One of my friends is going to implement IPv6 in his university network environment and he told me it is more secure than IPv4. Is IPv6 more secure than IPv4? If so, how is it achieved on the protocol level?
Adding to what Chemical Engineer said, IPv6 does have other advantages too, such as:
Native support for end-to-end encryption: This was a feature that was added much later to IPv4, but comes as a standard for IPv6.
Secure neighbor discovery: The improved protocol (SEND) for neighbor discovery in IPv6 actually confirms the identity of the other party during host discovery, using a cryptographic method.
Larger address space: More time needed to bruteforce through addresses (3.4 × 1038 vs the older 4.3 × 109)
But as in most cases, misconfiguration will only make you more vulnerable.
Scott Hogg wrote a brilliant article a while ago here. It covers these points in much greater detail.
Summary: As currently implemented IPv6 networks might actually be less secure than IPv4. This is not because of the design IPv6 but because of inadequate support in firewalls and because network administrators and security specialist have more knowledge dealing with IPv4 than with IPv6.
It is true that IPv6 was designed with more security in mind. Unfortunately most of the good stuff like builtin IPSec was left out as optional which means that today's IPv6 connection are not better protected than IPv4.
Even worse is that many security products are not fully aware of IPv6 yet. Thus it is not uncommon that OpenVPN and other VPN installations only tunnel the IPv4 traffic but not the IPv6 traffic which obviously is a security problem. Also there are still firewalls which have none or limited support for IPv6 or have no optimizations for IPv6 and thus get slow with IPv6 traffic. Also, IPv6 networks behave slightly different than IPv4 networks (autoconfiguration, multiple IPv6 addresses on the same device...) which means that the existing IPv4 knowledge of network administrators and security professionals cannot be simply applied to IPv6. And then there is the different on-the-wire representation of IPv6 which features a fixed sized main header but then many stacked optional headers which represents a different set of challenges to deal with in firewalls than IPv4. And there are more differences which might cause unexpected behavior and thus security problems.
This together definitly does not make IPv6 more safe than IPv4 in practical use. In fact one might say that IPv6 is less secure in today's reality even though it was designed to be more secure. See also the many talks about this topic from conferences like Black Hat with topics like Evasion of High-End IPS Devices in the Age of IPv6 or Attacking IPv6 Implementation Using Fragmentation.
When IPv4 was designed, security was (intentionally, according to some participants) left out of the design; no encryption, no authentication, no identity verification.
IPv6 was an attempt to right the wrongs of IPv4, and this included the woeful lack of security. Features like encryption and strong identity were built into the protocol. But the design was slightly derailed by the design process (again, intentionally according to some) such that the security protocols are generally optional and often too complex to be usable.
So for the most part, the security of a well-run IPv4 network is roughly the same as that of a well-run IPv6 network. IPv6 in its typical form isn't inherently safer that IPv4 in its typical form.
There's a definite "security by obscurity" advantage in IPv6, though. Malware typically spreads over IPv4, and malware that scans the network for vulnerable targets uses IPv4 almost exclusively.
There's also the frequently-mentioned fact that picking random IPs in IPv6 space nearly always turns up unused addresses, but that's not a particularly strong protection. Choosing targets in IPv6 space won't happen by random selection or sequential scans. There are other ways to discover addresses.
IPsec is known as internet security protocol architecture. This is mandatory in IPv6 and not a mandatory one in IPv4. Most of the IPv4 systems do not implement this IPsec unless they use VPN. Based on IPsec implementation, we probably say IPv6 is secured more than IPv4.
Basically, IPsec makes IPv6 secure than IPv4
What is IPsec? IPsec is used to protect an IP path between a pair of end-end system
IPSec is used to provide the following features
- Replay detection
- Access control
IPsec has two protocols with two modes
- IP Authentication Headers - Which is used to provide authentication and integrity mainly.
- IP Encapsulating security payload - which is used to provide confidentiality.
- Transport mode - the security mechanisms of the protocol is applied only to the upper layer data
- Tunnel mode - both the upper layer protocol data and the IP header of the IP packet are protected or “tunneled” through encapsulation.
When IPsec is mandatory then the authentication, integrity, confidentiality and other security features are preserved so IPv6 generally secures than IPv4.
There are other two factors are adds security further in IPv6
- Anycast address that is used to identify a set of interfaces and a packet is sent to anyone interface of the set.
The default behaviour of the IPv6 is routed to the nearest interface having that address but we can implement source selected policies to enforce security
- Subnet scanning difficulty Subnet mask is 64 bits which is IPv6 subnet addresses (2^64 = 18,446,744,073,709,551,616). So the Difficulty of an attacker scans this address space is higher than the IPv4 address space.
The above factors look like IPv6 more secures than IPv4. yeah, it's true if we have a well-trained network administrative. When we have network administrative without prior knowledge about IPv6 then the situation is worse than IPv4.
For example, We might expose our mac address to the real world if the network admins are not careful enough to use IPv6. Revealing the original MAC address of a device is allowing the attacker to do IP spoofing. Other worst scenarios also illustrate in other answers.