IPv6 Enkripsi: Mode untuk Enkripsi dan Authentikasi - Revision history

Unknown user: /* IPv6 Packet Encryption */

2022-12-13T02:18:27Z

IPv6 Packet Encryption

Unknown user at 02:17, 13 December 2022

2022-12-13T02:17:12Z

← Older revision		Revision as of 02:17, 13 December 2022
Line 12:		Line 12:

	Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.		Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.


			==IPv6 Packet Encryption==

			IPsec defines cryptography-based security for both IPv4 and IPv6 in RFC 4301. IPsec support is an optional add-on in IPv4, but is a mandatory part of IPv6. It provides two security headers which can be used separately or together: Authentication Header (AH) and Encapsulating Security Payload (ESP), used in conjunction with security key exchange.

			[[File:IPsecAHmodes.png\|center\|400px\|thumb]]

			Authentication Header
			AH provides connectionless integrity, data-origin authentication and protection against replay attacks. It authenticates with an Integrity Check Value (ICV) calculated over the payload, the header, and unchanging fields of the IPv6 header and options. AH does not provide privacy and confidentiality of packet contents. See RFC 2402.


			[[File:IPsecESPmodes.png\|center\|400px\|thumb]]

			Encapsulating Security Payload
			ESP also provides connectionless integrity, data-origin authentication, protection against replay attacks, limited traffic flow confidentiality, but also provides privacy and confidentiality through encryption of the payload. See RFC 2406.

			IPsec Modes
			IPSec operates in two different modes: Transport mode (host-to-host) and Tunnel mode (gateway-to-gateway or gateway-to-host).
			Transport mode: the IPv6 header of the original packet is used, followed by the AH or ESP header, then the payload.
			Tunnel mode: a new IPv6 header encapsulates the AH or ESP header and the original IP header and payload.
			Extension headers (Hop-by-Hop, Routing, Fragmentation) immediately follow their IP headers, except for Destination Options, which can appear before or after AH or ESP. ('TCP' below indicates any upper layer protocol.)

			Authentication Header Modes
			AH in Transport & Tunnel Modes
			AH authenticates the packet and the outermost IPv6 addresses (except for mutable fields), but does not encrypt payloads. AH cannot be used to traverse NATs, as it calculates the integrity check value (ICV) over source and destination addresses: NATs translate addresses, so would invalidate ICVs.

			Encapsulating Security Payload Modes
			ESP in Transport & Tunnel Modes
			ESP authentication does not include the outermost IPv6 headers, but in Tunnel mode it protects the original headers. ESP is used to build virtual private network tunnels between sites. It permits NAT traversal, as it does not use the outermost address values in the ICV calculation. If AH and ESP are used together, ESP is applied first, then AH authenticates the entire new packet.

			The Security Association
			Security Association is a record of the authentication algorithm, encryption algorithm, keys, mode (transport or tunnel), sequence number, overflow flag, expiry of the SA, and anti-replay window. The SA is held in a database at each endpoint, indexed by outer destination address, IPsec protocol (AH or ESP), and Security Parameter Index value.

			Selection of SA can be manually (pre-shared keys) but preferably is automated with Internet Key Exchange (IKE, IKEv2). IKE uses Diffie-Hellman techniques to create a shared secret encryption key used to negotiate SA data. For key exchange, IKE depends on a Public Key Infrastructure (PKI), which is not yet widespread. The framework and syntax for key exchange is ISAKMP (Internet Security Association and Key Management Protocol). See RFC 2408.

Unknown user at 02:14, 13 December 2022

2022-12-13T02:14:02Z

← Older revision		Revision as of 02:14, 13 December 2022
Line 12:		Line 12:

	Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.		Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.


			==Referensi==

			* http://www.ipv6now.com.au/primers/IPv6PacketSecurity.php

Onnowpurbo at 00:48, 23 September 2018

2018-09-23T00:48:31Z

← Older revision		Revision as of 00:48, 23 September 2018
Line 12:		Line 12:

	Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.		Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.


