Performance analysis of AES-finalists along with SHS in IPSEC VPN over 1Gbps link

IPSEC is suit of protocols designed to provide secure communication over Network Layer (Layer-3) of TCP/IP model. Participating IPSEC gateways may have different algorithms installed in them but RFC-4835 mentions mandatory algorithms that a gateway must have so that participating gateways always have at least one algorithmic combination to agree upon. Off the shelve IPSEC implementations only implement these mandatory algorithms. In this paper, the enhancements involve the selection of hashing and encryption algorithms that yield better performance for the given system. All AES finalists and SHS algorithms have been embedded after some modifications in 64 bit RHEL 6.2 Linux kernel (2.6.32) and Openswan 2.6.38 (A user space agent which helps gateways to negotiate security associations between them) and performance analysis of these algorithms having throughput as the main parameter over 1 Gbps link in an IPSEC VPN has been done. For this purpose, all the combinations of block ciphers with different key lengths along with hashing algorithms are tested and analyzed under same operating conditions. Comparative results are shown with respect to every combination of AES finalists with every hashing algorithm of SHS and MD5. Furthermore, All the AES finalists have also been tested without hashing algorithms.

I. Introduction

IPSEC is a set of protocols which provides secure communication over Network Layer (Layer-3) of TCP/IP model. Layer 3 is used for routing protocols that is why machines that implement and configure IPSEC are also called IPSEC gateways. IPSEC is extensively used in small and large enterprises to provide confidential, authentic and integral communication. IPSEC includes following protocols: (a) Encapsulation Security Payloads (ESP), (b) Authentication Headers (AH), (c) Security Associations (SA), (d) Internet Security Association, (e) Key Management Protocol (ISAKMP). Points of interest in this research are ESP and AH. Traditionally, ESP is used to provide encryption functionality via block ciphers and AH is used to provide integrity via various hashing algorithms. To have communication between two IPSEC gateways, both gateways must agree on same set of ESP and AH algorithms. This agreement is called Security Association and ISAKMP is used to establish same SA on both gateways.