WEBVTT

1
00:00.000 --> 00:05.000
So now that we've gotten a bit of an introduction to IPsec,

2
00:05.000 --> 00:11.000
let's take a closer look at ESP, specifically the two

3
00:11.000 --> 00:14.000
different modes that it can operate in, so that we're clear

4
00:14.000 --> 00:18.000
on what the difference is between those, and we'll also take a look

5
00:18.000 --> 00:22.000
at how ESP does data integrity.

6
00:22.000 --> 00:24.000
So those are our two topics for this video.

7
00:24.000 --> 00:28.000
Let's go ahead and jump in and get started looking at those two

8
00:28.000 --> 00:31.000
different modes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:28.000 --> 00:31.000
different modes.

9
00:31.000 --> 00:36.000
So again, one of the fundamental principles of ESP is that the

10
00:36.000 --> 00:41.000
original packet is going to be encapsulated and encrypted.

11
00:41.000 --> 00:47.000
However, there is a question which is how much of that packet is

12
00:47.000 --> 00:50.000
going to be encapsulated and encrypted.

13
00:50.000 --> 00:55.000
And the answer to that comes in the modes that are available with

14
00:55.000 --> 01:01.000
ESP. So ESP can operate in one of two modes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:55.000 --> 01:01.000
ESP. So ESP can operate in one of two modes.

15
01:01.000 --> 01:04.000
The first one is transport mode.

16
01:04.000 --> 01:11.000
With transport mode, this does not protect the original header.

17
01:11.000 --> 01:13.000
It simply protects the payload.

18
01:13.000 --> 01:17.000
If we look at our diagram here at the bottom, transport mode is

19
01:17.000 --> 01:21.000
our first choice, and we can see here that the original IP

20
01:21.000 --> 01:25.000
header is outside the section that's encrypted.

21
01:25.000 --> 01:29.000
It's encrypted from here to here.

22
01:29.000 --> 01:33.000
That's including the IP payload.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
01:29.000 --> 01:33.000
That's including the IP payload.

23
01:33.000 --> 01:36.000
So the original payload is being encrypted.

24
01:36.000 --> 01:41.000
However, the original IP header is still visible.

25
01:41.000 --> 01:44.000
So that's what we have with transport mode.

26
01:44.000 --> 01:49.000
With tunnel mode, what we're going to do is protect the

27
01:49.000 --> 01:51.000
original IP header.

28
01:51.000 --> 01:55.000
We can see that down here in the IP section tunnel mode section

29
01:55.000 --> 01:59.000
of our diagram, we see that now we're encrypting from here to

30
01:59.000 --> 02:03.000
here, and that's including that original IP header.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:59.000 --> 02:03.000
here, and that's including that original IP header.

31
02:03.000 --> 02:07.000
So that original IP header is now being encrypted.

32
02:07.000 --> 02:10.000
However, we still need an IP header.

33
02:10.000 --> 02:14.000
We can see that down here in the IP section tunnel mode section

34
02:14.000 --> 02:16.000
of our diagram.

35
02:16.000 --> 02:20.000
We can see that there is now being encrypted.

36
02:20.000 --> 02:24.000
However, we still need an IP header that's not encrypted to

37
02:24.000 --> 02:27.000
deliver the traffic to the proper destination.

38
02:27.000 --> 02:30.000
And that's where we have this additional IP header that's been
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
02:30.000 --> 02:32.000
added to the front.

40
02:32.000 --> 02:36.000
So clearly tunnel mode does add a little bit more overhead to

41
02:36.000 --> 02:40.000
the packet itself, which does technically lower your packet

42
02:40.000 --> 02:45.000
efficiency, but it does protect the traffic better in that it's

43
02:45.000 --> 02:47.000
going to be a little bit more overhead.

44
02:47.000 --> 02:49.000
So we're going to be using tunnel mode.

45
02:49.000 --> 02:51.000
So we're going to be using tunnel mode.

46
02:51.000 --> 02:54.000
So we're going to be using tunnel mode.

47
02:54.000 --> 02:56.000
So we're going to be using tunnel mode.

48
02:56.000 --> 02:59.000
So we're going to be using tunnel mode.

49
02:59.000 --> 03:01.000
So we're going to be using tunnel mode.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:59.000 --> 03:01.000
So we're going to be using tunnel mode.

50
03:01.000 --> 03:03.000
So we're going to be using tunnel mode.

51
03:03.000 --> 03:05.000
So we're going to be using tunnel mode.

52
03:05.000 --> 03:07.000
So we're going to be using tunnel mode.

