HP UX IPSec Software Figure, IKE Primary Authentication, Diffie-HellmanKey Generation

HP-UX IPSec Overview

Internet Key Exchange (IKE)

public value to generate a new value. Because of the mathematical properties of the numbers, each party will generate the same value, which can then be used as a symmetric key.

Figure 1-10		Diffie-Hellman Key Generation
	Node A					Node B
Step 1				A & B select Diffie-Hellman Group
						Public
Step 2	Public
	Value					Value
	Private					Private
	Value					Value
					Private Value B
			Private Value A
			combined with		combined with
			Public Value B		Public Value A
Step 3	A					B
	Shared			=		Shared
	Secret					Secret
	Value					Value

Diffie-Hellman is vulnerable to attacks where a third-party intercepts messages between the sender and receiver and assumes the identity of the other party. Because of this, Diffie-Hellman is used with some form of authentication to ensure that symmetric keys are established between correct parties.

In summary, if two entities use the same, well-known Diffie-Hellman group, they can publicly exchange values and generate the same shared value that they can use as a symmetric key, or use as a base for a symmetric key. Diffie-Hellman should be used with some form of authentication.

IKE Primary Authentication

IKE must authenticate the identities of the systems using the Diffie-Hellman algorithm. This process is known as primary authentication. HP-UX IPSec IKE can use two primary authentication methods:

•Preshared keys

40 Chapter 1