

\documentclass{beamer}

%     Copyright (c)  2001,2002,2003,2004,2005  Alexandre Dulaunoy <adulau@foo.be>
%     Permission is granted to copy, distribute and/or modify this document
%     under the terms of the GNU General Public License, Version 2.0
%     or any later version published by the Free Software Foundation;


%\usetheme{PaloAlto}
\usetheme{Goettingen}
\usepackage[english]{babel}
\usepackage[latin1]{inputenc}
\setbeamertemplate{blocks}[rounded][shadow=true]
\setbeamercovered{transparent}


%
% The following info should normally be given in you main file:
%


\title{An Introduction to the Tunneling Protocols}
\subtitle {}
\keywords {tunneling protocols}
\subject {Overview of Tunneling Protocols}
\author{Alexandre Dulaunoy and various}
\institute{
  ASBL CSRRT-LU (Computer Security Research and Response Team Luxembourg)\\
  http://www.csrrt.org/}


\begin{document}


\frame{\titlepage}

\section*{Session}

\subsection{Definition}

\frame[containsverbatim]{
  \nameslide{Definition of Tunneling Protocols}
  \frametitle{Definition of Tunneling Protocols}
  
 "A tunneling protocol is a network protocol which encapsulates one protocol or session inside another. Protocol A is encapsulated 
within protocol B, such that A treats B as though it were a data link layer. Tunneling may be used to transport a network protocol 
through a network which would not otherwise support it. Tunnelling may also be used to provide various types of VPN functionality 
such as private addressing."\\

\structure{e.g. : a transit network unsupporting a specific protocol (DECnet), the need to provide confidentiality and integrity for a specific network stream.}

}

\subsection{Types of Tunneling Protocols}

\frame[containsverbatim]{
  \nameslide{Types of Tunneling Protocols}
  \frametitle{Types of Tunneling Protocols}
  \begin{itemize}
    \item Stream oriented (e.g. SSL/TLS)
      \begin {itemize}
        \item Encapsulation/Tunneling is done bytes per bytes. 
      \end{itemize}
    \item Datagram "packet" oriented (e.g. IPsec, PPP, PPTP)
      \begin {itemize}
        \item Encapsulation/Tunneling  is done per  packet and packets
          are (often) standalone entities.
      \end{itemize}
  \end{itemize}

}
\subsection{IP headers}

\frame{
  \nameslide{IP headers}
  \frametitle{IP headers}
  \includegraphics[scale=0.50]{./imgs/IP-Header.png}
  

\structure{proto : 4 (IPinIP), 47 (GRE), 50 (IPsec ESP), 51 (IPsec AH)}
}


\subsection{Generic Routing Encapsulation (GRE)}

\frame[containsverbatim]{
  \nameslide{Generic Routing Encapsulation (GRE)}
  \frametitle{Generic Routing Encapsulation (GRE)}

  \begin{itemize}
    \item described in RFC2784
    \item A  first try to  generalize and standardize the  approach to
      encapsulate  an  arbitrary  network  layer protocol  in  another
      arbitrary network layer protocol.
    \item GRE header includes minimal information like an ether type.
    \item Cryptographic  Integrity, Confidentiality is  *not* provided
      by GRE.
    \item   Various   specific    requirements   are   required   when
      forwarding/decapsulating the packet. (TTL and alike)
  \end{itemize}
}


\subsection{PPTP}

\frame[containsverbatim]{
  \nameslide{PPTP}
  \frametitle{PPTP}

  \begin{itemize}
    \item described in RFC2637
    \item  encapsulate network frame  in PPP  using the  GRE tunneling
      protocol.
    \item use  TCP port 1723 to  manage the GRE tunnels.  At least two
      sessions are required to establish one tunnel.
    \item Sessions are authenticated using MSCHAP-v2.
    \item  Confidentiality and  Integrity can  be provided  using MPPE
      (RFC3078) but various security flaws/issue exist.
  \end{itemize}

}


\subsection{IPsec}

\frame[containsverbatim]{
  \nameslide{IPsec}
  \frametitle{IPsec}

  \begin{itemize}
    \item IPsec a suite  of tunneling (and non-tunneling) protocols to
      secure network connection.
    \item A  (very) complex suite of protocols  described by different
      RFCs.
    \item IPsec is a framework to build secure network connection (you
      can   choose  between   the  encryption,   the   various  modes,
      authentication,...).     
  \end{itemize}
}

