HP StorageWorks 1606 Brocade Web Tools Administrator's Guide v6.3.0 (53-100134 - Page 291

IPSec Concepts 17 Internet Key Exchange (IKE) Concepts Key exchange is used to authenticate the end points of an IP connection, and to determine security policies for IP traffic over the connection. The initiating node proposes a policy based on the following: • An encryption algorithm to protect data. • A hash algorithm to check the integrity of the authentication data. • A Pseudo-Random Function (PRF) algorithm that can be used with the hash algorithm for additional cryptographic strength. • An authentication method requiring a digital signature, and optionally a certificate exchange. • A Diffie-Hellman exchange that generates prime numbers used in establishing a shared secret key. Encryption algorithms An encryption algorithm is used to encrypt messages used in the IKE negotiation. Table 20 lists the available encryption algorithms. A brief description is provided. If you need further information, please refer to the RFC. TABLE 20 Encryption algorithm options Encryption Algorithm Description RFC Number 3des_cbc null_enc aes128_cbc aes256_cbc 3DES processes each block three times, using RFC 2451 a unique 56-bit key each time. No encryption is performed. Advanced Encryption Standard (AES) 128 bit block cipher. RFC 4869 Advanced Encryption Standard (AES) 256 bit block cipher. RFC 4869 Hash algorithms Hash message authentication codes (HMAC) check data integrity through a mathematical calculation on a message using a hash algorithm combined with a shared, secret key. The sending computer uses the hash function and shared key to compute a checksum or code for the message, and sends it to the receiving computer. The receiving computer must perform the same hash function on the received message and shared key and compare the result. If the hash values are different, it indicates that a third party may have tampered with the message in transit, and the packet is rejected. TABLE 21 Hash algorithm options Hash Algorithm Description RFC/Publication Number aes_xcbc hmac_md5 hmac_sha1 Uses a cypher block and extended cypher block RFC 3566 chaining (CBC). The MD5 computation produces a 128-bit hash. RFC 1321 The SHA1 computation produces a 160-bit hash. FIPS Pub 180-1 Web Tools Administrator's Guide 259 53-1001343-01