HP UX IPSec Software Figure, SA Establishment, Generating Shared Keys: Diffie-Hellman

Figure 1-9

IPSec

ISAKMP

SA

NodeA

HP-UX IPSec Overview

Internet Key Exchange (IKE)

Using the secure communication channel provided by the ISAKMP/MM SA, negotiate one or more SAs for IPSec transforms (AH or ESP). A Phase Two negotiation typically negotiates two SAs for an IPSec transform: one for inbound and one for outbound traffic.

SA Establishment

		ISAKMP phase 1			IPSec
		ISAKMP phase 2
	Inbound		Outbound	ISAKMP
					SA
	Outbound		Inbound
		IP traffic
IPSec/QM SAs			IPSec/QM SAs
		( secured by IPSec AH/ESP )

NodeB

Generating Shared Keys: Diffie-Hellman

SAs use a symmetric key to encrypt communication. This symmetric key is based on a shared value generated using the Diffie-Hellman algorithm.

With Diffie-Hellman key generation, each party generates two numbers, one public and one private. These values are based on a selected, well-known numeric base, or “Diffie-Hellman group.” The two parties exchange public values (this exchange may occur via an insecure channel). Each party then uses its private value and the other party’s

Chapter 1 39