CCS2000-tutorial

Network Security and IPsec Part 2 Angelos D. Keromytis University of Pennsylvania John Ioannidis AT&T Labs - Research Key Management - The Need Manual/Static Keying Tedious Prone to Misconfiguration Requires Significant Human Intervention Typically Weak Keys Does not Scale Boring Key Establishment Needs Automation Key Management - Requirements Negotiate SA Parameters Capabilities vs. Desired Configuration Establish Strong Keys Dynamic Rekeying Increased Security Crash Recovery Require Minimal Configuration No Human Intervention Key Management - Requirements Algorithm Independence Identity Protection Forward Secrecy If Needed Fast Scalable Cure Cancer Simplicity Not A Requirement! Key Management - Situation ISAKMP Oakley Internet Key Exchange (IKE) Photuris SKIP KINK Will Focus on IKE ISAKMP Framework for Writing Security Protocols Standardized Payloads Exchange Types Payload Processing Rules Flexibility Domain Of Interpretation Concept Internet Key Exchange (IKE) Combination of ISAKMP and Oakley Uses UDP (port 500) Two Phase Protocol Establish Secure Channel Authenticate Peers Negotiate Application Parameters Various Authentication Mechanisms Key Agreement Diffie-Hellman Kerberos (W2K) Diffie-Hellman Algorithm Small Integer g, Generator for p ...