template.dvi

Size: px

Start display at page:

Download "template.dvi"

あいねかみいしづ
5 years ago
Views:

1 XIV

3 PW I D E P R O J E C T 14 FQDN 1 KINK KINK Kerberos Kerberos IPsec FQDN IKE IETF IPsec WG IKE kink/fqdn@realm Internet Key Exchange version 2IKEv2 FQDN IPsec IP Kerberos Kerberized Internet Nego- FQDN tiation KeysKINK KINK WG FQDN IP FQDN WIDE Project IPsec WG spmd 1 racoon2 libracoon racoon2 WIDE KINK IKEv2 2 racoon2 racoon2 BSD OS Linux IKEv2KINK Internet Key ExchangeIKEv1 FreeBSDNetBSDLinux 2.1 racoon2 3 spmd policy management daemon iked IKE damon kinkd KINK daemon 3 spmd spmd libracoon 2.2 racoon2 5 selector info policy info ipsec info sa info remote info selector info Security Policy DatabaseSPD selector selector FQDN IP policy info selector info selector info IPsec policy info remote info ipsec info ipsec info IPsec SA IPsec SA IPsec SA sa info I 14

4 racoon2 W I D E P R O J E C T a n n u a l r e p o r t sa info IPsec SA Authentication HeaderAH IP Encapsulation PayloadESP IPsec protocol SPI remote info racoon2 IP FQDN 2.2 racoon spmd SADB ACQUIRE IPsec SA FQDN 2.3 FQDN spmd spmd FQDN 2.2. IP racoon FQDN racoon2 SADB ACQUIRE IPsec SA SADB ACQUIRE FQDN spmd 2.4 spmd spmdsecurity Policy Management Daemon racoon2 2 1 racoon2 libracoon API IPsec 1 FQDN DNS proxy FQDN DNS proxy 2.5 iked iked racoon2 IKEInternet Key Exchange Unix IKEISAKMPIPsec DOI IKEv2 libracoon PF KEY RFC2367KAME/USAGI IKEv2 IKE IKE SA INITIKE AUTH 4 IPsec SA IKEv2 IKE SA INIT 2 SAIKE SA Diffie-Hellman 228

5 PW I D E P R O J E C T IKE SA IKE SA IPsec SA Initiator Responder 3 IKE SA INIT(request) IKE SA INIT(response) IKE AUTH(request) 3.1 spmd IKE AUTH(response) libracoon API UDP DNS proxy 2.6 kinkd FQDN IP kinkd racoon2 KINK libracoon API libracoon KINK spmd racoon2 IPsec IPsec IKE DOI IPsec FQDN /etc/nsswitch.conf OS KINK /etc/hosts Kerberos two-way responder initiator 3-way KINK ISAKMP kinkd KINK ISAKMP Security Association Payload Proposal Payload Transform Payload Identification Payload Nonce Payload Notification Payload Delete Payload FQDN DNS DNS IPsec libracoon MY kinkd UNIX inet spmd IP FQDN IPsec spmif 3.2 iked iked libracoon/rcf read() 3. PF KEY libracoon/rcpfk init() 4. ISAKMP UDP 5. select(2) PF KEY SADB ACQUIRE I 14

6 14 W I D E P R O J E C T a n n u a l r e p o r t 1. IKE SA initiator 2. IKE SA CHILD SA initiator ISAKMP UDP 1. IKEv2 2. IKE SA 3. IKE SA 4. IKE SA responder IKE SA CHILD SA IKE SA initiator IKEV2 STATE IDLI initiator CHILD SA CHILD SA GETSPI DONE responder IKE SA INIT IKEV2 STATE INI IKE SA INIT SENT responder IKE SA INIT responder IKE AUTH IKEV2 STATE INI IKE AUTH SENT responder IKE AUTH IKEV2 STATE ESTABLISHED IKEV2 STATE DYI CHILD SA IKE SA responder IKE SA initiator IKE SA INIT IKEV2 STATE IDLI initiator IKE SA INIT IKEV2 STATE RES IKE SA INIT SENT initiator IKE AUTH initiator IKE AUTH IKEV2 STATE ESTABLISHED IKEV2 STATE DYI CHILD SA CHILD SA initiator IKEV2 CHILD STATE IDLI PF KEY SADB GETSPI IKEV2 CHILD STATE GETSPI PF KEY SADB GETSPI IKEV2 CHILD STATE GETSPI DONE IKE SA IDLI IKE SA ESTABLISHED CREATE CHILD SA IKEV2 CHILD STATE WAIT RESPONSE PF KEY SADB ACQUIRE IKEV2 CHILD STATE MATURE IKEV2 CHILD STATE EXPIRED CHILD SA responder IKEV2 CHILD STATE IDLI PF KEY SADB GETSPI 230