			==Pranala Menarik==

			* [[IPv6]]

Onnowpurbo at 01:40, 14 July 2013

2013-07-14T01:40:58Z

← Older revision		Revision as of 01:40, 14 July 2013
Line 3:		Line 3:
	==Mode Transport==		==Mode Transport==

	Mode Transport adalah real end-to-end connection mode. ~~Dsini~~, hanya payload (biasanya ICMP, TCP atau UDP) yang di enkripsi dengan header mereka, sedang IP header tidak di enkrip (biasanya termasuk di authentikasi).		Mode Transport adalah real end-to-end connection mode. Disini, hanya payload (biasanya ICMP, TCP atau UDP) yang di enkripsi dengan header mereka, sedang IP header tidak di enkrip (biasanya termasuk di authentikasi).

	Menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi, mode ini akan mengurangi MTU sebanyak 42 octet.		Menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi, mode ini akan mengurangi MTU sebanyak 42 octet.

Onnowpurbo at 23:45, 3 July 2013

2013-07-03T23:45:29Z

← Older revision		Revision as of 23:45, 3 July 2013
Line 1:		Line 1:
	Dua mode yang mungkin digunakan untuk enkripsi dan authentikasi pada sebuah sambungan:		Dua mode yang mungkin digunakan untuk enkripsi dan authentikasi pada sebuah sambungan:


	==Mode Transport==		==Mode Transport==

Onnowpurbo at 23:45, 3 July 2013

2013-07-03T23:45:19Z

← Older revision		Revision as of 23:45, 3 July 2013
Line 1:		Line 1:
	~~20.1. Modes of using encryption and authentication~~		Dua mode yang mungkin digunakan untuk enkripsi dan authentikasi pada sebuah sambungan:

	~~Two modes of encryption and authentication of a connection are possible:~~

	==~~20.1.1.~~ Transport ~~mode~~==		==Mode Transport==

	Transport ~~mode is a~~ real end-to-end connection mode. ~~Here~~, ~~only the~~ payload (~~usually~~ ICMP, TCP or UDP) ~~is encrypted with their particular~~ header, ~~while the~~ IP header ~~is not encrypted~~ (~~but usually included in authentication~~).		Mode Transport adalah real end-to-end connection mode. Dsini, hanya payload (biasanya ICMP, TCP atau UDP) yang di enkripsi dengan header mereka, sedang IP header tidak di enkrip (biasanya termasuk di authentikasi).

	~~Using~~ AES-128 ~~for encryption and~~ SHA1 ~~for authentication~~, ~~this~~ mode ~~decreases the~~ MTU by 42 ~~octets~~.		Menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi, mode ini akan mengurangi MTU sebanyak 42 octet.

	==~~20.1.2.~~ Tunnel ~~mode~~==		==Mode Tunnel==

	Tunnel mode ~~can be used either for~~ end-to-end ~~or for~~ gateway-to-gateway ~~connection modes~~. ~~Here~~, ~~the complete~~ IP ~~packet is being encrypted and gets a new~~ IP ~~header prepended~~, ~~all together constituing a new~~ IP ~~packet (this mechanism is also known as~~ "~~encapsulation~~")		Mode Tunnel dapat digunakan baik untuk mode sambungan end-to-end atau untuk gateway-to-gateway. Di sini, paket IP secara lengkap akan di enkrip dan memperoleh tambahan header IP yang baru, sehingga menjadi paket IP yang baru. Mekanisme ini biasanya di kenal sebagai "enkapsulasi".

	~~This mode usually decreases the~~ MTU by 40 ~~octets from the~~ MTU of transport ~~mode~~. ~~I.e. using~~ AES-128 ~~for encryption and~~ SHA1 ~~for authentication~~ 82 ~~octets less than the~~ normal ~~MTU~~.		Mode ini biasanya akan mengurangi MTU dengan 40 octet dari MTU mode transport. Jika menggunakan AES-128 untuk enkripsi dan SHA1 untuk authentikasi maka 82 octet akan di ambil dari MTU yang normal.

