Cyberstudy
PDF p.146 In progress

Internet Protocol Security Tunneling

Open PDF at p.146 17 flashcards

Summary

PDF p.146

Internet Protocol Security (IPsec) operates at the network layer (layer 3) of the OSI model, providing secure communication without the need for specific application support. IPsec uses two core protocols, Authentication Header (AH) and Encapsulating Security Payload (ESP), and can operate in transport or tunnel mode.

In plain words

Supplementary — not from your PDF

IPsec secures traffic at layer 3, so applications don't need to support it. AH (Authentication Header) provides integrity and authentication for the whole packet, including the IP header, but no encryption. ESP (Encapsulating Security Payload) adds encryption. Transport mode protects the payload between hosts; tunnel mode wraps the whole original packet in a new IP header, which is what site-to-site VPNs use.

Detailed explanation

PDF p.146
  • IPsec Overview
    • Layer: Network layer (layer 3) of the OSI model.
    • Implementation: Does not require specific application support.
    • Packet Overhead: Less than application-level security protocols.
  • Core Protocols
    • Authentication Header (AH)
      • Function: Performs a cryptographic hash on the whole packet (including IP header) plus a shared secret key.
      • Integrity Check Value (ICV): Added to the header to confirm packet integrity.
      • Confidentiality: Does not encrypt the payload.
    • Encapsulating Security Payload (ESP)
      • Function: Encrypts the packet and attaches a header, trailer, and ICV.
      • ICV Calculation: Excludes the IP header.
      • Confidentiality: Provides encryption for the payload.
  • IPsec Modes
    • Transport Mode
      • Use Case: Secures communications between hosts on a private network.
      • ESP: Encrypts only the payload data, not the IP header.
      • AH: Provides integrity for the IP header.
    • Tunnel Mode
      • Use Case: Secures communications between VPN sites across an unsecure network.
      • ESP: Encrypts the whole IP packet (header and payload) and encapsulates it with a new IP header.
      • AH: Not typically used in tunnel mode due to the need for confidentiality.

Important terms

taken from the text above
Layer
Network layer (layer 3) of the OSI model.
Packet Overhead
Less than application-level security protocols.
Integrity Check Value (ICV)
Added to the header to confirm packet integrity.
Confidentiality
Does not encrypt the payload.
ICV Calculation
Excludes the IP header.
ESP
Encrypts only the payload data, not the IP header.
AH
Provides integrity for the IP header.
AH Authentication Header ESP Encapsulating Security Payload ICV Integrity Check Value

Examples & real-world scenarios

Supplementary — not from your PDF
  • ESP in tunnel mode between two office gateways.
  • Transport mode protecting traffic between two internal servers.
  • AH used where integrity matters but confidentiality isn't needed.

Scenario

A site-to-site link must hide internal addressing and content from the ISP. ESP in tunnel mode encrypts the entire original packet, including its internal IP header.

Common mistakes

Supplementary — not from your PDF
  • Thinking AH encrypts data. It provides integrity only.
  • Mixing up transport mode (payload only) and tunnel mode (whole packet, new header).

Practical skills

Supplementary — not from your PDF
  • Pick AH or ESP and transport or tunnel mode for a requirement.

What I should remember

Key Points PDF p.146
  • IPsec Overview
    • Layer: Network layer (layer 3).
    • Implementation: No specific application support needed.
    • Packet Overhead: Reduced.
  • Core Protocols
    • AH: Cryptographic hash, ICV, no payload encryption.
    • ESP: Encryption, header, trailer, ICV, excludes IP header.
  • IPsec Modes
    • Transport Mode: Host-to-host, payload encryption (ESP), IP header integrity (AH).
    • Tunnel Mode: VPN sites, full packet encryption (ESP), new IP header, AH not used.