WEBVTT 1 00:00.000 --> 00:09.000 So our next topic here is key management or doing key exchanges. 2 00:09.000 --> 00:14.000 Now, as we mentioned during our previous video, we are using some 3 00:14.000 --> 00:17.000 metrical algorithms to encrypt the data. 4 00:17.000 --> 00:20.000 We do this, of course, for performance reasons. 5 00:20.000 --> 00:22.000 Some metrical encryption is faster. 6 00:22.000 --> 00:24.000 However, it has a weakness. 7 00:24.000 --> 00:27.000 And the weakness is the shared key. 8 00:27.000 --> 00:32.420 We need to make sure that the key is only learned by the sender and the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:27.000 --> 00:32.420 We need to make sure that the key is only learned by the sender and the 9 00:32.420 --> 00:33.000 receiver, 10 00:33.000 --> 00:38.000 because the same key is used to both encrypt and decrypt the data, 11 00:38.000 --> 00:42.000 which means that if a bad actor were to get hold of that key, 12 00:42.000 --> 00:48.000 well, they can simply decrypt all of our data and have all of that information 13 00:48.000 --> 00:50.000 that we were trying to protect. 14 00:50.000 --> 00:56.000 So protecting that key becomes paramount to the security of our network. 15 00:56.000 --> 00:58.000 So there are a few ways to do that. 16 00:58.000 --> 01:01.000 We're going to discuss those in this video. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 16 00:58.000 --> 01:01.000 We're going to discuss those in this video. 17 01:01.000 --> 01:06.720 One of them, however, that we generally don't do anymore is hire people with 18 01:06.720 --> 01:09.000 black trench codes and briefcases, 19 01:09.000 --> 01:13.000 handcuffed to their wrist to carry that key to the other side. 20 01:13.000 --> 01:16.000 And of course, we don't do that for practicality reasons. 21 01:16.000 --> 01:22.000 But in a way, it's a very similar process, which is why I bring it up. 22 01:22.000 --> 01:28.430 We need a way to securely get that key from the sender to the receiver so that 23 01:28.430 --> 01:30.000 they can decrypt our data, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 01:30.000 --> 01:33.000 but nobody in the middle can get a hold of that key. 25 01:33.000 --> 01:36.490 So let's go ahead and take a look at some of the methods that we have to do 26 01:36.490 --> 01:37.000 that. 27 01:37.000 --> 01:46.000 So in a very broad sense, key management uses two primary key exchange methods. 28 01:46.000 --> 01:51.000 One of those is Diffie-Hellman or DH. 29 01:51.000 --> 01:57.000 And the other one is a, you can say, more updated version of Diffie-Hellman, 30 01:57.000 --> 02:02.000 which is elliptical curve Diffie-Hellman or ECDH. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:57.000 --> 02:02.000 which is elliptical curve Diffie-Hellman or ECDH. 31 02:02.000 --> 02:08.010 Now within that Diffie-Hellman family, we also have different levels of 32 02:08.010 --> 02:09.000 protection. 33 02:09.000 --> 02:11.000 This is certainly not all of them. 34 02:11.000 --> 02:16.000 These are some of the more popular ones, but you can see the generally speaking 35 02:16.000 --> 02:16.000 , 36 02:16.000 --> 02:18.000 working down our list. 37 02:18.000 --> 02:23.670 The encryption generally gets better as we go down the list or to hire Diffie- 38 02:23.670 --> 02:25.000 Hellman group numbers. 39 02:25.000 --> 02:30.300 On most modern networks, we would probably want to use one of these ECDH WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 02:25.000 --> 02:30.300 On most modern networks, we would probably want to use one of these ECDH 40 02:30.300 --> 02:32.000 options down here, 41 02:32.000 --> 02:36.000 Diffie-Hellman group 19, 20, 24. 42 02:36.000 --> 02:40.000 Again, there's a lot of other choices, but these are just some of the options. 43 02:40.000 --> 02:44.000 Now what are these groups and how do they get used? 44 02:44.000 --> 02:48.290 Well, these Diffie-Hellman groups get used by something called the Internet Key 45 02:48.290 --> 02:51.000 Exchange or IKE. 46 02:51.000 --> 02:59.000 IKE provides the negotiation of security associations or essays. 