Onnowpurbo at 07:04, 27 June 2013

2013-06-27T07:04:23Z

← Older revision		Revision as of 07:04, 27 June 2013
Line 2:		Line 2:

	Two modes of encryption and authentication of a connection are possible:		Two modes of encryption and authentication of a connection are possible:
	20.1.1. Transport mode
			==20.1.1. Transport mode==

	Transport mode is a real end-to-end connection mode. Here, only the payload (usually ICMP, TCP or UDP) is encrypted with their particular header, while the IP header is not encrypted (but usually included in authentication).		Transport mode is a real end-to-end connection mode. Here, only the payload (usually ICMP, TCP or UDP) is encrypted with their particular header, while the IP header is not encrypted (but usually included in authentication).

	Using AES-128 for encryption and SHA1 for authentication, this mode decreases the MTU by 42 octets.		Using AES-128 for encryption and SHA1 for authentication, this mode decreases the MTU by 42 octets.
	20.1.2. Tunnel mode
			==20.1.2. Tunnel mode==

	Tunnel mode can be used either for end-to-end or for gateway-to-gateway connection modes. Here, the complete IP packet is being encrypted and gets a new IP header prepended, all together constituing a new IP packet (this mechanism is also known as "encapsulation")		Tunnel mode can be used either for end-to-end or for gateway-to-gateway connection modes. Here, the complete IP packet is being encrypted and gets a new IP header prepended, all together constituing a new IP packet (this mechanism is also known as "encapsulation")

	This mode usually decreases the MTU by 40 octets from the MTU of transport mode. I.e. using AES-128 for encryption and SHA1 for authentication 82 octets less than the normal MTU.		This mode usually decreases the MTU by 40 octets from the MTU of transport mode. I.e. using AES-128 for encryption and SHA1 for authentication 82 octets less than the normal MTU.

Onnowpurbo: New page: 20.1. Modes of using encryption and authentication Two modes of encryption and authentication of a connection are possible: 20.1.1. Transport mode Transport mode is a real end-to-end con...

2013-05-23T00:08:18Z

New page: 20.1. Modes of using encryption and authentication Two modes of encryption and authentication of a connection are possible: 20.1.1. Transport mode Transport mode is a real end-to-end con...

New page

20.1. Modes of using encryption and authentication

Two modes of encryption and authentication of a connection are possible:
20.1.1. Transport mode

Transport mode is a real end-to-end connection mode. Here, only the payload (usually ICMP, TCP or UDP) is encrypted with their particular header, while the IP header is not encrypted (but usually included in authentication).

Using AES-128 for encryption and SHA1 for authentication, this mode decreases the MTU by 42 octets.
20.1.2. Tunnel mode

Tunnel mode can be used either for end-to-end or for gateway-to-gateway connection modes. Here, the complete IP packet is being encrypted and gets a new IP header prepended, all together constituing a new IP packet (this mechanism is also known as "encapsulation")

This mode usually decreases the MTU by 40 octets from the MTU of transport mode. I.e. using AES-128 for encryption and SHA1 for authentication 82 octets less than the normal MTU.

← Older revision		Revision as of 02:18, 13 December 2022
Line 20:		Line 20:
	[[File:IPsecAHmodes.png\|center\|400px\|thumb]]		[[File:IPsecAHmodes.png\|center\|400px\|thumb]]

	Authentication Header		===Authentication Header===
	AH provides connectionless integrity, data-origin authentication and protection against replay attacks. It authenticates with an Integrity Check Value (ICV) calculated over the payload, the header, and unchanging fields of the IPv6 header and options. AH does not provide privacy and confidentiality of packet contents. See RFC 2402.		AH provides connectionless integrity, data-origin authentication and protection against replay attacks. It authenticates with an Integrity Check Value (ICV) calculated over the payload, the header, and unchanging fields of the IPv6 header and options. AH does not provide privacy and confidentiality of packet contents. See RFC 2402.

Line 26:		Line 26:
	[[File:IPsecESPmodes.png\|center\|400px\|thumb]]		[[File:IPsecESPmodes.png\|center\|400px\|thumb]]

	Encapsulating Security Payload		===Encapsulating Security Payload===
	ESP also provides connectionless integrity, data-origin authentication, protection against replay attacks, limited traffic flow confidentiality, but also provides privacy and confidentiality through encryption of the payload. See RFC 2406.		ESP also provides connectionless integrity, data-origin authentication, protection against replay attacks, limited traffic flow confidentiality, but also provides privacy and confidentiality through encryption of the payload. See RFC 2406.

