Withdrawn Draft Warning Notice The attached draft document has been withdrawn, and is provided solely for historical purposes. It has been superseded by the document identified below. Withdrawal Date June 30, 2020 Original Release Date July 2, 2019 Superseding Document Status Final Series/Number NIST Special Publication 800-77 Revision 1 Title Guide to IPsec VPNs Publication Date June 2020 DOI CSRC URL https://csrc.nist.gov/publications/detail/sp/800-77/rev-1/draft Additional Information 1 Draft NIST Special Publication 800-77 2 Revision 1 3 Guide to IPsec VPNs 4 5 6 Elaine Barker 7 Quynh Dang 8 Sheila Frankel 9 Karen Scarfone 10 Paul Wouters 11 12 13 14 15 16 This publication is available free of charge from: 17 https://doi.org/10.6028/NIST.SP.800-77r1-draft 18 19 20 C O M P U T E R S E C U R I T Y 21 22 23 Draft NIST Special Publication 800-77 24 Revision 1 25 Guide to IPsec VPNs 26 27 Elaine Barker 28 Quynh Dang 29 Sheila Frankel 30 Computer Security Division 31 Information Technology Laboratory 32 33 Karen Scarfone 34 Scarfone Cybersecurity 35 Clifton, VA 36 37 Paul Wouters 38 No Hats Corporation 39 Toronto, ON, Canada 40 41 This publication is available free of charge from: 42 https://doi.org/10.6028/NIST.SP.800-77r1-draft 43 44 45 July 2019 46 47 48 49 50 51 U.S. Department of Commerce 52 Wilbur L. Ross, Jr., Secretary 53 54 National Institute of Standards and Technology 55 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 56 Authority 57 This publication has been developed by NIST in accordance with its statutory responsibilities under the 58 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law 59 (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including 60 minimum requirements for federal information systems, but such standards and guidelines shall not apply 61 to national security systems without the express approval of appropriate federal officials exercising policy 62 authority over such systems. This guideline is consistent with the requirements of the Office of Management 63 and Budget (OMB) Circular A-130. 64 Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and 65 binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these 66 guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, 67 Director of the OMB, or any other federal official. This publication may be used by nongovernmental 68 organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, 69 however, be appreciated by NIST. 70 National Institute of Standards and Technology Special Publication 800-77 Revision 1 71 Natl. Inst. Stand. Technol. Spec. Publ. 800-77 Rev. 1, 161 pages (July 2019) 72 CODEN: NSPUE2 73 This publication is available free of charge from: 74 https://doi.org/10.6028/NIST.SP.800-77r1-draft 75 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 76 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 77 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 78 available for the purpose. 79 There may be references in this publication to other publications currently under development by NIST in accordance 80 with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, 81 may be used by federal agencies even before the completion of such companion publications. Thus, until each 82 publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For 83 planning and transition purposes, federal agencies may wish to closely follow the development of these new 84 publications by NIST. 85 Organizations are encouraged to review all draft publications during public comment periods and provide feedback to 86 NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 87 https://csrc.nist.gov/publications. 88 Public comment period: July 2, 2019 through October 8, 2019 89 National Institute of Standards and Technology 90 Attn: Computer Security Division, Information Technology Laboratory 91 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 92 Email: [email protected] 93 All comments are subject to release under the Freedom of Information Act (FOIA). NIST SP 800-77 REV. 1 (DRAFT) GUIDE TO IPSEC VPNS 94 Reports on Computer Systems Technology 95 The Information Technology Laboratory (ITL) at the National Institute of Standards and 96 Technology (NIST) promotes the U.S. economy and public welfare by providing technical 97 leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 98 methods, reference data, proof of concept implementations, and technical analyses to advance 99 the development and productive use of information technology. ITL’s responsibilities include the 100 development of management, administrative, technical, and physical standards and guidelines for 101 the cost-effective security and privacy of other than national security-related information in 102 federal information systems. The Special Publication 800-series reports on ITL’s research, 103 guidelines, and outreach efforts in information system security, and its collaborative activities 104 with industry, government, and academic organizations. 105 106 Abstract 107 Internet Protocol Security (IPsec) is a widely used network layer security control for protecting 108 communications. IPsec is a framework of open standards for ensuring private communications 109 over Internet Protocol (IP) networks. IPsec configuration is usually performed using the Internet 110 Key Exchange (IKE) protocol. This publication provides practical guidance to organizations on 111 implementing security services based on IPsec so that they can mitigate the risks associated with 112 transmitting sensitive information across networks. The document focuses on how IPsec 113 provides network layer security services and how organizations can implement IPsec and IKE to 114 provide security under different circumstances. It also describes alternatives to IPsec and 115 discusses under what circumstances each alternative may be appropriate. 116 117 Keywords 118 communications security; Internet Key Exchange (IKE); Internet Protocol (IP); Internet Protocol 119 Security (IPsec); network layer security; networking; virtual private network (VPN). 120 ii NIST SP 800-77 REV. 1 (DRAFT) GUIDE TO IPSEC VPNS 121 Acknowledgments 122 The authors, Elaine Barker, Quynh Dang, and Sheila Frankel of NIST, wish to thank everyone 123 who has contributed to this revision of Special Publication (SP) 800-77, particularly Andrew 124 Regenscheid, David Waltermire, and Lily Chen of NIST, and Dorothy E. Cooley and James 125 Banoczi of the National Security Agency (NSA). 126 The authors acknowledge the following individuals (with their original affiliations) and 127 organizations that assisted in the development of the original SP 800-77: 128 • The authors of the original version: Sheila Frankel of NIST, and Karen Kent, Ryan 129 Lewkowski, Angela D. Orebaugh, Ronald W. Ritchey, and Steven R. Sharma of Booz 130 Allen Hamilton 131 • Bill Burr, Tim Grance, Okhee Kim, Peter Mell, and Murugiah Souppaya of NIST 132 • Darren Hartman and Mark Zimmerman of ICSA Labs 133 • Paul Hoffman of the VPN Consortium 134 • Representatives from the Department of Energy, the Department of State, the 135 Environmental Protection Agency, and the U.S. Nuclear Regulatory Commission 136 137 Audience 138 This document has been created for network architects, network administrators, security staff, 139 technical support staff, and computer security program managers who are responsible for the 140 technical aspects of preparing, operating, and securing networked infrastructures. The material in 141 this document is technically oriented, and it is assumed that readers have at least a basic 142 understanding of networking and network security. 143 144 Trademark Information 145 All names are registered trademarks or trademarks of their respective companies. 146 iii NIST SP 800-77 REV. 1 (DRAFT) GUIDE TO IPSEC VPNS 147 Call for Patent Claims 148 This public review includes a call for information on essential patent claims (claims whose use 149 would be required for compliance with the guidance or requirements in this Information 150 Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be 151 directly stated in this ITL Publication or by reference to another publication. This call also 152 includes disclosure, where known, of the existence of pending U.S. or foreign patent applications 153 relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents. 154 ITL may require from the patent holder, or a party authorized to make assurances on its behalf, 155 in written or electronic form, either: 156 a) assurance in the form of a general disclaimer to the effect that such party does not hold 157 and does not currently intend holding any essential patent claim(s); or 158 b) assurance that a license to such essential patent claim(s) will be made available to 159 applicants desiring to utilize the license for the purpose of