MAC|IP| //IKE_SA_INIT
Ikev2 Hdr(Initiator SPI|Responder SPI: sas|Next Payload)|SAP|PP|TP|KEP|NP--->
Peer-1 proposes Transform payloads(encryption, authentication Algo list, DH Group, Nounce).
TP-1:{AES, SHA-1, DH group=2}.
TP-2{3DES, MD5, DH Group=2}
//Peer-2 Selects one policy from list of policies.
Selected <-----|SAP|TP|KEP|NP|--//IKE_SA_INIT
SKEYSEED generated SKEYSEED generated
From SKEYSEED Encryption, Authentication Keys are generated
IKE SA Keys Generated
Phase 2. IKE-AUTH / Child SA(2 messages)
Keys exchanges in Phase-1 are used to encrypt actual data traffic
Peer1 Peer2
------------ IKE_AUTH ------->
<------------ IKE_AUTH -------
Peer-1(Initiator) Peer-2(Responder)
//IDENTIFICATION, AUTHENTICATION Payloads, Security Association are encrypted.
---|MAC hdr|IP Hdr|Ikev2 Hdr|
SA Payload|IDENTIFICATION payload|AUTHENTICATION payload|
Security Association | Traffic Selector: Initiator, Responder |-->
|- IDENTIFICATION Payload: Contains MAC of Data+Key |
|- AUTHENTICATION Payload : Initiator: CERT or PSK, Responder: Send PSK or Certificate|
Authentication(Certificate is Authenticated), Identification(MAC is calculated & compared)
<--------Same are Message-3-------------
Phase2: IPSec
Its used for encrypting the data using keys established in Phase1.
Set of open standards for ensuring secure private communication over
Internet. IPSec does not support broadcast & multicast. Works over TCP
Modes in IPsec
1. Tunnel Mode
New IP Header provided. For Firewall-to-Firewall Delivery.
Consumes more CPU power. IP, TCP, App Protected.
|------- Encrypted -----------|
| New IP Hdr | ESP/AH | Old IP Hdr | TCP Hdr | App Hdr |
2. Transport Mode
Host-to-Host Delivery. TCP & Application Protected.
|-- Encrypted -------|
| IP Hdr | ESP/AH(protocol=ESP or AH) | TCP/UDP Hdr | App Hdr |
IPSec Packet Headers
| AH | ESP | |
|---|---|---|
| Integrity check | yes | yes |
| Encryption Support | no | yes |
| IPv6 Support | no | yes |
Authentication Header / AH
Provides: Authentication & Integrity Does not provide Encryption
|IP Header | Authentication_Header | TCP/UDP/IDMP | Application
| |
----------- ----------------------------------------------------------------------------------
| |
| Next Hdr(1 byte) | AH Len(4 byte) | Reserved | SPI(4 byte) | Seq No(4 byte) | ICV/HMAC/Authentication Data(variable) |
Next Header: IP
Payload Length: length of the Authentication Header
Security Parameters Index (SPI): This is connection identifier. Receiver
will search this SPI in SPD and find matching SA.
Sequence Number:
- Seq no of all the packets sent on an SA. Every packet gets a unique
sqe no, even retransmissions. This detects reply attacks.
-If all 232 are exhausted, a new SA must be established to continue
communication.
ICV(Integrated check value)/Authentication Data:
This is HMAC(keyed Hash) calculated on complete packet
(|AH|Original-IP-Hdr|TCP|Application|)
How ICV is calculated? TTL is not included in ICV since it changes at
every router.
Shared key(k1) is established during ISAKMP phase.
\/ k1
Magic No1 > |XOR| > aaa
\/ k1
Magic No2 > |XOR| > bbb
|AH|Original-IP-Hdr|TCP|APP| + aaa > |HASH| > ccc
ccc + aaa > |HASH| > ICV
ESP(Encapsulating Security Payload)
Provides: Encryption, Integrity, Authentication: With ESP Header & Trailer, Authentication Data Tailor is also added to message.
|New IP | ESP Hdr | Old IP | TCP | App | ESP Trailor | Auth Data/ICV |
| | | |
-- - - -------------
| | | |
| SPI | Seq no | |Padding | Pad Len | Next Hdr |
1. SPI: same as in AH
2. Seq No: same as in AH
3. Next Hdr: same as AH
4. ICV: Same as AH But does not included in Header of Trailer but comes
after trailer.
Why ICV is placed at end?
- Advantage in a hardware implementation: HMAC can be calculated as the
bits are going out over the network interface and appended to the end.
This is why Ethernet and other LANs have their CRCs in a trailer, rather
than in a header.
- With AH, the packet has to be buffered and the signature computed
before the packet can be sent, potentially reducing the number of
packets/sec that can be sent.