7 PW I D E P R O J E C T IKEV2 CHILD STATE GETSPI PF KEY SADB GETSPI IKE SA RES IKE SA INIT SENT IKE SA ESTABLISHED CREATE CHILD SA IKEV2 CHILD STATE MATURE IKEV2 CHILD STATE EXPIRED cookie secret ID = 0 IPCOMP SUPPORTED racoon2 racoon2 SA iked SADB EXPIRE proposal check obey selector check ID TS exact IKEv1 IKEv2 IKE(v1) IP IKEv2 IKEv2 CERTCERTREQ certificate x509 subjectid DER ASN1 DN HTTP CERT LOUP SUPPORTED ESP TFC PADDI NOT SUPPORTED NON FIRST FRAGMENTS ALSO DSSDigital Signature Standard ENCR AES CTR NAT traversal CONFIG EAP window minimum1 rekey informational exchange minimum DELETE peer polling NO ADDITIONAL SAS MobileIP 3.3 kinkd kinkd kinkd 3 KINK TGT Kerberos KDCKey Distribution Center TGTTicket-Granting Ticket KDC Kerberos KRB TGS REQ user-to-user KINK GETTGT SA CREATE SA DELETE I 14

8 14 W I D E P R O J E C T a n n u a l r e p o r t SA 3.1. TGT Kerberos Message flow KRB AS REQ KRB AS REP 3.2. Kerberos +KINK Message flow KRB TGS REQ KRB TGS REP GETTGT REPLY KRB TGS REQ KRB TGS REP CREATE REPLY (KRB AP ERR USER TO USER REQUIRED) GETTGT REPLY KRB TGS REQ KRB TGS REP 3.3. KINK Message flow CREATE REPLY CREATE REPLY ACK (i.e 3-way hand shake DELETE REPLY STATUS REPLY REPLY responder initiator KINK KRB ERROR 3.4. KINK KRB ERROR ERROR KRB AP ERR BAD INTEGRITY KRB AP ERR TKT EXPIRED KRB AP ERR SKEW KRB AP ERR NEY KRB AP ERR BADKEYVER 3.5. KINK ERROR ERROR KINK never KINK PROTOERR KINK INVDOI KINK INVMAJ KINK INVMIN KINK INTERR KINK BADQMVERS TKT EXPIRED ERR SKEW [kink page page 27)] responder ctime initiator ctime SAD kinkd kinkd 3.6. SAD PF KEYv2 message SADB GETSPI SADB UPDATE SADB ADD SADB DELETE SADB ACQUIRE SADB REGISTER SADB EXPIRE never ISAKMP kinkd ISAKMP []KINK optional 3.7. CREATE/REPLY-to-CREATE ISAKMP SA NonceNi NonceNr3-way [KE] [ID] [Notification] 3.8. DELETE/REPLY-to-DELETE ISAKMP Delete [Notification] 3.9. inprogress STATUS/REPLY-to-STATUS ISAKMP [Notification] 232

