Cyberstudy
PDF p.147 In progress

Internet Key Exchange

Open PDF at p.147 22 flashcards

Summary

PDF p.147

Internet Key Exchange (IKE) is a protocol used to set up a secure, authenticated communication channel between two peers using IPsec. IKE negotiates the security association (SA), which includes the authentication method, cryptographic ciphers, and key exchange. IKE operates in two phases and has two versions, with IKEv2 offering additional features for remote access VPNs.

In plain words

Supplementary — not from your PDF

IKE sets up IPsec. It authenticates both peers (with certificates or a pre-shared key) and negotiates the security association (SA): which ciphers, keys and modes to use. Phase I authenticates the peers and uses Diffie-Hellman to build a secure channel. Phase II agrees the ciphers and key sizes for AH/ESP. IKEv2 adds EAP user authentication, simpler setup, NAT traversal, and MOBIKE for roaming between networks.

Detailed explanation

PDF p.147
  • IPsec Policy
    • Definition: Sets the authentication mechanism and use of AH/ESP and transport or tunnel mode.
    • Shared Secret: Encryption and hashing functions depend on a shared secret communicated to both peers.
    • Mutual Authentication: Confirms the identity of both peers.
  • Internet Key Exchange (IKE)
    • Function: Implements authentication, selects cryptographic ciphers, and performs key exchange.
    • Security Association (SA): Set of properties negotiated by IKE.
  • IKE Phases
    • Phase I
      • Identity Establishment: Confirms the identity of the two peers.
      • Key Agreement: Uses the Diffie-Hellman algorithm to create a secure channel.
      • Authentication Methods
        • Digital Certificates: Issued by a mutually trusted certificate authority.
        • Pre-Shared Key: Same passphrase configured on both peers.
    • Phase II
      • Cipher and Key Size Selection: Establishes which ciphers and key sizes will be used with AH and/or ESP in the IPsec session.
  • IKE Versions
    • IKEv1
      • Use Case: Designed for site-to-site and host-to-host topologies.
      • Remote Access VPNs: Requires a supporting protocol.
    • IKEv2
      • Features
        • EAP Authentication: Supports methods like user authentication against a RADIUS server.
        • Simple Setup Mode: Reduces bandwidth without compromising security.
        • NAT Traversal and MOBIKE Multihoming: Easier tunnel configuration through home routers/firewalls and maintaining IPsec connections when switching between Wi-Fi and cellular interfaces.

Important terms

taken from the text above
IPsec Policy
Sets the authentication mechanism and use of AH/ESP and transport or tunnel mode.
Shared Secret
Encryption and hashing functions depend on a shared secret communicated to both peers.
Mutual Authentication
Confirms the identity of both peers.
Security Association (SA)
Set of properties negotiated by IKE.
Identity Establishment
Confirms the identity of the two peers.
Key Agreement
Uses the Diffie-Hellman algorithm to create a secure channel.
Digital Certificates
Issued by a mutually trusted certificate authority.
Pre-Shared Key
Same passphrase configured on both peers.
Cipher and Key Size Selection
Establishes which ciphers and key sizes will be used with AH and/or ESP in the IPsec session.
Remote Access VPNs
Requires a supporting protocol.
EAP Authentication
Supports methods like user authentication against a RADIUS server.
Simple Setup Mode
Reduces bandwidth without compromising security.
NAT Traversal and MOBIKE Multihoming
Easier tunnel configuration through home routers/firewalls and maintaining IPsec connections when switching between Wi-Fi and cellular interfaces.
IKE Internet Key Exchange SA Security Association

Examples & real-world scenarios

Supplementary — not from your PDF
  • Two gateways authenticating with certificates from a shared CA.
  • A pre-shared key configured on both peers of a small VPN.
  • A phone keeping its IPsec VPN up while moving from Wi-Fi to cellular (MOBIKE).

Scenario

Remote users' laptops sit behind home routers and switch networks often. IKEv2 suits them better than IKEv1 thanks to NAT traversal, MOBIKE and EAP authentication against RADIUS.

Common mistakes

Supplementary — not from your PDF
  • Mixing up the phases: Phase I authenticates and does key agreement; Phase II selects the IPsec ciphers.
  • Thinking IKEv1 is designed for remote access. It needs an extra protocol for that.

Practical skills

Supplementary — not from your PDF
  • Describe the two IKE phases.
  • Explain why IKEv2 suits remote-access VPNs.

What I should remember

Key Points PDF p.147
  • IPsec Policy
    • Authentication Mechanism: AH/ESP, transport/tunnel mode.
    • Shared Secret: Mutual authentication.
  • Internet Key Exchange (IKE)
    • Function: Authentication, cryptographic ciphers, key exchange.
    • Security Association (SA): Negotiated properties.
  • IKE Phases
    • Phase I: Identity establishment, key agreement, authentication methods.
    • Phase II: Cipher and key size selection.
  • IKE Versions
    • IKEv1: Site-to-site, host-to-host, remote access VPNs.
    • IKEv2: EAP authentication, simple setup, NAT traversal, MOBIKE multihoming.