ike协商（Ike negotiation）.doc

ike协商（Ike negotiation） IPSec IKE negotiation process The first stage of IKE The essence of IKE is that it is never in the insecure network key is transmitted directly, but through a series of calculations, the two sides finally calculate the shared key, and even the third party interception of all data exchange, can not calculate the true key. Which is the core technology of DH exchange algorithm. The first stage of the IKE negotiation, the parties involved in communication will generate 4 secrets: SKEYID: follow up three are built on the basis of it, calculated by it. SKEYID_d: used to derive the material for IPSec encryption. SKEYID_a: for the integrity of the IKE message security data and data sources to verify the identity of the. SKEYID_e: for the subsequent IKE negotiation and IPSEC SA negotiation encryption. The formation of SKEYID depends on what kind of validation algorithm, 1) used a pre shared key; 2) Certificate (digital signature) The main mode of using the three exchange, total of 6 information exchange In a message before the negotiation initiator and responder must be calculated to produce cookie, used to uniquely identify each individual exchange, the use of cookie source / destination IP address, random number, date and time of MD5 is calculated, and will be put into the ISAKMP header message 1, identifies a single exchange agreement. The pre shared key 1) 1 and 2 news news: policy negotiation, exchange of both cookie and SA load. Message 1: the parameter negotiation negotiation IKE SA SA in the initiator carrying the load (5 tuples), including the IKE hash type, encryption algorithm and authentication method, DH group, SA survival. Message 2: response strategy view IKE news, search and matching strategy in the local, find back a message in response to the. The first time after the exchange, the communication to generate shared keys used to generate DH DH value. The generation method is both use a random number of random numbers by DH algorithm to