9 PW I D E P R O J E C T IPsec IPsec protocol AH ESP IPsec SA Mode of SA Transport Tunnel epoch change DPD [kink (page 10)] KINK ISAKMP [kink (page 21)] randomized rekeying time [kink (page 9)] replay protection (by Kerberos) DELETE grace timer Authentication Algorithm MD5 SHA libracoon racoon2 libracoon.a Encryption Algorithm DES 3DES AES-128 AES-192 AES libracoon kinkd racoon1 racoon2 libracoon libracoon libracoon SADB rcpfk rcf inprogress RCT inprogress spmd spmif plog wmbufrbuf inprogress libracoon SAD/SPD spmd rbuf libracoon RCT RCT RCT RCT BOOL OFF = 0 RCT BOOL ON = 1 RCT ADDR INET = 0x1000 RCT ADDR FQDN = 0x2000 RCT ADDR MACRO = 0x4000 RCT ADDR FILE = 0x I 14

10 14 W I D E P R O J E C T a n n u a l r e p o r t libracoon.txt SAD/SPD rcpfk libracoon SAD SPD API PF KEYv2 rcpfk cont API API sa srcsa dstsp src sp dst rcpfk cont rcf racoon2 libracoon API spmd spmif racoon2 spmd libracoon API spmd plog libracoon plog plog syslog() RC LOG INFO [INFO] RC LOG PROTO ERR [PROTO ERR] IKE KINK RC LOG PROTO WARN [PROTO WARN] RC LOG INTERNAL ERR [INTERNAL ERR] PF KEY system call PF KEY malloc DB RC LOG INTERNAL WARN [INTERNAL WARN] RC LOG DEBUG [DEBUG] RC LOG CRITICAL [CRITICAL] exit( 1) rbuf libracoon rbuf rbuf 2 1 free() 234

11 PW I D E P R O J E C T RCT ADDR FQDN libracoon racoon2 RCT ADDR MACRO RCT ADDR FILE MY UNIX port type == RCT ADDR INET a.ipaddr MY IP IP MY IPV6 IPv6 MY IPV6 GLOBAL MY IPV6 LINKLOCAL MY IPV4 IPv4 IP ANY :: IP ANY % libracoon IP FQDN rc addrlist rc addrlist struct rc addrlist { struct rc addrlist *next; rc type type; int port; int prefixlen; union { struct sockaddr *ipaddr; vchar t*vstr; } a; }; type RCT ADDR INET RCT ADDR INET a.ipaddr type a.vstr racoon2 IKEv2 KINK IKE racoon racoon2 racoon2 IPsec WG IPsec API racoon2 Glossary Authentication Header (AH) RFC I 14

12 14 W I D E P R O J E C T a n n u a l r e p o r t Internet Security Association and Key Management Protocol (ISAKMP) RFC2408 SA Internet Key Exchange version 2 (IKEv2) draft-ietf-ipsec-ikev2-xx.txt IKE IP Encapsulation Security Payload (ESP) RFC2406 IP Payload Compression Protocol (IPComp) Kerberos RFC1510 Key Distribution CenterKDC Kerberized Internet Negotiation of Keys (KINK) Kerberos ISAKMP IPsec DOI draft-ietf-kink-kink-xx.txt PF KEY Key management API, version2 (PF KEYv2PF KEY) RFC2367 socket SA BSD OS Linux SP Security Architecture for Internet Protocol (IPsec) RFC2401 IP Security Association (SA) Security Association Database (SAD) IPsec SA IP AHESP SA Security Policy (SP) Security Policy IP Security Policy Database (SPD) Security Policy The Internet IP Security Domain of Ineterpretation for ISAKMP (IPsec DOI) RFC2407 IPsec SA ISAKMP The Internet Key Exchange (IKEIKEv1) RFC2409 RFC2407RFC IPsec SA 236

IPsec 鍵交換アーキテクチャ racoon2 の開発 Title: IPsec 鍵交換アーキテクチャ racoon2 の開発 Authors(s): 神田充鎌田健一坂根昌一福本淳 (f

IPsec 鍵交換アーキテクチャ racoon2 の開発 Title: IPsec 鍵交換アーキテクチャ racoon2 の開発 Authors(s): 神田充 (mk@wide.ad.jp) 鎌田健一 (kamda@nanohz.org) 坂根昌一 (sakane@kame.net) 福本淳 (fukumoto@isl.rdc.toshiba.co.jp) 宮澤和紀 (kazunori@miyazawa.org)