\subsection{IPsec : the framework}

\frame[containsverbatim]{
  \nameslide{IPsec : the framework}
  \frametitle{IPsec : the framework}

  \begin{itemize}
  \item AH or ESP
    \begin{itemize}
      \item Authentication mode (AH) or Encapsulation Security Payload
        (ESP).  AH  is just  doing  authentication  but  ESP is  doing
        authentication and encryption.
    \end{itemize}
   \item Tunnel mode or Transport mode
     \begin{itemize}
         \item Transport Mode provides a secure connection between two
           endpoints (only IP payload) in Tunnel mode is the entire IP
           packets being encapsulated. (Tunnel  or Transport mode ? ip
           type is always tunnel, the rest is transport...)
     \end{itemize}
    \item Authentication and Encryption mode (AES+SHA1 ? AES+MD5)
      \begin{itemize}
        \item Authentication calculates an Integrity Check Value (ICV)
          over  the  packet's  contents,   with  crypto  hash  MD5  or
          SHA-1.  The shared  secret  key used,  and  this allows  the
          recipient  to  compute  the  ICV  in the  same  way.  by  so
          authenticate both ends.
      \end{itemize}
  \end{itemize}
}

\subsection{IPsec : the framework 2nd part}

\frame[containsverbatim]{
  \nameslide{IPsec : the framework 2nd part}
  \frametitle{IPsec : the framework 2nd part}

  \begin{itemize}
    \item IKE or manual keys
      \begin{itemize}
        \item Various shared secrets (keys) must be shared between the
          various ends. You can manually set the various required keys
          by   using   a   ``second   channel''  to   distribute   the
          secrets. This  can be very  complicated with a  large meshed
          vpn networks.  IKE (a possible) key exchange  is proposed in
          the IPsec framework in order to exchange info.
        \end{itemize}
    \item Main mode or agressive mode
      \begin{itemize}
        \item Main mode is a  6-ways initial exchange to setup the IKE
          key  exchange. The  main  mode is  secure  but can  generate
          compatibility issues  between implementation. Agressive mode
          is simpler but somewhat weaker...
      \end{itemize}
      
  \end{itemize}
}
       
  
\subsection{IPsec AH/Transport mode}
\frame[containsverbatim]{
  \nameslide{IPsec AH/Transport mode}
  \frametitle{IPsec AH/Transport mode}

   \includegraphics[scale=0.40]{./imgs/IPSec-AH-Transport-Mode.png}
}


\subsection{IPsec AH/Tunnel mode}
\frame[containsverbatim]{
  \nameslide{IPsec AH/Tunnel mode}
  \frametitle{IPsec AH/Tunnel mode}

   \includegraphics[scale=0.40]{./imgs/IPSec-AH-Tunnel-Mode.png}
}

\subsection{IPsec HMAC (AH auth)}
\frame[containsverbatim]{
  \nameslide{IPsec HMAC (AH auth)}
  \frametitle{IPsec HMAC (AH auth)}

   \includegraphics[scale=0.50]{./imgs/IPSec-HMAC.png}
}

\subsection{IPsec ESP/Transport mode}
\frame[containsverbatim]{
  \nameslide{IPsec ESP/Transport mode}
  \frametitle{IPsec ESP/Transport mode}

   \includegraphics[scale=0.40]{./imgs/IPSec-ESP-Transport-Mode.png}
}

\subsection{IPsec ESP/Tunnel mode}
\frame[containsverbatim]{
  \nameslide{IPsec ESP/Tunnel mode}
  \frametitle{IPsec ESP/Tunnel mode}

   \includegraphics[scale=0.40]{./imgs/IPSec-ESP-Tunnel-Mode.png}
}

\subsection{IPsec a final use}
\frame[containsverbatim]{
  \nameslide{IPsec a final use}
  \frametitle{IPsec a final use}

   \includegraphics[scale=0.40]{./imgs/IPSec-ESP-Auth-VPN.png}
}

\section*{Q and A}

\frame {

\nameslide {Q and A}
 \frametitle {Q and A}

\begin{itemize}
\item Thanks for listening.
\item http://www.csrrt.org.lu/
\item adulau@foo.be
\end{itemize}
%%\includegraphics[scale=0.50]{Hack2005lu-banner.png}
}

\end{document}


