network protocols handbook.pdf

116Protocols GuideSecurity and VPN - Secured Routing ProtocolsProtocol NameIPsec ISAKMP: Internet SecurityAssociation and Key ManagementProtocolProtocol DescriptionISAKMP, a key protocol in the IPsec (Internet Security) architecture,combines the security concepts of authentication, keymanagement, and security associations to establish the requiredsecurity for government, commercial, and private communicationson the Internet.The Internet Security Association and Key Management Protocol(ISAKMP) defines procedures and packet formats to establish,negotiate, modify and delete Security Associations (SAs).SAs contain all the information required for execution of variousnetwork security services, such as the IP layer services (suchas header authentication and payload encapsulation), transportor application layer services, or self-protection of negotiationtraffic. ISAKMP defines payloads for exchanging key generationand authentication data. These formats provide a consistentframework for transferring key and authentication data independentof the key generation technique, encryption algorithm andauthentication mechanism.ISAKMP is distinct from key exchange protocols in order tocleanly separate the details of security association management(and key management) from the details of key exchange.There may be many different key exchange protocols, each withdifferent security properties. However, a common framework isrequired for agreeing to the format of SA attributes, and for negotiating,modifying, and deleting SAs. ISAKMP serves as thiscommon framework.Separating the functionality into three parts adds complexity tothe security analysis of a complete ISAKMP implementation.However, the separation is critical for interoperability betweensystems with differing security requirements, and should alsosimplify the analysis of further evolution of an ISAKMP server.ISAKMP is intended to support the negotiation of SAs for securityprotocols at all layers of the network stack (e.g., IPSEC,TLS, TLSP, OSPF, etc.). By centralizing the management of thesecurity associations, ISAKMP reduces the amount of duplicatedfunctionality within each security protocol. ISAKMP can alsoreduce connection setup time, by negotiating a whole stack ofservices at once.Within ISAKMP, a Domain of Interpretation (DOI) is used to grouprelated protocols using ISAKMP to negotiate security associations.Security protocols sharing a DOI choose security protocoland cryptographic transforms from a common namespace andshare key exchange protocol identifiers. They also share a commoninterpretation of DOI-specific payload data content, includingthe Security Association and Identification payloads.Overall, ISAKMP places requirements on a DOI definition to definethe following:• Naming scheme for DOI-specific protocol identifiers• Interpretation for the Situation field• Set of applicable security policies• Syntax for DOI-specific SA Attributes (Phase II)• Syntax for DOI-specific payload contents• Additional Key Exchange types, if needed• Additional Notification Message types, if neededProtocol StructureNext Payload8 12 16 24 32 bitMjVerInitiator CookieResponder CookieMn-VerMessage IDLengthExchangeTypeFlags• Initiator Cookie - The Initiator Cookie: Cookie of theentity that initiated SA establishment, SA notification,or SA deletion• Responder Cookie - The Responder Cookie: Cookieof the entity that is responding to an SA establishmentrequest, SA notification, or SA deletion.• Next Payload - The type of the next payload in themessage.• Major Version - The major version of the ISAKMPprotocol in use.• Minor Version - The minor version of the ISAKMPprotocol in use.• Exchange Type - The type of exchange being used• Flags - Various options that are set for the ISAKMPexchange.• Message ID - A Unique Message Identifier used toidentify protocol state during Phase 2 negotiations.• Length - Length of total message (header + payloads)in octets.Related protocolsIPsec, ESP, AH, DES, AES, IKE, DOI, HMAC, HMAC-MD5,HMAC-SHA, PKI, IP, IPv6, ICMPSponsor SourceISAKMP is defined by IETF (http://www.ietf.org) in RFC 2408.Referencehttp://www.javvin.com/protocol/rfc2408.pdfInternet Security Association and Key Management Protocol(ISAKMP)