Cisco Catalyst 2960 Series, Configuration Manual

Page: 1225 / 2288

CAs simplify the administration of IPSec network devices. You can use a CA with a network containing
multiple IPSec-compliant devices such as routers.
Digital signatures, enabled by public key cryptography, provide a means of digitally authenticating devices
and individual users. In public key cryptography, such as the RSA encryption system, each user has a key
pair containing both a public and a private key. The keys act as complements, and anything encrypted with
one of the keys can be decrypted with the other. In simple terms, a signature is formed when data is encrypted
with a user's private key. The receiver verifies the signature by decrypting the message with the sender's public
key. The fact that the message could be decrypted using the sender's public key indicates that the holder of
the private key, the sender, must have created the message. This process relies on the receiver's having a copy
of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender
and not to someone pretending to be the sender.
Digital certificates provide the link. A digital certificate contains information to identify a user or device, such
as the name, serial number, company, department, or IP address. It also contains a copy of the entity's public
key. The certificate is itself signed by a certification authority (CA), a third party that is explicitly trusted by
the receiver to validate identities and to create digital certificates.
In order to validate the signature of the CA, the receiver must first know the CA's public key. Normally this
process is handled out-of-band or through an operation done at installation. For instance, most web browsers
are configured with the public keys of several CAs by default. The Internet Key Exchange (IKE), an essential
component of IPSec, can use digital signatures to scalably authenticate peer devices before setting up security
associations.
Without digital signatures, one must manually exchange either public keys or secrets between each pair of
devices that use IPSec to protect communications between them. Without certificates, every new device added
to the network requires a configuration change on every other device with which it communicates securely.
With digital certificates, each device is enrolled with a certification authority. When two devices wish to
communicate, they exchange certificates and digitally sign data to authenticate each other. When a new device
is added to the network, one simply enrolls that device with a CA, and none of the other devices needs
modification. When the new device attempts an IPSec connection, certificates are automatically exchanged
and the device can be authenticated.
Implementing IPsec Without CAs
Without a CA, if you want to enable IPsec services (such as encryption) between two Cisco devices, you must
first ensure that each device has the key of the other device (such as an RSA public key or a shared key). This
requirement means that you must manually perform one of the following operations:
• At each device, enter the RSA public key of the other device.
• At each device, specify a shared key to be used by both device.
In the above illustration, each device uses the key of the other device to authenticate the identity of the other
device; this authentication always occurs when IPsec traffic is exchanged between the two devices.
If you have multiple Cisco devices in a mesh topology and wish to exchange IPsec traffic passing among all
of those devices, you must first configure shared keys or RSA public keys among all of those devices.
Every time a new device is added to the IPsec network, you must configure keys between the new device and
each of the existing devices. (In Figure 34, four additional two-part key configurations would be required to
add a single encrypting device to the network.)
Consequently, the more devices there are that require IPsec services, the more involved the key administration
becomes. This approach does not scale well for larger, more complex encrypting networks.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1143
Information About Certification Authority