	IPsec Modes		===IPsec Modes===
	IPSec operates in two different modes: Transport mode (host-to-host) and Tunnel mode (gateway-to-gateway or gateway-to-host).		IPSec operates in two different modes: Transport mode (host-to-host) and Tunnel mode (gateway-to-gateway or gateway-to-host).
	Transport mode: the IPv6 header of the original packet is used, followed by the AH or ESP header, then the payload.		Transport mode: the IPv6 header of the original packet is used, followed by the AH or ESP header, then the payload.
Line 35:		Line 35:
	Extension headers (Hop-by-Hop, Routing, Fragmentation) immediately follow their IP headers, except for Destination Options, which can appear before or after AH or ESP. ('TCP' below indicates any upper layer protocol.)		Extension headers (Hop-by-Hop, Routing, Fragmentation) immediately follow their IP headers, except for Destination Options, which can appear before or after AH or ESP. ('TCP' below indicates any upper layer protocol.)

	Authentication Header Modes		===Authentication Header Modes===
	AH in Transport & Tunnel Modes		====AH in Transport & Tunnel Modes====
	AH authenticates the packet and the outermost IPv6 addresses (except for mutable fields), but does not encrypt payloads. AH cannot be used to traverse NATs, as it calculates the integrity check value (ICV) over source and destination addresses: NATs translate addresses, so would invalidate ICVs.		AH authenticates the packet and the outermost IPv6 addresses (except for mutable fields), but does not encrypt payloads. AH cannot be used to traverse NATs, as it calculates the integrity check value (ICV) over source and destination addresses: NATs translate addresses, so would invalidate ICVs.

	Encapsulating Security Payload Modes		===Encapsulating Security Payload Modes===
	ESP in Transport & Tunnel Modes		====ESP in Transport & Tunnel Modes====
	ESP authentication does not include the outermost IPv6 headers, but in Tunnel mode it protects the original headers. ESP is used to build virtual private network tunnels between sites. It permits NAT traversal, as it does not use the outermost address values in the ICV calculation. If AH and ESP are used together, ESP is applied first, then AH authenticates the entire new packet.		ESP authentication does not include the outermost IPv6 headers, but in Tunnel mode it protects the original headers. ESP is used to build virtual private network tunnels between sites. It permits NAT traversal, as it does not use the outermost address values in the ICV calculation. If AH and ESP are used together, ESP is applied first, then AH authenticates the entire new packet.

	The Security Association		===The Security Association===
	Security Association is a record of the authentication algorithm, encryption algorithm, keys, mode (transport or tunnel), sequence number, overflow flag, expiry of the SA, and anti-replay window. The SA is held in a database at each endpoint, indexed by outer destination address, IPsec protocol (AH or ESP), and Security Parameter Index value.		Security Association is a record of the authentication algorithm, encryption algorithm, keys, mode (transport or tunnel), sequence number, overflow flag, expiry of the SA, and anti-replay window. The SA is held in a database at each endpoint, indexed by outer destination address, IPsec protocol (AH or ESP), and Security Parameter Index value.

	Selection of SA can be manually (pre-shared keys) but preferably is automated with Internet Key Exchange (IKE, IKEv2). IKE uses Diffie-Hellman techniques to create a shared secret encryption key used to negotiate SA data. For key exchange, IKE depends on a Public Key Infrastructure (PKI), which is not yet widespread. The framework and syntax for key exchange is ISAKMP (Internet Security Association and Key Management Protocol). See RFC 2408.		Selection of SA can be manually (pre-shared keys) but preferably is automated with Internet Key Exchange (IKE, IKEv2). IKE uses Diffie-Hellman techniques to create a shared secret encryption key used to negotiate SA data. For key exchange, IKE depends on a Public Key Infrastructure (PKI), which is not yet widespread. The framework and syntax for key exchange is ISAKMP (Internet Security Association and Key Management Protocol). See RFC 2408.



	==Referensi==		==Referensi==