The NULL Authentication Method in the Internet Key Exchange Protocol Version 2 (IKEv2)

Wouters, Paul; Smyslov, Valery

doi:10.17487/rfc7619

Cited by 3 publications

(2 citation statements)

References 3 publications

(7 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…According to different encoding formats, RFC4945 [24] specifically defines 11 different ID identifiers, corresponding to these six ID types. In addition, RFC4595 [25] proposed the ID_FC_NAME format applied to the fiber channel protocol, and RFC7619 [32] proposed the ID_NULL format. With the ID_ANY/ID_NONE type, the 14 ID identifier types are summarized in Table 1.…”

Section: Identification Types Of Ipsecmentioning

confidence: 99%

Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations

Guo

Chen

et al. 2021

ITC

View full text Add to dashboard Cite

Owing to the advent and rapid development of Internet communication technology, network security protocols with cryptography as their core have gradually become an important means of ensuring secure communications. Among numerous security protocols, certificate authentication is a common method of identity authentication, and hostname verification is a critical but easily neglected process in certificate authentication. Hostname verification validates the identity of a remote target by checking whether the hostname of the communication partner matches any name in the X.509 certificate. Notably, errors in hostname verification may cause security problems with regard to identity authentication. In this study, we use a model-learning method to conduct security testing for hostname verification in internet protocol security (IPsec). This method can analyze the problems entailed in implementing hostname verification in IPsec by effectively inferring the deterministic finite automaton model that can describe the matching situation between the certificate subject name and the hostname for different rules. We analyze two popular IPsec implementations, Strongswan and Libreswan, and find five violations. We use some of these violations to conduct actual attack tests on the IPsec implementation. The results show that under certain conditions, attackers can use these flaws to carry out identity impersonation attacks and man-in-the-middle attacks.

show abstract

Section: Identification Types Of Ipsecmentioning

confidence: 99%

Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations

Guo

Chen

et al. 2021

ITC

View full text Add to dashboard Cite

show abstract

“…If the Initiator uses NULL Authentication [RFC7619], then its identity is never verified. This condition may be used by attackers to perform a DoS attack after the IKE SA is established.…”

mentioning

confidence: 99%

Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks

Smyslov¹,

Nir²

2016

Self Cite

View full text Add to dashboard Cite

show abstract

Analysis and improvement of the Internet‐Draft IKEv3 protocol

Cheng

2016

Int J Communication

View full text Add to dashboard Cite

Summary Internet protocol (IP) is the kernel of the TCP/IP protocol family. Because IP is the only one that is shared by all high‐level protocols in TCP/IP. So the security of the IP is particularly important to the whole communication network. Fortunately, IPsec provides excellent protection for the kIP security. As a part of the IPsec, Internet Key Exchange (IKE) protocol can achieve security association negotiation, key generation, and identity authentication. The study of IKEv2, both in its application and security analysis, has been relatively mature. When the Internet Engineering Task Force published the Internet‐Draft IKEv3 protocol, there is not much attention and research on it. In this paper, we analyze the security and authentication of IKEv3 by formal verification and show that IKEv3 is susceptible to reflection attack and DoS attack. Then we propose a new variant of the IKEv3 protocol, which both resists reflection attack and mitigates the impact of the DoS attack.

show abstract

The NULL Authentication Method in the Internet Key Exchange Protocol Version 2 (IKEv2)

Abstract: This document specifies the NULL Authentication method and the ID_NULL Identification Payload ID Type for Internet Key Exchange Protocol version 2 (IKEv2).

Cited by 3 publications

References 3 publications

Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations

Automated State-Machine-Based Analysis of Hostname Verification in IPsec Implementations

Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks

Analysis and improvement of the Internet‐Draft IKEv3 protocol

Contact Info

Product

Resources

About