HP 635n Practical IPsec Deployment for Printing and Imaging Devices - Page 30

Because IKE is so important, we are going to go through a simple construction analogy to better illustrate the key concepts. The IPsec Policy Corporation is expanding and has decided it needs a new building. The IPsec Policy Corporation has hired IKE Construction to build this company building. The company building will be very tall and will require two large cranes. IKE Construction doesn't have any cranes so it decides to build a small crane which will then be used to build the two larger cranes. IKE Construction gets together the suppliers and builders in order to build the small crane. Because there are many suspect suppliers, the IKE Corporation gives its valid builders and valid suppliers two secret passwords so that when they meet, they may authenticate each other. The builders and suppliers discuss various proposals about the materials that will be used to build the small crane. The stronger the steel that the crane will use limits the number of steel suppliers. The stronger the bolts that are used to hold the steel together also limits the number of suppliers. Finally, after many proposals, the builders and suppliers agree on one proposal. Once this proposal has been accepted, the first secret password is exchanged. If that password is valid, then the next secret password is exchanged. If that secret password is valid, then the contract is finalized and the small crane is built. Now, the same proposal process happens again for the two larger cranes. When the builders and suppliers agree on one proposal for both the large cranes, no secrets need to be exchanged because IKE Construction is using the same builders and suppliers for the large cranes as it did for the small crane. Therefore, the small crane can begin building the two large cranes. Once the large cranes have been built, IKE Construction can now work on building the actual building for IPsec Policy Corporation. As the building is being built, the larger cranes begin to suffer wear and tear. The smaller crane disassembles the larger cranes and rebuilds them, replacing worn out parts with new parts. Depending on the agreement between the builders and suppliers, the parts that are not worn out could be reused in the newly rebuilt cranes. Also, but less frequently, the small crane gets worn out too and must be rebuilt every so often. There are a few takeaways from this analogy: • The small crane represents the IKE Security Association (SA) • To establish an IKE SA, a proposal of the cryptographic algorithms must be accepted which is represented by the proposals between the builders and suppliers • IKE must authenticate the endpoints specified by the IPsec Policy - which is represented through the secret passwords here. • The process of building the small crane is called IKE Phase 1 • The IKE SA is used to build two IPsec SAs which are represented by the two large cranes. • The IPsec SAs are constructed via a different set of proposals than the IKE SA. • The process of building the two large cranes is called IKE Phase 2 • When the IPsec SAs expire or when the two large cranes suffer wear and tear, new IPsec SAs (large cranes) are rebuilt using the IKE SA (small crane). • IPsec SAs can require Perfect Forward Secrecy which represented when no parts from the worn out large crane can be reused in the next large crane being built • The IKE SA (small crane) can also expire and must be rebuilt as well. We will start with IKE Phase 1 which will establish the IKE SA. IKE Phase 1 can be done in one of two modes: Main Mode or Aggressive Mode (back to our analogy, you can think of these modes as the difference between "formal" negotiations - or main mode - and "aggressive" negotiations). For the purposes of this whitepaper, only Main Mode will be used. Main Mode looks like the following: 30