iSG4F
User’s Manual
iS5 Communications Inc.
132
Authentication method (PSK ,X.509)
Diffie–Hellman key exchange group (a.k.a OAKLY groups)
IKE exchange mode
o
Main
o
Aggressive
Encryption algorithm
o
Advanced Encryption Standard (AES)
128 and 256 key size options
symmetric algorithm
o
Triple Data Encryption Algorithm (3DES)
comprises of three DES keys, K1, K2 and K3, each of 56 bits
Authentication s HASH algorithms
Secure Hash Algorithm SHA-1 (160 bit)
Secure Hash Algorithm SHA-2 (256 |512 bit)
Message Digest (MD5) (128 bit)
Life time and Dead Peer Discovery settings
24.15.2
ISAKMP Phase 2
At this phase the negotiation of SA to secure the VPN GRE data using IPSec is made.
Modes
The common mode to use between end stations supporting IPSec (the VPN parties) is called
Transport mode. This is the mode supported by iS5.
Perfect forward secrecy (PFS)
The PFS is a part of the key agreement session and has a purpose to ensure that a session key
derived from a set of long-term public and private keys will not be compromised if one of the
(long-term) private keys is compromised in the future. The VPN (GRE, IPSEC) sessions can
negotiate new keys for every communication and if a key is compromised only the specific
session it protected will be revealed.
The PFS uses as well the D-H groups but independently from phase 1.
Settings structure