HP UX IPSec Software manual Encapsulating Security Payload ESP, ESP Encryption

HP-UX IPSec Overview

Encapsulating Security Payload (ESP)

	Encapsulating Security Payload (ESP)
	The IPSec Encapsulating Security Payload (ESP) provides data privacy.
	The ESP protocol also defines an authenticated format that provides
	data authentication and integrity, with data privacy (described in
	“Authenticated ESP” on page 36).
	ESP Encryption
	ESP takes the data carried by IP, such as a TCP packet, and encrypts it
	using an encryption algorithm and cryptographic key. The output is
	ciphertext that is difficult to decode without knowing the key. The
	receiving IPSec ESP entity uses an associated decryption algorithm and
	the same key to extract the original data.
Figure 1-4	Symmetric Key Cryptosystem
	Shared Cryptographic Key

Plaintext

Encryption

Host A

Ciphertext

Decryption

Host B

Plaintext

The cryptography used by ESP is referred to as symmetric key cryptography or shared key cryptography because the sender and receiver must use the same key. In addition, the key must only be known by the sender and receiver, so this class of cryptography is sometimes referred to as secret key cryptography.

HP-UX IPSec supports the following encryption algorithms for ESP:

•DES-CBC(Data Encryption Standard Cipher Block Chaining Mode, 56-bit key length)

•3DES-CBC(Triple-DES CBC, three encryption iterations, each with a different 56-bit key)

•AES128-CBC(Advanced Encryption Standard CBC, 128-bit key length)

Chapter 1 33