IPsecComponentsandIPsecVPNFeatures幻灯片.pptVIP

Key Lengths of Symmetric vs.Asymmetric Encryption Algorithms Comparable key lengths required for asymmetric keys compared to symmetric keys Security Level of Cryptographic Algorithms Symmetric Encryption: DES Symmetric key encryption algorithm Block cipher: Works on 64-bit data block, uses 56-bit key (last bit of each byte used for parity) Mode of operation: Apply DES to encrypt blocks of data Symmetric Encryption: 3DES 168-bit total key length Mode of operation decides how to process DES three times Normally: encrypt, decrypt, encrypt 3DES requires more processing than DES Symmetric Encryption: AES Formerly known as ‘Rijndael’ Successor to DES and 3DES Symmetric key block cipher Strong encryption with long expected life AES can support 128-, 192-, and 256-bit keys; 128-bit key is considered safe Asymmetric Encryption: RSA Based on Diffie-Hellman key exchange (IKE) principles Public key to encrypt data, and to verify digital signatures Private key to decrypt data, and to sign with a digital signature Perfect for insecure communication channels Diffie-Hellman Key Exchange Diffie-Hellman Key Exchange (Cont.) PKI Environment PKI Environment Certificate Authority The trust basis of a PKI system Verifies user identity, issues certificates by binding identity of a user to a public key with a digital certificate Revokes certificates and publishes CRL In-house implementation or outsourcing X.509 v3 Certificate PKI Message Exchange PKI Credentials How to store PKI credentials: RSA keys and certificates NVRAM eToken: Cisco 871, 1800, 2800, 3800 Series router Cisco IOS Release 12.3(14)T image Cisco USB eToken A k9 image Summary IPsec provides a mechanism for secure data transmission over IP networks. The IKE protocol is a key management protocol standard used in conjunction with the IPsec standard. IKE has some additional functions: DPD, NAT traversal, encapsulation in UDP packet, config mode, and Xauth. The two IP protocols used in the IPsec standard are ESP and AH. For