Hot answers tagged ipsec
18
The cryptography involved in the VPN is designed precisely to keep your data safe even in the situation of an attacker who can intercept all traffic; the best an attacker could do in that situation is to disrupt traffic (namely, cutting off the wires).
Both SSL, and IPsec-with-IKE, use cryptography in proper ways, so there should be no qualitative ...
15
VPN means "Virtual Private Network". It is a generic concept which designates a part of a bigger network (e.g. the Internet at large) which is logically isolated from the bigger network through non-hardware means (that's what "virtual" means): it is not that we are using distinct cables and switches; rather, isolation is performed through use of ...
11
IPsec is actually a family of protocols, it has several sub-protocols that could be used or not used, and the overall security depends on each of these in turn and how they're configured:
IKE for protocol negotiation and key management
AH for authentication, integrity and I think some protocol protection
ESP for encryption and then some.
Advantages:
...
10
I think the biggest impacts will be on the public relations side.
On the plus side (from OpenBSD maintainers point of view), the idea that the FBI deemed OpenBSD important enough, back in 2000, to warrant money-backed insertion of backdoors, is a sure ego inflater. This alone could be a motive for public allegations of backdoors, whether they exist or not. ...
9
Both have security issues if not configured correctly. But first lets start with some definitions:
Cisco have a good definition of a VPN:
VPN can take several forms. A VPN can be between two end systems, or it can be between two or more networks. A VPN can be built using tunnels or encryption (at essentially any layer of the protocol stack), or both, or ...
8
L2TP/IPSEC wraps a simulated data link layer in IPSEC. Plain IPSEC just encrypts the network layer. If you want hosts to think they're on the same LAN, use L2TP/IPSEC; if you'd rather skip the extra bandwidth and processing overhead, use IPSEC.
7
The data bits which flow one machine to the other must travel in some way, over wires, optic fiber, radio waves or some other medium. At any point, information can be eavesdropped.
The very low-grade attackers will eavesdrop where it is easiest, i.e. close to either end. This is made easy with many WiFi hotspots; it can also be done with wired Ethernet by ...
6
802.1x-2010 will provide authentication to the network switch and encrypt traffic exchanged. Older 802.1x specifications do not encrypt traffic.
IPsec can be a useful solution or layer on top of older 802.1x, but the increase in configuration work to allow only desired clients may be notable.
6
As I noted in comment, this is a very broad question. There are a wide variety of potential ramifications. One thing is clear though: Theo just got himself a whole bunch of free code reviews ;-).
Maybe the FBI did manage to get a backdoor into the 2001-era openbsd IPSec code. If they did, it means that there have been VPNs that US law enforcement could ...
6
I think it's referring to "hub" as the center of a hub-and-spoke VPN architecture, as shown in this diagram.
Later on in the document you linked to, it says:
Dynamic—Dynamic crypto maps can only be used in a hub-and-spoke VPN
topology. Dynamic crypto map policies allow remote peers to exchange
IPsec traffic with a local hub, even if the hub does not ...
5
DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" ...
5
Are you looking at these options to create a secure VPN? SSL is generally easier to deploy and better supported for a desktop-to-network type of VPN, such as when an employee at home is connecting to the corporate network. If you're doing a more complex deployment, such as a network-to-network encrypted VPN (e.g., between two different organizations), then ...
5
To protect packet destinations, you need to abstract the network layer entirely - which usually means some form of encrypted VPN. This would mean no hardware on the local network would know what packets are being transmitted, where to or what they contain.
Unfortunately, this doesn't solve the real problem, just moves it upstream. Your VPN/encrypted link ...
5
The IP Authentication Header (AH) is used to provide connectionless
integrity and data origin authentication for IP datagrams (hereafter
referred to as just "authentication"), and to provide protection
against replays. This latter, optional service may be selected, by
the receiver, when a Security Association is established. (Although
the ...
5
It is not that the header has to be encrypted in tunnel mode; rather, if the header is not encrypted, it is not really a tunnel.
Tunnel mode is about having two routers linked together with an encrypted tunnel. They exchange packets for other hosts. Schematically, router A is the exit router for network netA, and router B is the exit router for network ...
