INS_RL1000GW_REV– 15 Jul 2016 PAGE 140
INSTALLATION AND OPERATION MANUAL
RL1000GW
TECH SUPPORT: 1.888.678.9427
Phase 1 is where the two ISAKMP VPN peers establish a secure, authenticated channel with which
to communicate. This is called the ISAKMP Security Association (SA)or IKE Security Association.
The authentication is supported with Pre-Shared Keys or Digital Signatures (X.509)
Diffie and Hellman
Diffie and Hellman describe a means for two parties to agree upon a shared secret. This secret
may then be converted into cryptographic keying material for other (symmetric) algorithms.
Diffie-Hellman key agreement requires that both the sender and recipient of a message have key
pairs.
The private key of each member is never sent over the insecure channel.
The public key is generated from the private key by each member and is the one sent over the
insecure channel.
By combining one’s private key and the other party’s public key, both parties can compute the
same shared secret number.
This number can then be converted into cryptographic keying material. That keying material is
typically used as a key-encryption key (KEK) to encrypt the VPN GRE traffic. This key is kept secret
and never exchanged over the insecure channel.
The D-H groups are identified by the length of the keys in bits. The larger the key (higher group
id)the higher is the security but as well the resources required are higher and the user should
consider performance degradation.
The D-H exchange can be authenticated with RSA signatures or pre-shared keys.
The exchange modes are “Main Mode” and “Aggressive Mode” and are accomplished at the
phase 1.
Authentication
Pre-shared Key (PSK)
A PSK is an option for the IKE phase 1 authentication.
The encryption, hash, and authentication algorithm for use with a pre-shared key are a part of the
state information distributed with the key itself.
Each VPN end point (Hubs, Spokes) must have a unique ID and a common shared key known to
the remote VPN partner. Together these form the station PSK.
When a pre-shared key is used to generate an authentication payload, the certification authority
is “None”, the Authentication Type is “Preshared”, and the payload contains the ID, encoded as
two 64-bit quantities, and the result of applying the pseudorandom hash function to the message
body with the KEY forming the key for the function
