WEBVTT

1
00:00.000 --> 00:07.360
So, all of the different aspects that we're discussing about IPsec are, of

2
00:07.360 --> 00:09.000
course, important,

3
00:09.000 --> 00:13.480
but you could probably make an argument that the most important thing here is

4
00:13.480 --> 00:13.920
the data

5
00:13.920 --> 00:17.540
confidentiality or encryption.

6
00:17.540 --> 00:21.550
This of course is what's going to prevent other people from being able to read

7
00:21.550 --> 00:22.480
our private

8
00:22.480 --> 00:23.480
data.

9
00:23.480 --> 00:27.830
Now, the way that encryption works in a nutshell is we're going to take the

10
00:27.830 --> 00:29.560
data on one side,

11
00:29.560 --> 00:34.390
we're going to do a mathematical computation on it to scramble that data and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:29.560 --> 00:34.390
we're going to do a mathematical computation on it to scramble that data and

12
00:34.390 --> 00:35.080
then send

13
00:35.080 --> 00:37.200
that across the network.

14
00:37.200 --> 00:40.510
If anybody intercepts that in the middle, they're going to get data that doesn

15
00:40.510 --> 00:41.080
't mean

16
00:41.080 --> 00:44.480
anything if they don't have the key to unlock it.

17
00:44.480 --> 00:49.570
Now, of course, the receiving side needs to have the proper key to be able to

18
00:49.570 --> 00:50.160
decrypt

19
00:50.160 --> 00:54.360
that data and read it in its original unencrypted format.

20
00:54.360 --> 01:01.840
Now, there are tons of ways to do encryption out there in the world today.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:54.360 --> 01:01.840
Now, there are tons of ways to do encryption out there in the world today.

21
01:01.840 --> 01:06.270
We're going to be, of course, focusing on the ones that Cisco was going to use

22
01:06.270 --> 01:06.560
with

23
01:06.560 --> 01:10.180
their equipment and the ones that we use to connect to the various cloud

24
01:10.180 --> 01:11.000
providers.

25
01:11.000 --> 01:15.560
So, let's jump in and talk a little bit generically about how the encryption

26
01:15.560 --> 01:16.720
works and some of

27
01:16.720 --> 01:21.280
the more popular algorithms that we're going to be taking a look at.

28
01:21.280 --> 01:26.060
So, as we mentioned, there are several different ways to provide

29
01:26.060 --> 01:27.880
confidentiality, otherwise

30
01:27.880 --> 01:30.360
known as encryption.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:27.880 --> 01:30.360
known as encryption.

31
01:30.360 --> 01:33.930
And one of the main things we have to be concerned with because there are so

32
01:33.930 --> 01:35.080
many choices out

33
01:35.080 --> 01:41.410
there, we want to make sure that we're using a trusted algorithm, trusted by

34
01:41.410 --> 01:42.200
whom?

35
01:42.200 --> 01:46.240
Well, there's a lot of information out there from the cryptographic community

36
01:46.240 --> 01:46.840
where they

37
01:46.840 --> 01:51.040
rate the performance and the strength of various different encryption

38
01:51.040 --> 01:52.760
algorithms and so on.

39
01:52.760 --> 01:57.310
So, you really want to keep an eye on industry publications and reviews and so

40
01:57.310 --> 01:58.240
on of different

41
01:58.240 --> 01:59.240
algorithms.

42
01:59.240 --> 02:04.730
Now, some of the popular ones that Cisco has used over the years and/or is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:59.240 --> 02:04.730
Now, some of the popular ones that Cisco has used over the years and/or is

43
02:04.730 --> 02:05.560
currently

44
02:05.560 --> 02:06.560
using.

45
02:06.560 --> 02:13.880
Well, first, we had data encryption standard, otherwise known as DES.

46
02:13.880 --> 02:20.760
This was actually developed by IBM and this one uses a 56-bit key.

47
02:20.760 --> 02:26.180
Now, of course, that would be fairly small by today's standards and DES is

48
02:26.180 --> 02:27.480
really considered

49
02:27.480 --> 02:29.880
legacy deprecated.

50
02:29.880 --> 02:34.720
We should not be using DES anymore on today's networks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:29.880 --> 02:34.720
We should not be using DES anymore on today's networks.

51
02:34.720 --> 02:40.480
Now, an updated version of DES came out called three DES or more commonly

52
02:40.480 --> 02:41.680
triple DES.

53
02:41.680 --> 02:46.900
This one sort of built on the same architecture in that it still uses 56-bit

54
02:46.900 --> 02:47.520
keys.

55
02:47.520 --> 02:51.080
However, it uses three of them.

56
02:51.080 --> 02:54.180
So basically, it encrypts everything through key one, then it encrypts

57
02:54.180 --> 02:55.080
everything through

58
02:55.080 --> 02:58.760
key two, and then it encrypts through key three.

59
02:58.760 --> 03:04.480
So it's using three 56-bit keys to actually encrypt the data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:58.760 --> 03:04.480
So it's using three 56-bit keys to actually encrypt the data.

60
03:04.480 --> 03:10.160
That of course is going to make it much stronger than DES itself.

61
03:10.160 --> 03:16.860
And this one was actually a very common encryption standard for a very long

62
03:16.860 --> 03:17.720
time.

63
03:17.720 --> 03:23.040
Then we got the advanced encryption standard or AES.

