Table of Contents
Advertisement
IPsec Overview
encrypted by ESP. The Authentication digest in the ESP header is used to verify data integrity. Authenti-
cation is always applied after encryption, so a check for validity of the data is done upon receipt of the
packet and before decryption.
Encryption Algorithms
There are several different encryption algorithms that can be used in IPsec. However, the most commonly
used algorithms are "AES" and "3DES". These algorithms are used for encrypting IPv6 packets.
•
Advanced Encryption Standard - Cipher Block Chaining - (AES-CBC)
The AES-CBC mode comprises three different key lengths; AES-128, AES-192 and AES-256. Each block
of plaintext is XOR'd with the previous encrypted block before being encrypted again.
•
Triple DES (3DES)
A mode of the DES encryption algorithm that encrypts data three times. Three 64-bit keys are used,
instead of one, for an overall key length of 192 bits (the first encryption is encrypted with second key, and
the resulting cipher text is again encrypted with a third key). 3DES is a more powerful version of DES.
Authentication Header (AH)
An Authentication Header (AH) provides connectionless integrity and data origin authentication. This
protocol permits communicating parties to verify that data was not modified in transit and that it was genu-
inely transmitted from the apparent source. AH helps verify the authenticity/integrity of the content and
origin of a packet. It can optionally protect against replay attacks by using the sliding window technique
and discarding old packets. It authenticates the packet by calculating the checksum via hash-based
message authentication code (HMAC) using a secret key and either HMAC-MD-5 or HMAC-SHA1 hash
functions.
Authentication Algorithms
•
HMAC-MD5 - An algorithm that produces a 128-bit hash (also called a digital signature or message
digest) from a message of arbitrary length and a 16-byte key. The resulting hash is used, like a finger-
print of the input, to verify content and source authenticity and integrity.
•
HMAC-SHA1 - An algorithm that produces a 160-bit hash from a message of arbitrary length and a
20-byte key. It is generally regarded as more secure than MD5 because of the larger hashes it produces.
•
AES-XCBC-MAC-96 - An algorithm that uses AES [AES] in CBC mode [MODES] with a set of
extensions [XCBC-MAC-1] to overcome the limitations of the classic CBC-MAC algorithm. It uses
the AES block cipher with an increased block size and key length (128 bits) which enables it to with-
stand continuing advances in crypto-analytic techniques and computational capability. Its goal is to
ensure that the datagram is authentic and cannot be modified in transit.
Unlike ESP, AH does not encrypt the data. Therefore, it has a much simpler header than ESP. The figure
below shows an AH-protected IPv6 packet.
page 14-6
OmniSwitch AOS Release 7 Network Configuration Guide
Configuring IPsec
March 2011
Advertisement
Table of Contents
