HP-UX IPSec Overview

Internet Key Exchange (IKE)Internet Key Exchange (IKE)

Before IPSec sends authenticated or encrypted IP data, both the sender and receiver must agree on the protocols, encryption algorithms and keys to use. HP-UX IPSec uses the Internet Key Exchange (IKE) protocol to negotiate the encryption and authentication methods, and generate shared encryption keys. The IKE protocol also provides primary authentication - verifying the identity of the remote system before negotiating the encryption algorithm and keys.

The IKE protocol is a hybrid of three other protocols: Internet Security Association and Key Management Protocol (ISAKMP), Oakley, and Versatile Secure Key Exchange Mechanism for Internet protocol (SKEME). ISAKMP provides a framework for authentication and key exchange, but does not define them (neither authentication nor key exchange). The Oakley protocol describes a series of modes for key exchange and the SKEME protocol defines key exchange techniques.

Security Associations (SAs) and IKE Phases

A Security Association (SA) is a secure communication channel and its parameters, such as the encryption algorithm, keys and lifetime. There are two SA negotiation phases within ISAKMP, which are sometimes referred to by the Oakley modes used to establish the SAs. The general flow of the IKE protocol is as follows:

1. ISAKMP Phase One (Main Mode, MM)

•Negotiate and establish an ISAKMP SA, a secure communication channel for further IKE communication.

The two systems generate a Diffie-Hellmanshared value (described below) that is used as the base for a symmetric (shared) key, and further IKE communication is encrypted using this symmetric key.

• Verify the remote system’s identity (primary authentication)

2.ISAKMP Phase Two (Quick Mode, QM)

38

Chapter 1