Operation Of Ike - 3Com MSR 50 Series Configuration Manual

1902 C 101: IKE C
HAPTER

Operation of IKE

ONFIGURATION
DH
The Diffie-Hellman (DH) algorithm is a public key algorithm. With this algorithm,
two peers can exchange some data and then use the data to calculate the shared
keys, rather than transmitting the keys directly. Due to the decryption complexity,
a third party cannot decrypt the keys even after intercepting all the exchanged
data.
PFS
The perfect forward secrecy (PFS) feature is a security feature based on the DH
algorithm. It guarantees that decryption of a key makes no impact on the security
of other keys, because the keys have no derivative relations. For IPSec, PFS is
implemented by adding an additional key exchange at IKE negotiation phase 2.
IKE negotiates keys and establishes SAs for IPSec in two phases:
1 Phase 1: The two peers establish an ISAKMP SA (a secure, authenticated channel
for communication). In this phase, two modes are available: main mode and
aggressive mode.
2 Phase 2: Using the ISAKMP SA established in phase 1, the two peers negotiate to
establish IPSec SAs.
Figure 553 IKE exchange process
SA Exchange
Key
Exchange
ID Exchange
authenticate identity and
/Authentication
As shown in Figure
three pairs of messages:
SA exchange, used for negotiating the security policy.
■
Key exchange, used for exchanging the Diffie-Hellman public vale and other
■
values like the random data. Key data is generated in this stage.
ID information and authentication data exchange, used for identity
■
authentication and the whole SA exchange.
The main difference between main mode and aggressive mode is that the
aggressive mode does not provide identity protection and only exchanges the
Peer 1
Initiator's policy
Send local
IKE policy
confirmed policy
Receive
policy
Initiator's key information
Key information
Generate key
Initiator's identity and authentication
Receive authentication data
exchange process
553, the main mode of IKE negotiation in phase 1 involves
Peer2
Algorithm
Confirmation
Find a
matching policy
Generate key
Authentication
data
authenticate identity and
exchange process
Key
Generation
Identity