53
03:07.000 --> 03:09.000
So we're going to be using tunnel mode.

54
03:09.000 --> 03:11.000
So we're going to be using tunnel mode.

55
03:11.000 --> 03:13.000
So we're going to be using tunnel mode.

56
03:13.000 --> 03:16.000
So again, what we're trying to do here is make sure that nobody

57
03:16.000 --> 03:19.000
has altered the data.

58
03:19.000 --> 03:22.000
Just a small example of why this is so important.

59
03:22.000 --> 03:27.000
Imagine if you went to your bank's website and you did a digital

60
03:27.000 --> 03:33.000
transfer and you said to transfer a thousand dollars.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
03:27.000 --> 03:33.000
transfer and you said to transfer a thousand dollars.

61
03:33.000 --> 03:38.000
But somebody modified that data and said, no, you only transferred

62
03:38.000 --> 03:40.000
a hundred dollars.

63
03:40.000 --> 03:42.000
Well, needless to say, you're not going to be very happy about

64
03:42.000 --> 03:46.000
this because nine hundred dollars just went who knows where,

65
03:46.000 --> 03:50.000
particularly if they only modify the data on one side.

66
03:50.000 --> 03:53.000
So it takes the thousand out of one side, but only puts the

67
03:53.000 --> 03:54.000
one hundred in the other.

68
03:54.000 --> 03:58.000
This again is just a simple example, but this is why we don't

69
03:58.000 --> 04:00.000
want data to be modified.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
04:00.000 --> 04:02.000
So how do we accomplish that?

71
04:02.000 --> 04:06.000
Well, we accomplished that by running the data through a

72
04:06.000 --> 04:07.000
hashing function.

73
04:07.000 --> 04:11.000
Now, a fairly popular hashing function is SHA2.

74
04:11.000 --> 04:13.000
There was also SHA1.

75
04:13.000 --> 04:16.000
We had MD5 back in the day.

76
04:16.000 --> 04:18.000
Those two are mostly outdated.

77
04:18.000 --> 04:20.000
They're generally considered legacy.

78
04:20.000 --> 04:26.000
So SHA2 is the more common way to do this in modern networks.

79
04:26.000 --> 04:30.000
To add even more security to that, we generally use something
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:30.000 --> 04:32.000
called HMAC.

81
04:32.000 --> 04:35.000
And to sort of simplify this discussion, the easiest way to

82
04:35.000 --> 04:40.000
think of HMAC is we take a secret key and we hash that.

83
04:40.000 --> 04:42.000
Along with the data.

84
04:42.000 --> 04:46.000
So in other words, we wouldn't just hash the one thousand in our

85
04:46.000 --> 04:47.000
example.

86
04:47.000 --> 04:51.000
We would hash the one thousand plus a secret key of, I don't know,

87
04:51.000 --> 04:53.000
three, seven, eight.

88
04:53.000 --> 04:57.000
We would add these two things together and then hash that.

89
04:57.000 --> 05:01.000
That way, if somebody else happened to know the original data
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:57.000 --> 05:01.000
That way, if somebody else happened to know the original data

90
05:01.000 --> 05:04.000
that they were trying to hash, they wouldn't know the secret key.

91
05:04.000 --> 05:06.000
So their hash would still be wrong.

92
05:06.000 --> 05:10.000
It prevents somebody from being able to actually spoof the hash.

93
05:10.000 --> 05:15.000
So it adds another layer of protection to our data integrity.

94
05:15.000 --> 05:19.000
So in this video, we just wanted to get two quick topics out of

95
05:19.000 --> 05:20.000
the way.

96
05:20.000 --> 05:24.000
First, of course, we wanted to discuss how ESP works in both

97
05:24.000 --> 05:26.000
transport mode and tunnel mode.

98
05:26.000 --> 05:30.000
Remember, the biggest difference is whether the original IP header
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
05:30.000 --> 05:32.000
is actually being protected.

100
05:32.000 --> 05:36.000
In the case of tunnel mode, it is.

101
05:36.000 --> 05:38.000
And of course, transport mode.

102
05:38.000 --> 05:40.000
It's using the original IP header.

103
05:40.000 --> 05:45.000
Then we also wrapped up here with talking about data integrity

104
05:45.000 --> 05:50.000
using hash functions, specifically using HMAC.

105
05:50.000 --> 05:54.000
All of this is great, but we still need to protect the data

106
05:54.000 --> 05:55.000
itself.

107
05:55.000 --> 05:57.000
And the way we do that is with encryption.

108
05:57.000 --> 06:00.000
That's exactly what we're going to cover next.