Network Security Protocols - USALearning

Network Security ProtocolsTable of ContentsNetwork Security Protocols -1 . 2Network Security Protocols -2 . 3PPTP and L2F . 5IPSec and GRE . 6IPSec -1 . 8IPSec -2 . 10Telnet, SSH, and SSL/TLS . 13S-RPC and DNSSEC . 16Notices . 17Page 1 of 17

Network Security Protocols -1Network Security Protocols -1The original concept for the Internet had minimal security.Various protocols have been created over the years toaddress the notion of security.These protocols have been stacked into the OSI and TCP/IPmodel depending on what they protect and how they do it.147**147 Some network securityprotocols that we need to payattention to. So, remember, originallynone of this stuff needed to worryabout security. We said well we justwant to actually get it up andrunning. We have to look at thesesecurity protocols to help us protect.So, you've heard about the regularprotocols.Now let's make them secure.Page 2 of 17

Network Security Protocols -2Network Security Protocols -2Layer 1None, but physical security controls can be implemented and types ofcabling used can make a differenceLayer 2PPTP, Layer 2 Forwarding, Layer 2 Tunneling Protocol, wirelessnetwork security, MPLSLayer 3GRE, IPSecLayer 4SSL, TLS, WTLS, SSH, SOCKSLayer 5 Application dependent, S-RPC, DNSSEC, S-HTTP148**148 At layer one we really say none.What we say here is it's none, butreally what the answer is that we dophysical security protections. We doconduit, those kinds of things.Layer two we could use encryptionlike PPTP, or some sort of wirelessnetwork security. Now L2TP doesn'thave any security in it. But it is atunneling protocol that helps us. Andit supports IPsec.Or we could use MPLS. Now,standard MPLS is not a securityprotocol in and of itself. But it hassome authentication mechanisms in itthat we can use.Page 3 of 17

At layer three, general routeencapsulation or IPsec. We'll talkabout IPsec in more detail.In layer four, this is where everythingreally happens. We use SSL or TLS.Those are our primary two protocols.But we could use others.And at layer five, well we've got aweb protocol HTTP. And what we useis a lower level protocol to bolt on toit. Normally, it's HTTPS. But here isalso another protocol. There isanother. It is SHTTP. That is a realprotocol. It is a different protocolthan HTTPS on the other end,separate protocol.Page 4 of 17

PPTP and L2FPPTP and L2FPPTP – Point to point tunneling protocol PPTP PPP IP encapsulation for TCP/IP, IPX, and NetBEUINo encryption, but extended with RC4, PAP, CHAP, and EAPSingle-factor authentication; weak implementationNearly all Windows based; obsoleted by L2TP and IPSecL2F – Layer 2 forwarding Tunnels at, surprise, layer 2Not IP dependent, supports ATM and frame relayRelies on PPP for authentication (designed to tunnel PPP traffic)Used for VPNsNo encryption by itself149**149 Let's talk PPTP and layer twoforwarding. PPTP is relatively old atthis point. It encapsulated any kindof IP traffic. It didn't matter whatwas above it. And we used point topoint tunneling protocol along withpoint to point protocol tocommunicate. There wasn't anyencryption. But what we did is we didauthentication with point to pointtunneling protocol. And that workedpretty well for a long period of time.It's pretty much obsolete at thispoint.Now, specific to a particular vendor islayer two forwarding. Cisco came upwith this concept. It tunnels at layerPage 5 of 17

two. It even says two in the thing.But it's not used that often. It is usedfor VPNs, but not that often. I mean,we're going to live and die by IPsec.IPSec and GREIPSec and GREIPSec – Internet protocol security Encapsulates at Layer 3Mutual node authenticationCan authenticate users, but requires L2TPCrypto implementation agnosticClient-to-client, or node-to-node (bulk)Mandatory for IPv6 implementationDoes not work with NAT, unless NAT-Transversal (NAT-T) is usedGRE – Generic Route Encapsulation Encapsulates layer 3 packets in IP tunnelUsed to secure VPNsCreates a virtual point-to-point link with destinationSupports multicast protocols – IPSec doesn’t!150**150 Okay, here's IPsec. IPsec, itencapsulates layer three. So, is it alayer two protocol? Well, not it's kindof a shim protocol that fits inbetween layer two and layer three.It's above the IP address in mostcases unless we decide to abstractthe IP address. We'll get into that alittle bit later.We can use user authentication. Itcan use L2TP. That depends on thePage 6 of 17

implementation. Some Ciscoimplementations don't. And someMicrosoft implementations do. Checkyour local operating system for theconfiguration near you.It can be done client to client tothat's host to host. Or we can do itnetwork to network using routerconfigurations or remote accesshosts. And we'll get into those lateron.Now, it is mandatory for V6 in thatthere is a next header for it. But it'snot required that you have IPsec forIP6. You have the next headeroption. You can bolt it on. But it's notlike everything is encrypted for IPv6.Next is generic route encapsulation.And this encapsulates layer threepackets in an IP tunnel. It is used tosecure VPNs. It creates those virtualpoint to point links.One of the things that it does thatIPsec doesn't do is it supportsmulticast protocols. But what I willask you is is when you are doingmulticast protocols and encryption atthe same time? Usually, we do asingle point to point. Now, there area whole bunch of otherimplementations from vendors outthere that use combinations of IPsecand GRE and point to point and layertwo tunneling protocol. And you needto talk to those vendors.And one of the problems that we runinto is those vendor specific protocolswork really well if you're using all thePage 7 of 17

