Security

All IPv6 stacks must implement Internet Protocol Security (IPSec). IPSec provides for security to be provided at the Internet layer, rather than at the transport layer (like the Secure Socket Layer currently provides for secure e-commerce). IPSec provides facilities for encryption, authentication, implementing security policies, and data compression. The two main components of IPv6 security are packet encryption through the Encapsulated Security Payload (ESP) and source authentication through the Authentication Header (AH).

The ESP provides confidentiality, authentication, and integrity checks, while the AH only supports authentication and integrity, and works at the packet level—it uses strong cryptography to ensure that a packet can be authentically exchanged between two interfaces by the sharing a secret key. This allows the two parties to be assured that the packet has not been tampered with in transit, and that the packet originated from the source interface as described in the packet’s header.

The ESP provides a different level of security than the AH by ensuring that the data contained within a packet has not been intercepted and decrypted by a third party, as long as the secret key protecting the data has not been given to a third party.

Key management is clearly a central issue in the provision of a secure platform for IPv6. That’s why the Internet Key Exchange (IKE) system is important to the success of IPSec. IKE makes it possible for two systems to share secret keys in a secure environment. However, if a cracker discovers a secret key, all of the traffic previously protected by the key will be open for reading by that hacker. This is why secret keys cannot be used indefinitely, and should be regularly modified. One of the benefits of using Solaris IPSec is that it incorporates IKE—Solaris 8 IPSec did not support IKE because it was not part of the IPSec standard at the time, leading to cross-platform incompatibilities. This is done automatically after the session is started with a public-key exchange.