Encryption and Authentication

C

cb9fl

Limp Gawd
Joined
Jan 2, 2006
Messages
456
The basics:

Two parties want to communicate securely
1. A tells B what group # to use for Diffie-Hellman
2. A and B create public/private keys and share the public keys
3. A uses its private key and B's public key to create a new key
4. A uses the new key to encrypt the chosen symmetric key
5. A shares the encrypted symmetric key with B
6. B uses its private key and A's public key to create a new key
7. B uses the new key to decrypt the symmetric key given to it by A
8. A and B both share a symmetric key which has never passed unencrypted across a network

Is the Symmetric key created above used for both data encryption and packet authentication (3DES and MD5)? If not which key is used for encryption and which is used for packet authentication?

Is Diffie-Hellman used solely to created a shared symmetric key for encryption while pre-shared keys or digital certificates are used for packet authentication? If so why go through the process of DH when you have to manually enter the pre-shared key anyways? Why not simply enter the encryption keys at the same time?
 
Yes, VPN based Authentication and Encryption. From what I can gather the only way two hosts can truly authenticate each other is through the use of pre-shared keys or certificates. If they use pre-shared keys then why does Diffie-Hellman need to be used? I thought the whole purpose of DH was to share keys over an insecure medium. If pre-shared keys are used then keys are shared out of band anyways so DH doesn't need to be used.
 
The pre-shared keys/digital signatures are used to authenticate the devices. I believe they are also used in conjunction with DH in creating a hash that is used to provide authentication for the phase 1 exchange. You can read all about that in RFC 2409.

DH is also used in phase 2 to provide material for the generation of non-IKE/ISAKMP keys - such as key generation for IPSec.
 
Here is how I understand it (which I could be wrong or mislead):

Diffie-Hellman is used solely to generate the key shared between the devices. Then the
packets are encrypted by DES (or 3DES or AES) based off that key.

DH is used because it never sends the key in an unencrypted form. Basically the sending device sends out a hash based off the pre-shared key to the receiving device. The receiving device then sends a different hash back based on the preshared key. Both devices take the hashes and decode them and if the keys match then they authenticate.

So once the devices have established a link using DH then they encrypt the packets and everything is protected from the beginning.

Years ago I actually did an experiment utilizing the formulas for DH to gain a better understanding. It is actually quite fascinating how it works.
 
Yeah I think it's interesting how research into primes had little real world application until it's use in cryptography.
 
I took an intro to cryptography class at school one summer and it was awesome. The math wasn't all that hard and when we talked about MD5, DES, or say Diffie-Hellman, it was cool to see how that math applied to real word stuff to make sense.

Also, its interesting to see modular arithmetic being useful for cyrptography.
 
You must log in or register to reply here.
Back
Top