same gear. But when you startmixing and matching gear, thingskind of blow up in your face. So, beaware of that.IPSec -1IPSec -1Authentication Header (AH) – prove identity of source node(host) and provide integrity, through hashing packet data andpre-shared secret keyEncapsulating Security Payload (ESP) – encrypts packets,contains fields for header, payload, trailer (optional), andauthentication (optional)Security Association (SA) – describes protocols in use,algorithms, keys, and mode of operation; stored in SecurityAssociation Databases (SADs), one required for eachcommunication direction151**151 Let's talk a little more aboutIPsec. It has two major protocolswithin it, AH and ESP. AH isauthenticated header. And all thisgives us is integrity. There is noencryption here. But what we do iswe get integrity of the packet. Andthat's a nice thing if we need it as faras our communication is concerned.Most of the time, we don't turn onAH. But it's there if we need it.Page 8 of 17

What do we use most of the time?Well, we usually use ESP.Encapsulated security payload isencryption. That's really what wewant out of a good IPsec tunnel.That's really what we care about.Along with that, we have the abilityto configure. And the way weconfigure is in simplex connectionsthrough something called a securityassociation.So, let's talk about simplexconnections through securityassociations. I demand that we usethe strongest, most impossibleencryption that's ever possible. Andhe says, "I just need a little bit ofencryption here. That's all I reallycare about." So, when I talk to him,and I communicate to his network, Ijust use a little bit of encryption. Butwhen he talks to me, he uses a lot ofencryption.So, in security associations, we cancreate what are called simplexconnections. When you talk to meinbound, I require this. When I talkto you outbound, you require this.And I can change those. Now, whatthat did was that really messed witha lot of people when they were doingIPsec implementations. And it justdrove them just crazy.So, what ends up happening is thatwe end up saying let's all use really,really super-duper encryption, whichis not a bad thing, except for if he'sgot a really small enterprise overPage 9 of 17

there. And he can't afford all thatCPU utilization.IPSec -2IPSec -2Mode – transport or tunnel Transport – IP payload is protected (usually client to server) Tunnel – IP payload and header are protected (usually network tonetwork, like remote office to home office)Internet Key Exchange – negotiates key materials for SADs IKMP – Internet key management protocol; builds on ISAKMP andOakley implementations IPSP – IP Security Policy, establishes source, destination and typeof traffic that is permitted Phase 1 – end-point authenticate to each other using a pre-sharedsecret, public keys, or a “revised” public key method Phase 2 – establishes a Security Association and a tunnel to securethe rest of the key exchanges152**152 Now, there are two differentways that you can communicate viaIPsec, transport mode and tunnelmode. In transport mode, we gofrom host to host. Now, at this point,the payload is protected, but mysource IP address and your source IPaddress are known to ouradversaries. So, that might beinappropriate.What happens if you've got yournetwork, and I've got my network?And my host really can't figure outPage 10 of 17

how to do all this IPsec configurationstuff. But we want to have privacybetween us. So, what we'll say is allyour people can talk to your VPNconcentrator. And all my people willtalk to my VPN concentrator. Andthen from my network to yournetwork, we'll make sure that weencrypt all that traffic.What does the IP addressing schemelook like to the rest of the world? Mylive source IP address, your livesource IP address, and then thisencryption that goes around it.What about their IP address, andyour IP address back there? Itdoesn't know anything about it. Andthat's what's beautiful about tunnelmode. We can go from network tonetwork.Now, one thing is is what happenswhen we go from a single host onthe Internet to a VPN concentrator?Well, since there's one host involved,we only go transport mode. How youcan remember, its tunnel mode isfrom network to network is there'stwo Ns in tunnel. So, therefore, Nsand networks fit together.Now, we can go beyond thatconfiguration. And we can starttalking about the Internet keyexchange, what we call IKE, orInternet Key Management Protocol.And in this case, what we can do iswe can start playing with theconfigurations.Page 11 of 17

How far can we carry this? Well,what's amazing to me in Internet keyexchange is we can say I want torekey every X number of seconds.So, if an adversary is listening, andthey're working on the first key of ourcommunication, and they decryptthat one piece of our conversationthinking they can jump into ourstream, by then we've moved on to anew key. So, we can, in Internet keyexchange, rekey very often.We can also choose the type of keysthat we use for setting things up. Itcould be a pre-shared secret where Icall you up on the phone, and I saythe password is password. Or it couldbe that we're in the same Kerberosrealm. And we can use Kerberostickets between us, which is in ourKerberos servers. That's if we are onthe same Kerberos realm. From oneMicrosoft Active Directory to anotheror to a UNIX Kerberos network, that'sbetween realms. And that won'twork.We could use something this isuniversal for us all. And that's publickey infrastructure. We could use PKIcertificates to exchange. And wecould set up those PKI keys and thengenerate keys from there. So, there'sall these configurations in IPsec tomake it so that we can make itsuper-uper crazy secure. And that'sreally what we want.Page 12 of 17