Authentication and Privacy in IPv4 and IPv6

This paper describes the security mechanisms for IP version 4 (IPv4) and IP version 6 (IPv6) and the services that they provide. An overview of key management requirements for systems implementing those security mechanisms will also be discussed. There are two specific headers that are used to provide security services in IPv4 and IPv6. These headers are the IP Authentication Header (AH) and the IP Encapsulating Security Payload (ESP) header. The Authentication Header provides support for data integrity and authentication of IP packets as well as protection against replay attacks. The Encapsulating Security Payload header, like the Authentication Header, provides for data integrity, authentication, and replay protection but also provides for confidentiality through packet encryption. Depending on the application, both AH and ESP can be used to either protect either a transport layer segment or the entire IP packet (transport-mode versus tunnel-mode). Example applications of both the AH and the ESP will be discussed using the HMAC-MD5 algorithm to illustrate the AH and DES-CBC transform to illustrate the ESP. Descriptions will cover both AH and ESP used individually as well as in tandem. A key concept that appears in both the authentication and privacy mechanisms for IP is the security association. This security association is uniquely identified by the internet destination address, the security protocol and a Security Parameter Index (SPI). The SPI is enclosed in both the AH and the ESP header and is the method by which a key management mechanism is linked to the authentication and privacy mechanisms. This loose coupling of key management systems allows for the use of existing systems while allowing for the development of future key systems without modification of the security mechanisms. Current key management systems mandated by the Internet Engineering Task Force (IETF) draft standards include manual management as well as the ISAKMP/OAKLEY key management and exchange protocol. Note that many of the concepts described here have yet to be standardized and are to be considered as work in progress. Much of the available information upon which this paper is based is drawn from Internet Draft documents which are working documents of the IETF.