47 02:59.000 --> 03:06.000 Essays are the characteristics of the VPN, such as what authentication method WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 02:59.000 --> 03:06.000 Essays are the characteristics of the VPN, such as what authentication method 48 03:06.000 --> 03:06.000 are we using? 49 03:06.000 --> 03:09.000 What encryption type are we using? 50 03:09.000 --> 03:14.460 We'll talk more about security associations in an upcoming video after we've 51 03:14.460 --> 03:15.000 talked about 52 03:15.000 --> 03:18.200 all the different things that the Security Association is going to be 53 03:18.200 --> 03:19.000 exchanging. 54 03:19.000 --> 03:24.000 So we will get back to this topic of essays in a future video. 55 03:24.000 --> 03:31.000 The other thing that IKE provides is actual key generation and key refresh. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 03:24.000 --> 03:31.000 The other thing that IKE provides is actual key generation and key refresh. 56 03:31.000 --> 03:36.200 The main reason, of course, for key refresh is if somebody were to happen to 57 03:36.200 --> 03:38.000 get one of our keys, 58 03:38.000 --> 03:42.650 that key will at least be updated after a certain amount of time so that they 59 03:42.650 --> 03:44.000 don't get too much of our data. 60 03:44.000 --> 03:49.000 So we see here that IKE is going to use Diffie-Hellman groups, 61 03:49.000 --> 03:52.000 so let's talk a little bit more about IKE itself. 62 03:52.000 --> 03:56.000 Well, first we have just regular IKE. 63 03:56.000 --> 04:03.670 This is published in RFC 2409, and it's really made up of a bunch of other WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 03:56.000 --> 04:03.670 This is published in RFC 2409, and it's really made up of a bunch of other 64 04:03.670 --> 04:05.000 protocols. 65 04:05.000 --> 04:11.000 The first is the Internet Security Association and key management protocol, 66 04:11.000 --> 04:18.550 otherwise known as ISACAMP, the Oakley Key Determination Protocol, or just Oak 67 04:18.550 --> 04:19.000 ley, 68 04:19.000 --> 04:24.230 and SCME, which in my research I can't find if that actually stands for 69 04:24.230 --> 04:25.000 anything. 70 04:25.000 --> 04:27.000 I don't believe that it does. 71 04:27.000 --> 04:30.000 It's just the name of the protocol. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 72 04:30.000 --> 04:36.570 So these are different things used by IKE, and IKE itself is available in two 73 04:36.570 --> 04:38.000 versions. 74 04:38.000 --> 04:42.560 So we need to discuss a little bit of the difference between these two versions 75 04:42.560 --> 04:43.000 . 76 04:43.000 --> 04:47.000 So let's, of course, begin with IKE version one. 77 04:47.000 --> 04:53.000 IKE version one actually operates in two separate phases. 78 04:53.000 --> 04:58.080 So within phase one, there's also two different modes that phase one can 79 04:58.080 --> 04:59.000 operate in. 80 04:59.000 --> 05:04.000 It can operate in either main mode or aggressive mode. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 80 04:59.000 --> 05:04.000 It can operate in either main mode or aggressive mode. 81 05:04.000 --> 05:07.000 So let's talk about the attributes of each of these. 82 05:07.000 --> 05:15.000 First, main mode gives us flexible negotiation of the IKE protection policy. 83 05:15.000 --> 05:19.000 We can actually see if we sort of compare these as we go. 84 05:19.000 --> 05:26.000 Aggressive mode is limited in its negotiation of that same protection policy. 85 05:26.000 --> 05:30.000 Main mode also protects the peers identity. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 86 05:30.000 --> 05:36.690 And as we can see down here, aggressive mode does not protect the peer identity 87 05:36.690 --> 05:37.000 . 88 05:37.000 --> 05:42.000 Finally, it's main mode here that doesn't do something. 89 05:42.000 --> 05:50.600 It does not support dynamic addressing for peers if we're using PSK or pre 90 05:50.600 --> 05:52.000 shared key. 91 05:52.000 --> 05:55.000 That's one of our authentication methods. 