IP Security

As the name suggests, the IP Security ( "IPsec" ) protocol suite is used to provide encryption and message authentication for IP communications. These protocols are defined by the IETF and published as RFC standards or working drafts. The Shrew Soft VPN Client makes every attempt to adhere to the following IPsec and key exchange related documents.

Standards

RFC 2367 - PF_KEY Key Management API, Version 2
RFC 2393 - IP Payload Compression Protocol (IPComp)
RFC 2394 - IP Payload Compression Using DEFLATE
RFC 2401 - Security Architecture for the Internet Protocol
RFC 2402 - IP Authentication Header (AH)
RFC 2406 - IP Encapsulating Security Payload (ESP)
RFC 2407 - The Internet IP Security Domain of Interpretation for ISAKMP
RFC 2408 - Internet Security Association and Key Management Protocol (ISAKMP)
RFC 2409 - The Internet Key Exchange (IKE)
RFC 2411 - IP Security Document Roadmap
RFC 2412 - The OAKLEY Key Determination Protocol
RFC 3456 - DHCPv4 Configuration of IPsec Tunnel Mode
RFC 3706 - A Traffic-Based Method of Detecting Dead IKE Peers
RFC 3947 - Negotiation of NAT-Traversal in the IKE
RFC 3948 - UDP Encapsulation of IPsec ESP Packets

Working Drafts

ipsec-isakmp-mode-cfg-05 - The ISAKMP Configuration Method
ipsec-isakmp-xauth-06 - Extended Authentication within ISAKMP/Oakley (XAUTH)
ipsec-isakmp-hybrid-auth-05 - A Hybrid Authentication Mode for IKE
ipsec-nat-t-ike-00 - Negotiation of NAT-Traversal in the IKE ( v00 )
ipsec-nat-t-ike-01 - Negotiation of NAT-Traversal in the IKE ( v01 )
ipsec-nat-t-ike-02 - Negotiation of NAT-Traversal in the IKE ( v02 )
ipsec-nat-t-ike-03 - Negotiation of NAT-Traversal in the IKE ( v03 )
ipsec-udp-encaps-00 - UDP Encapsulation of IPsec Packets ( v00 )
ipsec-udp-encaps-01 - UDP Encapsulation of IPsec Packets ( v01 )
ipsec-udp-encaps-02 - UDP Encapsulation of IPsec Packets ( v02 )
ipsec-udp-encaps-03 - UDP Encapsulation of IPsec Packets ( v03 )

Terminology

A host that directly participates in IPsec communications is referred to as an IPsec Peer. Peers use a set of Security Policies to determine which traffic requires protection or authentication. As with any method of secure communication, both parties involved must agree on a common set of parameters that define how data will be secured as well as share common key material. An established set of parameters and key material used to perform cryptographic services is referred to as a Security Association ( "SA" ).