Question

(15 pts) Distinguish between (a) AH and ESP in IPSec (b) Transport mode and Tunnel mode in IPSec and (c) SSL and TLS

Answer 1

Answer a): AH header in IPSec protocol provides a mechanism for authentication only, data integrity, data origin authentication, and an optional replay protection service. Data integrity is ensured by using a message digest that is generated by an algorithm HMAC-MD5 or HMAC-SHA. Data origin authentication is ensured by the shared secret key to create the message digest. Replay protection is provided by using a sequence number field in the AH header. AH authenticates IP headers with the exception of certain header fields that can be changed in transit, as the Time To Live (TTL) field.

ESP header in IPSec protocol provides data confidentiality using encryption algorithm and authentication using data integrity, data origin authentication, and replay protection. ESP can be used as confidentiality only, authentication only, or both combined. When ESP provides authentication functions, it uses the same algorithms as AH, but the coverage is different. AH-style authentication authenticates the whole IP packet, including the outer IP header, while the ESP authentication mechanism authenticates only the IP datagram portion of the IP packet.

Answer b): Tunnel mode:

• Tunnel mode of IPSec protocol only protects the internal routing information by encrypting the IP header of the original packet. The original packet is bundled by another set of IP headers.
• 
  
• It is widely implemented in site-to-site VPN scenarios.
• 
  
• NAT traversal is also supported with the tunnel mode only.
• 
  
• Additionally, headers are added to the packet so the payload MSS is less.

Transport mode: The transport mode of IPSec encrypts only the payload and ESP trailer by using the different encryption algorithms so that the IP header of the original packet is not encrypted.

• The IPsec Transport mode is only implemented for client-to-site VPN scenarios.
• NAT traversal is not supported by the transport mode.
• Maximum segment size is higher when compared to Tunnel mode, as no additional headers are required.

Answer c): SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are both protocols used for the encryption of user data on the network. It uses the different encryption, hash functions, message digests and digital signatures to provide confidentiality, integrity and authentication to the user or user data on the network.

SSL (Secure Sockets Layer) certificates are an integral part of any websites security those had implemented it. Whenever any user visit a website that is secured by SSL layer, the site's SSL Certificate encrypt the confidential data sent by user, such as credit card number or passwords.

TLS is a latest and more secured version of SSL. Still today these security certificates for securing network data are widely recognized as SSL, just because it's a more commonly used term, but in reality whenever someone buys an SSL certificate, they are actually buying the latest TLS certificates with the option of different encryption algorithm.