TCP/IP Tutorial and Technical Overview - IBM Redbooks

Before describing the details of the key exchange and update messages, some
explanations are necessary:
► Internet Security Association and Key Management Protocol (ISAKMP)
A framework that defines the management of Security Associations
(negotiate, modify, delete) and keys, and it also defines the payloads for
exchanging key generation and authentication data. ISAKMP itself does not
define any key exchange protocols, and the framework it provides can be
applied to security mechanisms in the network, transport, or application layer,
and also to itself.
► Oakley
A key exchange protocol that can be used with the ISAKMP framework to
exchange and update keying material for Security Associations.
► Domain of Interpretation (DOI)
Definition of a set of protocols to be used with the ISAKMP framework for a
particular environment; also a set of common definitions shared with those
protocols regarding the syntax of SA attributes and payload contents,
namespace of cryptographic transforms, and so on. In relation to IPSec, the
DOI instantiates ISAKMP for use with IP.
► Internet Key Exchange (IKE)
A protocol that uses parts of ISAKMP and parts of the Oakley and SKEME
key exchange protocols to provide management of keys and Security
Associations for the IPSec AH and ESP protocols and for ISAKMP itself.
Protocol overview
ISAKMP requires that all information exchanges must be both encrypted and
authenticated, so that no one can eavesdrop on the keying material. The keying
material will be exchanged only among authenticated parties. This is required
because the ISAKMP procedures deal with initializing the keys, so they must be
capable of running over links where no security can be assumed to exist.
In addition, the ISAKMP methods have been designed with the explicit goals of
providing protection against several well-known exposures:
► Denial of service: The messages are constructed with unique cookies that can
be used to quickly identify and reject invalid messages without the need to
execute processor-intensive cryptographic operations.
► Man-in-the-middle: Protection is provided against the common attacks such
as deletion of messages, modification of messages, reflecting messages
back to the sender, replaying of old messages, and redirection of messages
to unintended recipients.
830 TCP/IP Tutorial and Technical Overview