TCP/IP Tutorial and Technical Overview - IBM Redbooks

Another public key algorithm, the very first ever invented, is Diffie-Hellman. This
is a key exchange algorithm; that is, it is used for securely establishing a shared
secret over an insecure channel. The communicating parties exchange public
information from which they derive a key. An eavesdropper cannot reconstruct
the key from the information that went through the insecure channel. More
precisely, the reconstruction is computationally infeasible. The security of
Diffie-Hellman relies on the difficulty of calculating discrete logarithms in finite
fields. After the shared secret has been established, it can then be used to derive
keys for use with symmetric key algorithms such as DES.
Diffie-Hellman makes the secure derivation of a shared secret key possible, but it
does not authenticate the parties. For authentication, another public key
algorithm must be used, such as RSA.
Unfortunately, public key algorithms, while providing for easier key management,
privacy, authentication, and non-repudiation, also have some disadvantages.
The most important one is that they are slow and difficult to implement in
hardware. For example, RSA is 100 to 10,000 times slower than DES, depending
on implementation. Because of this, public key algorithms generally are not used
for bulk encryption. Their most important use is key exchange and
authentication. Another notable disadvantage is that they are susceptible to
certain cryptanalytic attacks to which symmetric algorithms are resistant.
Therefore, a good cryptographic system (cryptosystem) makes use of both
worlds. It uses public key algorithms in the session establishment phase for
authentication and key exchange, and then a symmetric one for encrypting the
consequent messages.
For the interested reader, we give more detailed information of the two most
important asymmetric algorithms, which involve modular arithmetic. An
arithmetic operation modulo m means that the result of that operation is divided
by m and the remainder is taken. For example: 3 * 6 mod 4 = 2, since 3 * 6 = 18
and dividing 18 by 4 gives us 2 as the remainder.
RSA public key algorithm
RSA is used in the ISAKMP/Oakley framework as one of the possible
authentication methods. The principle of the RSA algorithm is as follows:
1. Take two large primes, p and q.
2. Find their product n = pq; n is called the modulus.
3. Choose a number, e, less than n and relatively prime to (p-1)(q-1), which
means that e and (p-1)(q-1) have no common factor other than 1.
4. Find its inverse, d mod (p-1)(q-1), which means that ed = 1 mod (p-1)(q-1).
Chapter 22. TCP/IP security 783