92 05:55.000 --> 06:00.660 And as we can see to contrast that aggressive mode actually does support WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 92 05:55.000 --> 06:00.660 And as we can see to contrast that aggressive mode actually does support 93 06:00.660 --> 06:04.000 authentication for dynamically addressed peers. 94 06:04.000 --> 06:08.000 Again, that would be for the pre shared key method. 95 06:08.000 --> 06:12.000 Some of the attributes of phase two. 96 06:12.000 --> 06:18.950 Phase two is what actually negotiates that security association on behalf of 97 06:18.950 --> 06:23.000 the services such as well in our example, IP sec. 98 06:23.000 --> 06:30.030 Now, this can either use a key derived in phase one up here or it can create WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 98 06:23.000 --> 06:30.030 Now, this can either use a key derived in phase one up here or it can create 99 06:30.030 --> 06:31.000 its own key. 100 06:31.000 --> 06:38.180 We can also use Diffie-Hellman exchanges here to support something called 101 06:38.180 --> 06:42.000 Perfect Forward Secrecy or PFS. 102 06:42.000 --> 06:53.000 Now, like version two actually changes quite a few things. 103 06:53.000 --> 06:57.000 This operates over UDP port 500. 104 06:57.000 --> 07:02.000 Of course, we need to know port numbers to allow things through firewalls, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 104 06:57.000 --> 07:02.000 Of course, we need to know port numbers to allow things through firewalls, 105 07:02.000 --> 07:06.000 access control lists and other security methods. 106 07:06.000 --> 07:13.000 It also greatly simplifies that SA negotiation process. 107 07:13.000 --> 07:17.000 It actually creates a child SA in the same exchange. 108 07:17.000 --> 07:22.000 It does not need to use the whole phase one phase two method. 109 07:22.000 --> 07:25.000 So it's a much more simplified process. 110 07:25.000 --> 07:30.950 Now, since it's not doing phase one and phase two, hopefully it would be a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 110 07:25.000 --> 07:30.950 Now, since it's not doing phase one and phase two, hopefully it would be a 111 07:30.950 --> 07:37.000 little bit obvious that it's also not compatible with like version one. 112 07:37.000 --> 07:41.720 Because clearly if one is expecting to do two phases and version two is not 113 07:41.720 --> 07:46.000 doing two phases, those things are not going to work together. 114 07:46.000 --> 07:48.000 Another sort of cool feature here. 115 07:48.000 --> 07:53.000 This actually supports unidirectional authentication methods. 116 07:53.000 --> 07:57.960 So you could actually have the two peers authenticating to each other using 117 07:57.960 --> 07:59.000 different methods. 118 07:59.000 --> 08:01.000 They don't have to match. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 118 07:59.000 --> 08:01.000 They don't have to match. 119 08:01.000 --> 08:06.000 Of course, very commonly they will, but they don't have to. 120 08:06.000 --> 08:12.540 And another really important feature here is this also natively supports NAT 121 08:12.540 --> 08:15.000 traversal or NATT, 122 08:15.000 --> 08:21.000 which means we can actually use this fairly seamlessly through NAT devices. 123 08:21.000 --> 08:27.990 So in this video, we talked about key management mechanisms and exchanging keys 124 08:27.990 --> 08:35.070 using either Ike version one or Ike version two in conjunction with Diffie-Hell WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 124 08:27.990 --> 08:35.070 using either Ike version one or Ike version two in conjunction with Diffie-Hell 125 08:35.070 --> 08:36.000 man groups. 126 08:36.000 --> 08:42.640 We also touched a little bit on security associations and at least mentioned 127 08:42.640 --> 08:45.000 authentication methods. 128 08:45.000 --> 08:50.000 So next up, let's take a closer look at both of those things. 129 08:50.000 --> 08:54.660 We'll start with authentication and then we'll wrap up with talking a bit more 130 08:54.660 --> 08:57.000 about that security association.