Triple DES
One version of the Data Encryption Standard is Triple DES (3DES) so named because it performs three encryption operations on the data. It performs an encryption process, a decryption process, and then another encryption process, each with a different 56-bit key. This triple process produces an aggregate 168-bit key, providing strong encryption. Cisco VPN products and software all support the 168-bit 3DES encryption algorithm as well as the 56-bit DES algorithm.
Message Integrity
Message integrity is accomplished by using a hashing algorithm to compute a condensed representation of a message or data file. These condensed representations are called message digests (MDs) and are of a fixed length that depends on the hashing algorithm used. All or part of this message digest is transmitted with the data to the destination host, which executes the same hashing algorithm to create its own message digest. The source and destination message digests are then compared. Any deviation means that the message has been altered since the original message digest was created. A match means that you can be fairly certain that the data have not been altered during transit.
When using the IPSec AH protocol, the message digest is created using the immutable fields from the entire IP datagram, replacing mutable fields with 0s or predictable values to maintain proper alignment. The computed MD is then placed into the Authentication Data (or ICV) field of the AH. The destination device then copies the MD from the AH and zeroes out the Authentication Data field to recalculate its own MD. Refer to Figures 2-8 and 2-10 to refresh your memory about the structure of the AH datagram.
With the IPSec ESP protocol, the process is similar. The message digest is created using the immutable data in the portion of the IP datagram from the beginning of the ESP header to the end of the ESP trailer. The computed MD is then placed into the ICV field at the end of the datagram. With ESP, the destination host does not need to zero out the ICV field because it sits outside of the scope of the hashing routine. Refer to Figures 2-9 and 2-11 for the structure of the ESP datagram.
Cisco VPN products support Message Digest 5 (MD5) and Secure Hash Algorithm-1 (SHA-1) algorithms, which use a keyed hashing mechanism called Hashed Method Authentication Code (HMAC). These three message integrity tools are described in the following sections.
Continue reading here: Secure Hash Algorithm1
Was this article helpful?