One of the problems of the originators of the Internet not putting security into anything is that by
the end of the 1990s everybody was making their own security.
So if you had web pages you were doing SSL or less if you were trying to make a remote connection you'd
be using things like S-sh instead of telnet.
Everybody was doing their own thing when it came to security on a TZP IP network.
And by the late 90s there was a thought that you know this might not be the best way to do it.
What if instead of having all these different applications and things like that doing their own security
what if we could come up with a type of IP security that worked on a host to host basis where literally
every single computer on the Internet had its own security and when you would make a connection that
point to point security would take care of everything and that is known generically as Sec.
Now it is not one thing Essec is actually a bunch of protocols that work together that come up with
this idea that we could have any to host create a secure connection.
Now if Essec was totally rolled out it would be a pretty cool thing.
We could theoretically get rid of HDTV.
We could get rid of S-sh we could get rid of encrypted email because everything would be point to point
encrypted.
The reality is that didn't happen.
However if SEC is a very cool protocol it is used all over the place and it's also a little complicated.
So in this episode what I want to do is take about a 5000 foot overview of that set.
Make sure you understand the base pieces of it.
Now if we're going to be making point to point connections obviously we're going to have to do a lot
of important stuff when it comes to security.
We're going to have to go through an authentication process.
We're going have to go through encryption and all that stuff.
Now I'm going to talk about that in a minute but once everything is going what do you want to do with
that data.
Well there's two things you can do.
Number one you can generate what are known as authentication headers or you can generate what's known
as encapsulating security payloads.
So it runs in two very different modes.
Let's go through both of those.
Here is some TCAP data I've got to TCAP Hetter here and then I've got some data.
Now I'm eventually going to put an IP address on this and send it out the door.
Now one of the encapsulation formats that we use with Essec is known as authentication Hetter.
The only thing this does is provides integrity.
So what we'll do is before we send this guy out we're going to do is we're going to go ahead and do
an integrity check on the actual data itself and then we're going to insert this little bit of authentication
header data.
So in essence what we've done here is we've just generated an H Mac.
So the important thing to remember about authentication header is that it only provides integrity.
Now the more popular one that we're going to see is the encapsulating security protocols so let's go
ahead and start with that exact same header that we had before.
Now this time what we're going to do is we're going to actually go to the process of encrypting this
guy so we'll use some time something like Des's or triple does or even A-S encryption.
And we're going to go ahead and create an encryption here and then we're going to put a header on there
and then that thing is now fully encrypted.
So epic works simply by encapsulating our data into an upset packet that works great.
However there are some issues here you'll notice in those examples we took the original IP address and
in essence kind of inserted some stuff in there and that's fine.
And if I were the overlord godhead of the universe that I made everybody use the exact same IP protocols
and I got rid of that and I got rid of all kinds of problems this would be a great thing.
However we live in a world where there is Nat and there's IPV for an IP D6 and all of these issues where
we can't simply take an existing IP address and that can be a problem.
Now what I just showed you is one of two different ways that we could run Essec so and they're actually
two separate protocols so when we're talking about keeping the original IP address we call that transport
mode transport mode would work great if everybody had the exact same IP for range or IP B-6 range.
If we got rid of net a bunch of other things but transport mode in the real world doesn't work very
well.
So what we do instead is we use tunnel mode.
Let me show you how that works.
Let's take a look at that authentication head or we did earlier.
Now normally what we're going to do is just run an H Mac on all of this value and then insert that into
the H header.
Now the problem here is that we're still using the original IP address and in a lot of places that's
simply not going to work.
So what we use is what we call is Tunnel mode.
So this right now is transport.
We still have the original IP Hetter.
But what we can do is get rid of that and then add a new IP address to it.
And by adding a new different IP address then we could actually run this in transport mode.
Now you have to be careful.
This would drive the poor system crazy because remember you're doing an H Mac on this entire value including
the original IP.
And if you were to change it that would be a problem.
So we don't actually do tunnel mode with age by itself.
Instead what will tend to do is we use that with ESPN.