5
Let's clear up some confusion here first. Internet Key Exchange (IKE) is a hybrid protocol, it consists of 3 "protocols"
ISAKMP: It's not a key exchange protocol per se, it's a framework on which key exchange protocols operate.
Oakley: Describes the "modes" of key exchange (e.g. perfect
forward secrecy for keys, identity protection, and authentication)
...
4
L2TP does not provide any confidentiality or authentication. A common setup is using L2TP along with IPSEC (see RFC 3193).
EDIT: L2TP does provide tunnel end-point authentication. It does not provide encryption and message authentication.
4
The answer to your question is easy: if anyone hid nasty code in privileged subsystems, the wrong people could have arbitrary control over systems running the code.
But note that no evidence has been presented (and Perry should have a lot of that), and he offers no apologies.
For more info see
an early overview: Deconstructing the OpenBSD IPsec Rumors ...
4
However what if a computer is connected via Ethernet and does not ask for an IP address? What can they skim off the network with a standard network card?
I think you're asking if it's possible, like it is on a wireless network, to connect to a wired network and sniff packets just like the likes of aircrack allow for promiscuous mode wireless traffic.
...
4
Source IPs - If you connect to a mail server you control, you can configure it to write fake source headers (does it really matter since you'll probably be using private network IP ranges for your senders machines?) - but the upstream mail server will see the real IP address for your immediate mail server. Whether or not it commits that information ...
3
Good question. I'm not 100% sure about the answer, and of course it also depends on many aspects specific to the configuration of your L2TP/IPsec solution.
On the face of it, it does seem very likely that if the 'shared secret' is exposed in such a way, it would allow an attacker at the very least mount an active man-in-the-middle attack against you or ...
3
Sure. There are probably a couple dozen internet-addressable routers between the two sites, all of which are essentially just computers. It's certainly not impossible to attack them and steal traffic.
In fact, I can see a number of attack vectors:
As stated above, attack any of the routers between the two sites.
Break into a router on either site (they ...
3
It's hard to tell for sure what they are doing, but they may be doing something as simple as cutting off any connection they don't understand that is leaving the country. If that's the case, then you would basically be out of luck.
If they are doing something more elaborate, it unfortunately wouldn't be possible to know what they are doing without a fair ...
2
IPsec provides two modes:
Authentication Header: each packet has an attached Message Authentication Code which guarantees its integrity; this also includes some protection against replay attacks (when the attacker sends copies of a previously exchanged packet).
Encapsulated Security Payload: each packet is encrypted (and also has a MAC); the encryption ...
2
The setup described in the document you cite is suitable for certificate-based authentication. The RSA tag in ipsec.secrets means exactly that the file moonKey.pem contains the RSA private key.
What you need to do to use Pre-Shared Keys (PSK):
in your ipsec.secrets you need a line with the PSK tag followed by the secret itself among quotes. Like this:
...
2
Well, the difference is kind of like the difference between a circle and a square (both are shapes, but differ greatly). They both secure communications, but do it at different levels and in different ways. IPSEC is wireline encryption and authorization whereas SSL is application-specific.
IPSEC has access control whereas SSL does not.
Can you be more ...
2
Some very good answers here, I won't repeat what was already said.
However, one point I found to be lacking - SSL is a lot easier to setup on an ad-hoc basis, especially if you don't have a requirement for client certificates.
IPsec, on the other hand, always requires client certificates (assuming a normal, typical setup), and there are also other ...
2
What business/organisation(s) would have:
Sufficient technical skill to evaluate technologies needed for safe,
secure web browsing
OWASP
The capacity to publicly recommend a set of technologies to achieve the same
not actually, still
CERT
as several nations have it
Does not have conflicting goals of Certificate Authorities nor other goals ...
2
In terms of your question, I don't think there is any one organisation. OWASP gives good detail on the ten obvious things you should get right, but that should be a bare minimum - because there are so many aspects of security, and different browsers, OS'es, plugins, ways to access the Internet etc I'd be surprised if any single organisation could do it.
I ...
Only top voted, non community-wiki answers of a minimum length are eligible
