SafeNet HA4000, Руководство пользователя

Страница: 95 / 97

Glossary 95
two parties. If the HMAC is correct, it
proves that it must have been added
by the source.
HMAC
See Hash Message Authentication
Code.
I
IKE
See Internet Key Exchange.
Internet Key Exchange (IKE)
Protocol that IPSec uses to dynamically
authenticate IPSec peers, negotiate
security services, and generate shared
keys. IKE combines ISAKMP, which is
the framework for creating
connection-specific parameters, with
the Oakley key exchange, which is the
actual instance of the ISAKMP
framework for IPSec key and security
association generation.
ISAKMP
See Internet Security Association and
Key Management Protocol.
Internet Security Association and Key
Management Protocol (ISAKMP)
Protocol for establishing, negotiating,
modifying, and deleting security
associations. It provides the framework
for authentication and key exchange,
but does not define them.
integrity
Integrity ensures that the content of a
message has not been altered.
L
LDAP
See Lightweight Directory Access
Protocol.
life duration
In IKE, the life duration is a security
association’s actual lifetime. The
lifetime can be specified as either the
maximum number of seconds the SA
can be used, or as the maximum
number of kilobytes that can be
transmitted using the SA.
Lightweight Directory Access Protocol
(LDAP)
Online directory service protocol
defined by IETF. An LDAP directory
entry is a group of attributes identified
by a unique distinguished name (DN).
The directory system is hierarchically
structured.
M
Main Mode
Used during IKE Phase 1 negotiations.
It is slower than Aggressive Mode, but
it protects the negotiators’ identities.
manual keying
Method of distributing externally
generated cipher keys that are used to
protect traffic. This method does not
scale well and is unsuitable for large
installations.
MD5
See Message Digest #5.
Message Digest #5 (MD5)
Message-digest algorithm that
computes a secure, irreversible,
cryptographically strong 128-bit hash
value for a document.
P
peer
Security gateway, router, or other
device that participates in an IPSec
connection.
perfect forward secrecy (PFS)
Property of key-exchange protocols in
which the compromise of any single
key will permit access only to data
protected by that single key. For PFS to
exist, the key used to protect
transmission of data must not be used
to derive any additional keys.
PFS
See Perfect Forward Secrecy.
PKCS#12
Public key cryptography standard that
specifies the personal information
exchange syntax.