64
03:23.040 --> 03:32.520
AES was adopted by NIST to actually replace DES and triple DES.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:23.040 --> 03:32.520
AES was adopted by NIST to actually replace DES and triple DES.

65
03:32.520 --> 03:35.360
This was meant to be its replacement.

66
03:35.360 --> 03:39.040
This one, of course, uses much longer keys.

67
03:39.040 --> 03:42.360
It started off with 128-bit.

68
03:42.360 --> 03:48.800
Most modern systems are up to 256-bit key lengths or even longer.

69
03:48.800 --> 03:53.400
And in addition to having stronger keys and therefore being a stronger

70
03:53.400 --> 03:55.080
encryption algorithm,

71
03:55.080 --> 03:59.240
along with that, hits also more efficient.

72
03:59.240 --> 04:02.480
And it's more efficient by about five times.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:59.240 --> 04:02.480
And it's more efficient by about five times.

73
04:02.480 --> 04:07.360
So this is about five times faster than DES or triple DES.

74
04:07.360 --> 04:11.310
And of course, triple DES was also a little bit slower than DES since it used

75
04:11.310 --> 04:12.080
three separate

76
04:12.080 --> 04:13.240
keys.

77
04:13.240 --> 04:16.400
But AES is a much better option.

78
04:16.400 --> 04:20.080
This is actually the option that we'll be using through most of this course.

79
04:20.080 --> 04:23.840
However, there are a few others you want to be aware of.

80
04:23.840 --> 04:30.280
Another popular option out there is software-optimized encryption algorithm or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:23.840 --> 04:30.280
Another popular option out there is software-optimized encryption algorithm or

81
04:30.280 --> 04:30.800
SEEL.

82
04:30.800 --> 04:32.240
This one is fairly decent.

83
04:32.240 --> 04:34.640
It uses a 160-bit key.

84
04:34.640 --> 04:38.620
Again, we're not going to be really focusing on this one, but be aware that it

85
04:38.620 --> 04:40.560
's out there.

86
04:40.560 --> 04:44.520
Another rather popular choice is RSA.

87
04:44.520 --> 04:48.680
This one is, of course, named after the three people who created it.

88
04:48.680 --> 04:52.040
And I am not going to attempt to say those names properly.

89
04:52.040 --> 04:55.840
However, this does use a very large key.

90
04:55.840 --> 05:00.040
RSA uses a 1024-bit key or larger.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:55.840 --> 05:00.040
RSA uses a 1024-bit key or larger.

91
05:00.040 --> 05:03.840
In most implementations, it's actually going to be larger.

92
05:03.840 --> 05:10.600
This is also an asymmetric key exchange, meaning it's not the same key used to

93
05:10.600 --> 05:11.800
encrypt and

94
05:11.800 --> 05:14.120
decrypt the data.

95
05:14.120 --> 05:20.360
Generally speaking, for IPsec, we're only going to use this for authentication

96
05:20.360 --> 05:21.720
and possibly

97
05:21.720 --> 05:23.360
for key exchange.

98
05:23.360 --> 05:27.120
It depends which key exchange choice you choose to use.

99
05:27.120 --> 05:33.930
Now as we alluded to, by saying that RSA is asymmetric, that sort of implies
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
05:27.120 --> 05:33.930
Now as we alluded to, by saying that RSA is asymmetric, that sort of implies

100
05:33.930 --> 05:34.680
that the

101
05:34.680 --> 05:39.360
other choices we looked at here are actually symmetric.

102
05:39.360 --> 05:40.720
And they are.

103
05:40.720 --> 05:46.390
These symmetric encryption algorithms are actually going to require that both

104
05:46.390 --> 05:47.400
sides have

105
05:47.400 --> 05:50.040
a common key.

106
05:50.040 --> 05:54.910
Now the problem with a common key is you have to have some way to exchange that

107
05:54.910 --> 05:55.560
key with

108
05:55.560 --> 05:57.000
the other side.

109
05:57.000 --> 06:02.280
And this, of course, has to be done in a secure fashion.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:57.000 --> 06:02.280
And this, of course, has to be done in a secure fashion.

110
06:02.280 --> 06:06.290
So our goal in this video was just to get an introduction to some of the

111
06:06.290 --> 06:07.640
different choices

112
06:07.640 --> 06:12.760
available for encryption algorithms on our Cisco devices.

113
06:12.760 --> 06:17.520
And depending on what device you have, of course, this list could vary.

114
06:17.520 --> 06:22.860
And if you're not talking strictly about Cisco VPNs with IPsec, well, there's

115
06:22.860 --> 06:23.480
actually

116
06:23.480 --> 06:28.360
a whole lot more out there in the world that you can choose to use.

117
06:28.360 --> 06:34.360
Now most of the algorithms that we use for the data itself are symmetrical.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
06:28.360 --> 06:34.360
Now most of the algorithms that we use for the data itself are symmetrical.

118
06:34.360 --> 06:40.000
And that's simply because symmetrical algorithms are faster, but they have a

119
06:40.000 --> 06:40.320
problem.

120
06:40.320 --> 06:46.320
As we mentioned, you have to be able to exchange the key securely between the

121
06:46.320 --> 06:47.440
two sides.

122
06:47.440 --> 06:51.880
And for that, we're going to want some form of a key management system.

123
06:51.880 --> 06:56.200
So let's take a look at how those operate on our networks.