CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

- IPsec supports the following 3 types of encryption algorithms:
Data Encryption Standard
(DES)
Uses a 56-bit key that ensures high performance encryption.
Uses a symmetric key cryptosystem.
Triple DES (3DES) A variant of DES that breaks data into 64-bit blocks. 3DES then
processes each block 3 times, each time with an independent 56bit
key, hence providing significant improvement in encryption
strength over DES. Uses a symmetric key cryptosystem.
Advanced Encryption
Standard (AES)
Provides stronger encryption than DES and is more efficient
than 3DES. Key lengths can be 128-, 192-, and 256-bit keys.
- Encryption algorithms (eg: DES, 3DES, and AES) require a symmetric shared secret key to
perform encryption and decryption. The Diffie-Hellman Key Exchange (D-H) is a public key
exchange process that allows 2 parties that have no prior knowledge of each other to negotiate
symmetric shared secret keys used for encryption and decryption over an insecure channel.
The shared secret keys are negotiated between crypto endpoints dynamically, which only the
prime modulus size for use in the D-H exchange is needed to be specified. IKE uses the D-H
keys to encrypt the ISAKMP SA when establishing the IPsec SAs. Additionally, D-H is also
used to generate shared secret keys to be used in the ciphers specified in the IPsec transforms,
which are then used in conjunction with the D-H keys by the IPsec to encrypt and decrypt the
data passes through the IPsec VPN tunnel.
- IPsec uses a data integrity algorithm called Hash-based Message Authentication Code
(HMAC) that adds a hash to the message to ensure data integrity. The hash guarantees the
integrity of the original message. If the transmitted hash matches the received hash, the message
is considered has not been tampered.
- IPsec uses the following 2 HMAC algorithms:
Message Digest Algorithm 5
(MD5)
Secure Hash Algorithm 1
(SHA-1)
Uses a 128-bit shared secret key. The message and 128-bit
shared secret key are combined and run through the MD5 hash
algorithm, producing a 128-bit hash. This hash is then added
to the original message and sent to the destination host.
Uses a 160-bit shared secret key. The message and 160-bit
shared secret key are combined and run through the SHA-1
hash algorithm, producing a 160-bit hash. This hash is then
added to the original message and sent to the destination host.
- Below lists the 2 modes of IPsec operation:
Transport Only the payload of the IP packet is encrypted and/or authenticated. The routing is
intact, as the IP header is neither modified nor encrypted. It is used for host-to-host
or end-to-end communications (end systems perform the security processing).
Tunnel The entire IP packet is encrypted and/or authenticated. The original packet is
encapsulated entirely into a new packet with a new set of source and destination IP
addresses for routing to work. It is used for network-to-network or portal-to-portal
communications (gateways or routers perform the security processing). It is the
traditional and default mode of IPsec VPNs.
- The Tunnel mode is most commonly used to secure existing IP traffic for communication
between end systems on networks connected to IPsec-enabled routers. With routers or VPN
endpoints performing the IPsec encryption, no changes are required to the software and drivers
on the end systems – the IPsec implementation is transparent to end systems.
298
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com