Table of Protocols Used with IPSec

Last Updated on Fri, 30 Jun 2023 | Secure VPN

IPSec was designed to be able to use existing protocols and multipurpose protocols. The only two that are considered strictly IPSec protocols are Authentication Header and Encapsulating Security Payload. Table 2-11 outlines the protocols discussed in this chapter.

Table 2-11 Protocols Used with IPSec

Process

Protocol

Description

IP Security (IPSec) Protocol

Authentication Header (AH)

A security protocol that provides data authentication and optional antireplay services. AH is embedded in the data to be protected (a full IP datagram).

Encapsulating Security Payload (ESP)

Security protocol that provides data privacy services, optional data authentication, and antireplay services. ESP encapsulates the data to be protected.

Message encryption

Data Encryption Standard (DES)

Standard cryptographic algorithm developed by the U.S. National Bureau of Standards using 56-bit

key.

Triple DES (3DES)

Standard cryptographic algorithm based on DES, using 168-bit key.

Message integrity (hash) functions

Hash-based Message Authentication Code (HMAC)

A mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, for example, MD5 or SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function.

continues continues

Table 2-11 Protocols Used with IPSec (Continued)

Process

Protocol

Description

Message integrity (hash) functions (icontinued)

Message Digest 5 (MD5)

A one-way hashing algorithm that produces a 128bit hash. Both MD5 and Secure Hash Algorithm (SHA) are variations on MD4 and are designed to strengthen the security of the MD4 hashing algorithm. Cisco uses hashes for authentication within the IPSec framework.

Secure Hash Algorithm-1 (SHA-1)

Algorithm that takes a message of less than 264 bits in length and produces a 160-bit message digest. The large message digest provides security against brute-force collision and inversion attacks. SHA-1 [NIS94c] is a revision to SHA that was published in 1994.

Peer authentication

Preshared keys

A shared secret key that must be communicated between peers through some manual process.

RSA digital signatures

Public-key cryptographic system that can be used for encryption and authentication. The digital signature is a value computed with the RSA algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity.

RSA encrypted nonces

Nonces are random numbers used in security protocols to prove recentness of messages, but they can also be used as symmetric session keys.

Key management

Diffie-Hellman (D-H)

A public-key cryptography protocol that allows two parties to establish a shared secret over insecure communications channels. Diffie-Hellman is used within Internet Key Exchange (IKE) to establish session keys. Diffie-Hellman is a component of OAKLEY key exchange. Cisco IOS Software supports 768-bit and 1024-bit Diffie-Hellman groups.

Certificate Authority (CA)

Entity that issues digital certificates (especially X.509 certificates) and vouches for the binding between the data items in a certificate.
Table 2-11 Protocols Used with IPSec (Continued)

Related Posts

Readers' Questions

  • lawrence daniel
    What is the function of the diffiehellman algorithm within the ipsec framework?
    1 month ago
    • The Diffie-Hellman algorithm is used within the IPsec framework for key exchange. It enables two parties to establish a shared secret key over an insecure network without having to exchange the key directly. The function of the Diffie-Hellman algorithm within IPsec is as follows:
    1. Key Exchange: When two parties want to establish a secure communication channel, they perform a Diffie-Hellman key exchange. Each party generates a public-private key pair. The public keys are then exchanged with each other while keeping the private keys secret.
    2. Shared Secret Generation: Using the received public key and their own private key, each party independently generates the same shared secret. The shared secret is a common secret key that is used for subsequent encryption and authentication.
    3. Perfect Forward Secrecy: One of the key benefits of using the Diffie-Hellman algorithm is that it provides perfect forward secrecy. This means that even if an attacker intercepts the exchanged public keys or the encrypted communication, they would not be able to calculate or derive the shared secret key.
    4. Data Encryption: Once the shared secret key is established, it is used as an input to symmetric encryption algorithms, such as AES (Advanced Encryption Standard), to encrypt the actual data packets transmitted between the parties.By incorporating the Diffie-Hellman key exchange algorithm, IPsec ensures that a secure shared secret key is established between communicating parties, enabling them to securely encrypt and authenticate their data exchange.
    • dahlak michael
      Which tunneling protocol is a component of the ipsec protocol suite?
      6 months ago
      • The Internet Key Exchange (IKE) protocol is a component of the IPsec protocol suite.
      • segan
        Which are the two major protocols used with ipsec?
        1 year ago
        • The two major protocols used with IPsec are AH (Authentication Header) and ESP (Encapsulating Security Payload).
        • Allison
          Which protocols use IPSec?
          1 year ago
          • IPSec is a security protocol suite used to protect IP packets in Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) network traffic. It is most commonly used in Virtual Private Network (VPN) connections, to provide end-to-end encryption and authentication of data transmissions. IPSec is used in protocols such as SSL/TLS, SSH, L2TP, and others.
          • karen
            Which protocols are used by vpn to secure communications channels?
            1 year ago
            • The most commonly used protocols for VPNs are the following:
            1. Point-to-Point Tunneling Protocol (PPTP)
            2. Layer 2 Tunneling Protocol (L2TP)
            3. Internet Protocol Security (IPsec)
            4. Secure Sockets Layer (SSL)
            5. Secure Shell (SSH)
            6. OpenVPN

            Process

            Protocol

            Description

            Security

            Association (SA)

            Internet Key Exchange (IKE)

            IKE establishes a shared security policy and authenticates keys for services (such as IPSec) that require keys. Before any IPSec traffic can be passed, each router/firewall/host must verify the identity of its peer. This can be done by manually entering preshared keys into both hosts or by a CA service.

            Internet Security Association and Key Management Protocol (ISAKMP)

            Internet IPSec protocol [RFC 2408] that negotiates, establishes, modifies, and deletes security associations. It also exchanges key generation and authentication data (independent of the details of any specific key generation technique), key establishment protocol, encryption algorithm, or authentication mechanism.

            Continue reading here: Performance and Scalability

            Was this article helpful?

            0 0