So let's take a look at that original S P packet that we had before.
So we got our encrypted data that we have are authenticated data.
But in this case what we're going to be doing is the original IP header is encrypted and then we add
a new IP header to the outside of this.
So the bottom line is in today's upset world most people are going to be running in tunneling mode and
they're going to be doing a whole lot of ESPN now to get all this role.
You've got these two hosts so you've got an entire security aspect that you've got to deal with now
in the OPSEC world.
They use something called isip KMP Internet security agreement key management protocol.
I said KMP his only job is to create what we call a security agreement between two host.
So if two hosts want to start talking IPs SEC the first thing they're going to do is begin this negotiation
protocol using ISI KMP So I see KMP is going to handle all kinds of stuff like for example initial authentication
so it can use certificates it can use pre-shared keys it can use just about anything you want to start
that initial negotiation between the two.
It will set up the exchange.
It'll set up the type of schäfer h Mac that handles all of this through the negotiation process.
So I said KMP is the cornerstone of what gets all the security rocket and Roeland in order for to upset
hosta talk to each other and in a nice secure way.
So this can be pretty challenging to configure and as a result we don't see it being used in the way
that a lot of people thought it might be used.
But I would like to take a minute and talk about where we actually see upset in today's world and let's
start with the paeans
the tunneling aspect of it CEQ makes it a natural for VPN.
So we see a lot of the peahens that use it.
Second there's really two different ways that you'll see it Seck used in the paeans first would be a
real honest to Pete traditional OPSEC pure VPN.
In that case it's only running seconds using tunneling mode and you make these two connections between
two hosts.
And it works ok.
However that's really not the more common way to do it.
The more common and somewhat older way to do it is running it upset with the L2 T-P protocol.
In this scenario what will happen is L2 T.P. generates an initial tunnel and it set goes ahead and it
puts a total within the tunnel so it's got a lot more security to it but it works really well and that
is if you're going to be setting up a VPN with it it's probably going to be upset with L2 t.p.
Now the other place we're going to be seen upset used a lot is with radius and to Cacace
if you had some set up using Triple A radius or to Cacace in these situations you don't really have
a native encryption built into it.
So a lot of these folks will go ahead and use SFC to create an essence of VPN tunnel between the two
hosts so that they can communicate securely.
So you're not going to see this too much outside of say a enterprise level wireless network or if you
got a bunch of Cisco boxes that all have to talk to each other it is currently uncommon but it is out
there.
Now the other thing I want to talk about and one that bugs me a little bit is upset with IPV six
when IP B-6 first came out one of the big pushes was that if SEC is mandatory and built into IPV 6 which
we all thought was going to be so cool because we'd have to get rid of all of our secure web sites in
securing mail because it was going to take care of everything with IP B-6.
That's actually not accurate.
Now within the RF CS There was mention that if SEC would be required.
The reality of this simply means that the SEC header information can be placed within an IP V-6 header.
That's it.
So there's nothing about IP V-6 that makes it work perfectly with it.
In fact it works perfectly with Google IPV for just as well.
And by the way the powers of the internet dropped all that and no longer say that you must run chipset
with IP B-6 because to be honest with you I've never seen it.
All right.
Now there's one more place and you're going to see questions on the exam that kind of point to stuff
like that.
And that is using IPs SEC with non-secure protocols.
Remember that the whole idea behind it says is that we would no longer have to have secure applications
or it would be more optional because you'd have this layer 3 security and that is one aspect where it
can work pretty well.
For example let's say for some reason you absolutely have to have a telnet connection or something scary
like that.
Telnet wide open easy to read.
You could set up an SEC probably an app sec tunnel that would allow you to encrypt all of that telnet
information between the two hosts and saving you a lot of trouble so if you had an application that
absolutely had to have telnet you could do all kinds of stuff you could put in IPV six and add it second
all that stuff.
But the reality is you're probably just going to use S-sh.
If sex is an amazing tool it's been around for a while and we certainly see a lot of adoption to it
but unfortunately being the ultimate fix for all of our security problems is probably never going to
happen.