HP UX IPSec Software manual IKE Primary Authentication, Diffie-Hellman Key Generation

HP-UX IPSec Overview

Internet Key Exchange (IKE)

public value to generate a new value. Because of the mathematical properties of the numbers, each party will generate the same value, which can then be used as a symmetric key.

Figure 1-10 Diffie-Hellman Key Generation

Step 1

Step 2

Step 3

Node A					Node B
		A & B select Diffie-Hellman Group
					Public
Public
Value					Value
Private					Private
Value					Value
				Private Value B
	Private Value A
	combined with			combined with
	Public Value B			Public Value A
A					B
Shared			=		Shared
Secret					Secret
Value					Value

Diffie-Hellman is vulnerable to attacks where a third-party intercepts messages between the sender and receiver and assumes the identity of the other party. Because of this, Diffie-Hellman is used with some form of authentication to ensure that symmetric keys are established between correct parties.

In summary, if two entities use the same, well-known Diffie-Hellman group, they can publicly exchange values and generate the same shared value that they can use as a symmetric key, or use as a base for a symmetric key. Diffie-Hellman should be used with some form of authentication.

IKE Primary Authentication

IKE must authenticate the identities of the systems using the Diffie-Hellman algorithm. This process is known as primary authentication. HP-UX IPSec IKE can use two primary authentication methods:

•Preshared keys

40 Chapter 1