IPsec

DH group number _ at ____ bits of key strength is the most compatible DH group number.

2, 1024

Encapsulating Security Payload is included in RFC ____, ____ et. al.

2460, 4303

Transport mode is used to secure any layer _ or above protocol set.

4

Authentication Header protocol was established with RFC ____.

4301

ESP is included in IP Protocol __

50

IKE runs on TCP Port ___

500

AH in included in IP Protocol __.

51

Tunnel mode is utilized for the creation of ___ connections.

VPN

PFS is more _____ but _____ establishing a connection

secure, slower

In cryptography, a _______ __________ is a one way set of security information used to facilitate a logical connection between nodes

security association

Without PFS, the IPsec SA ______ ___ is derived from the IKE phase 1 key

session key

AH ensures a packet is not _______ or _______.

spoofed, munged

Both nodes must agree on the _______ of interest

traffic

Perfect Forward Security (PFS) performs a new DH _________ to create the IPsec SA session key

transaction

An IPsec ________ defines the set of cryptographic tools used by IPsec

transform

PIX/ASA implementations of IPsec refer to crypto tools as _______ ____

transform sets

___ security associations are required for duplex communication.

two

The two modes of IPsec operation are __________ and ______

Transport, Tunnel

IPsec reduces the need for __________ layer security

Application

The two protocols utilized in IPsec are the ____________ _______ protocol, and the ____________ _______ _______.

Authentication Header, Encapsulating Security Payload

IPsec supports many block ciphers using ______ _____ _______ (CBC)

Cipher Block Chaining

Negotiated cryptographic key length is determined by __ _____ _____

DH group number

Transforms that can be performed in IPsec include ___/__, ______ with key, and ___ with key

ESP/AH, Cipher, MAC

T/F ESP is the equivalent of adding encryption to AH

F

T/F A security association is a two way set of security information used to facilitate a logical connection between nodes.

F (One way)

T/F IPsec security associations are usually manually configured

F (Rarely done, as it is less secure than automatic)

T/F Main mode protects the identities of peers during negotiation, but is inflexible in implementation

F (actually allows greater flexibility)

T/F IPsec does not require the communication endpoint to be the cryptographic endpoint.

F (comm endpoint must be cryptographic endpoint)

T/F IPsec does not support filtering

F (it does)

T/F All systems support all DH groups.

F (not all systems support all groups)

T/F ESP allows implementation of authentication and encryption, but neither have to be enabled when configuring IPsec.

F (one must be specified, otherwise why enable it to begin with)

T/F The authentication header can be used for encryption of network traffic.

F (only authentication)

T/F IPsec will filter all traffic across the network at all times.

F (some traffic is handled natively by IP/TCP/UDP, etc)

T/F Even when using Authentication Headers, the source address could be spoofed.

F (theoretically the source address cannot be spoofed)

Main or Aggressive Mode applies to ___ ____ _ negotiations

IKE phase 1

IKE is the _______ protocol used for IPsec

ISAKMP

IKE stands for

Internet Key Exchange

ISAKMP stands for

Internet Security Association Key management protocol

____ mode is preferred for maximum security in IKE phase 1 negotiations.

Main

ISAKMP dynamically creates __ and ______ keys

SA, exchange

The _______ ________ _____ is a unique 32 bit value identifying each individual data flow.

Security Parameter Index

T/F Aggressive mode is faster to negotiate than Main mode

T

T/F An IPsec transform defines the set of cryptographic tools and traffic used by IPsec

T

T/F Authentication Headers provide an anti-replay service with optional sequence numbers.

T

T/F Before two nodes can communicate securely, they must sort out their security associations

T

T/F Both nodes must agree on the path MTU.

T

T/F Both transport and tunnel mode can work with AH and ESP.

T

T/F IKE uses the Oakley Key Agreement Protocol for keying, which uses Diffie-Hellman Key-exchange algorithms.

T

T/F IPsec AH and ESP can be used simultaneously.

T

T/F IPsec can provide a layer of security to inherently insecure application layer protocols.

T

T/F In IKE phase 1 the nodes authenticate each other and establish a secure channel for phase 2

T

T/F In IKE phase 2 and IPsec security association is negotiated

T

T/F Transport mode can be used with virtually all application layer protocols

T

T/F Tunnel mode requires an entire IP packet to be encapsulated into the IPsec data field.

T

ESP provides for ___________ and/or _________

authentication, encryption

A Security Association contains cryptographic information, including __________, _________ information, and ___ information

authenticators, Encryption, MAC

AH provides authentication of the entire IPv4 _______

datagram

Authentication Headers doe not ______ data.

encrypt

Transport mode is used to protect standard application layer data during transmission across an _______ network.

insecure

IPsec security associations are configured automatically via a ___ _______ ______

key exchange protocol

IPsec runs at a ___ layer of the operating system

low

IKE phase 2 _________ the IPsec SA, then derives a key from the _____ _ key and assigns a unique ___ to identify traffic

negotiates, phase 1, SPI

IPsec adds security to the IPv4 or IPv6 ________ layer

network

IKE Phase 1 involves an authentication of the _____, a shared session ___ and finally an IKE __ with a secure channel for phase 2.

nodes, key, SA