Download PubTeX output 2000.01.12:1056

Protocols
ipsec(7P)
NAME
DESCRIPTION
Protection
Mechanisms
ipsec – Internet Protocol Security Architecture
The IP Security Architecture (IPsec) provides protection for IP datagrams. The
protection can include confidentiality, strong integrity of the data, partial
sequence integrity (replay protection), and data authentication. IPsec is
performed inside the IP processing, and it can be applied with or without the
knowledge of an Internet application.
IPsec provides two mechanisms for protecting data. The Authentication Header
(“AH”) provides strong integrity, replay protection, and data authentication.
AH protects as much of the IP datagram as it can. AH cannot protect fields that
change nondeterministically between sender and receiver.
The Encapsulating Security Payload (“ESP”) provides confidentiality over what
it encapsulates, as well as the services that AH provides, but only over that
which it encapsulates. ESP’s authentication services are optional, which allow
ESP and AH to be used together on the same datagram without redundancy.
Two types of algorithms are used for IPsec, authentication and encryption
algorithms.. Authentication algorithms produce an integrity checksum value or
"digest" based on the data and a key. The size of both the digest and the key are
described in authentication algorithm pages. See, for example, authmd5h(7M)
and authsha1(7M). Encryption algorithms encrypt data with a key. Encryption
algorithms operate on data in units of a "block size". The size of both the block
size and the key size are described in the encryption algorithm pages. See, for
example, encrdes(7M) and encr3des(7M).
Security Associations
Both AH and ESP use Security Associations (SAs), which are entities that specify
security properties from one host to another. Two communicating machines
need at least two SAs to communicate securely, unless they are using multicast,
and then they can use the same multicast SA. SAs are managed through the
pf_key(7P) interface. Automatic SA management is not yet available, but a
command-line front-end is available by means of ipseckey(1M). An IPsec SA
is identified by a tuple of <AH or ESP, destination IP address, and SPI>. The
Security Parameters Index (“SPI”) is an arbitrary 32-bit value that is transmitted
on the wire with an AH or ESP packet. See ipsecah(7P) or ipsecesp(7P) for
an explanation about where the SPI falls in a protected packet.
Protection Policy
and Enforcement
Mechanisms
Mechanism and policy are separate. The policy for applying IPsec can
be enforced in two places: on a system-wide level, or on a per-socket
level.Configuring systemwide policy is done by the command ipsecconf(1M).
Configuring per-socket policy will be discussed later in this section.
Systemwide IPsec policy is applied to incoming and outgoing datagrams. Some
additional rules can be applied to outgoing datagrams because of the additional
data known by the system. Inbound datagrams can either be accepted or
dropped. The decision to drop or accept an inbound datagram is based on
Last modified 10 Nov 1999
SunOS 5.8
239