HP A7533A - Brocade 4Gb SAN Switch Base, Administrator'S Manual

Page: 152 / 576

150 Configuring advanced security features
operations), not a Feistel network. The cipher is specified in terms of repetitions of processing steps that are
applied to make up rounds of keyed transformations between the input plain-text and the final output of
cipher-text. A set of reverse rounds is applied to transform cipher-text back into the original plain-text using
the same encryption key. AES is fast in both software and hardware, is relatively easy to implement, and
requires little memory
Null encryption
A null cipher is an ancient form of encryption where the plaintext is mixed with a large amount of
non-cipher material. Today, it is regarded as a simple form of steganography. Null ciphers can also be
used to hide ciphertext, as part of a more complex system. In modern cryptology, null cipher is also defined
as choosing not to use encryption in a system where various encryption options are offered, such as for
testing/debugging, or authentication-only communication.
IPsec policies
An IPsec policy determines the security services afforded to a packet and the treatment of a packet in the
network. An IPsec policy allows classifying IP packets into different traffic flows and specifies the actions or
transformations performed on IP packets on each of the traffic flows. The main components of an IPsec
policy are: IP packet filter and selector (IP address, protocol, and port information), and transform set.
IPsec traffic selector
The traffic selector is a traffic filter that defines and identifies the traffic flow between two systems that have
IPsec protection. IP addresses, the direction of traffic flow (inbound, outbound) and the upper layer
protocol are used to define a filter for traffic (IP datagrams) that is protected using IPsec.
IPsec transform
A transform set is a combination of IPsec protocols and cryptographic algorithms that are applied on the
packet after it is matched to a selector. The transform set specifies the IPsec protocol, IPsec mode and
action to be performed on the IP packet. It specifies the key management policy that is needed for the IPsec
connection and the encryption and authentication algorithms to be used in security associations when IKE
is used as the key management protocol.
IPsec can protect either the entire IP datagram or only the upper-layer protocols. The appropriate modes
are called tunnel mode and transport mode . In tunnel mode the IP datagram is fully encapsulated by a
new IP datagram using the IPsec protocol. In transport mode only, the payload of the IP datagram is
handled by the IPsec protocol; it inserts the IPsec header between the IP header and the upper-layer
protocol header.
IKE policies
When IKE is used as the key management protocol, IKE policy defines the parameters used in IKE
negotiations needed to establish IKE SA and parameters used in negotiations to establish IPsec SAs. These
include the authentication and encryption algorithms, and the primary authentication method, such as
preshared keys or a certificate-based method, such as RSA signatures.
Key management
The IPsec key management supports Internet Key Exchange or Manual key/SA entry. The Internet Key
Exchange (IKE) protocol handles key management automatically. SAs require keying material for
authentication and encryption. The managing of keying material that SAs require is called key
management .
The IKE protocol solves the most prominent problem in the setup of secure communication: the
authentication of the peers and the exchange of the symmetric keys. It then creates the security associations
and populates the SADB.
The manual key/SA entry requires the keys to be generated and managed manually. For the selected
authentication or encryption algorithms, the correct keys must be generated using a third party utility on
your LINUX system. The key length is determined by the algorithm selected.
Linux IPsec-tools 0.7 provides tools for manual key entry (MKE) and automatic keyed connections. The
LINUX
setKey
command can be used for manually keyed connections, which means that all parameters
needed for the setup of the connection are provided by you. Based on which protocol, algorithm, and key