文档介绍：Advanced Topics in Encryption
Standards and Protocols
SESSION SEC-4011
Saadat Malik
Sr. Manager, Software Development
Critical Infrastructure Assurance Group (CIAG)
SEC-4011
12470_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 1
Agenda
• Analysis of Mainline Protocols
IKE V1: Current IPSec Negotiation Flow
IKE V2: New IPSec Negotiation Flow
SSH: Secure Shell Services
SSL/TLS: Secure Application Transport
• Analysis of Underlying Standards
Authentication Framework: PKI
Hashing Techniques: SHA and MD5
Encryption Protocols: 3DES and AES
• New Directions in Cryptography Standards
GCM: High Speed Authenticated Encryption
ECC: Elliptic Curve Cryptography in IPSec
SEC-4011
12470_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 2
Agenda
• Analysis of Mainline Protocols
IKE V1: Current IPSec Negotiation Flow
IKE V2: New IPSec Negotiation Flow
SSH: Secure Shell Services
SSL/TLS: Secure Application Transport
• Analysis of Underlying Standards
Authentication Framework: PKI
Hashing Techniques: SHA and MD5
Encryption Protocols: 3DES and AES
• New Directions in Cryptography Standards
GCM: High Speed Authenticated Encryption
ECC: Elliptic Curve Cryptography in IPSec
SEC-4011
12470_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 3
position
bines Three Protocols into a
Cohesive Security Framework
Provides Framework for the Negotiation
IKE of Security Parameters and
Establishment of Authenticated Keys
Provides Framework for the
ESP Encrypting, Authenticating and
Securing Data
Provides Framework for the
AH
Authenticating and Securing Data
SEC-4011
12470_04_2006_c1 © 2006 Cisco Systems, Inc. All rights reserved. Cisco Public 4
What Is IKE?
IKE ( Key Exchange) (RFC 2409)
Is a Hybrid Protocol
SKEME Oakley
Mechanism for Utilizing Modes-Based Mechanism for
Public Key Encryption Arriving at an Encryption Key
for A