CGA as alternative security credentials with IKEv2 : implementation and analysis

Jean-Michel Combes (1, 2, 3, 4) , Aurelien Wailly (1, 2, 3, 4) , Maryline Laurent (1, 2, 4)

1 TSP - RST - Département Réseaux et Services de Télécommunications
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 Orange Labs [Issy les Moulineaux]
4 CNRS - Centre National de la Recherche Scientifique

Internet Protocol security (IPsec) is a protocol suite enabling secure IP communications by authentication and/or encryption. Internet Key Exchange version 2 (IKEv2) mechanism is recommended to configure dynamically IPsec between IP nodes and the authentication of each peer is usually based on either pre-shared keys, X.509 certificates or Extensible Authentication Protocol (EAP). However, these methods may have drawbacks. On the other hand, Cryptographically Generated Addresses (CGA), IPv6 addresses with specific security properties, are the main component of the mechanism to secure the IPv6 Neighbor Discovery protocol but these security properties are only used in a local scope. An interesting solution could be the use of CGA as alternative security material for IKEv2. In this paper, we analyze advantages and drawbacks of CGA use compared to classical IKEv2 security materials, decide design choices regarding modifications of IKEv2 to integrate CGA, and finally, describe the resulting implementation.

Mots clés: Security; IPv6; IPsec/IKEv2; Credentials; CGA

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Jean-Michel Combes, Aurelien Wailly, Maryline Laurent. CGA as alternative security credentials with IKEv2 : implementation and analysis. SAR-SSI '12 : 7th Conference on Network Architectures and Information Systems Security, May 2012, Cabourg, France. pp.53-59. ⟨hal-00747186⟩