WEBVTT

1
00:00.000 --> 00:07.440
Of course, another important factor in any form of security is to make sure

2
00:07.440 --> 00:08.160
that you're

3
00:08.160 --> 00:13.360
actually talking to the other party that you think you're talking to.

4
00:13.360 --> 00:17.400
And what we're talking about here is, of course, authentication.

5
00:17.400 --> 00:22.030
We need to make sure that both sides authenticate to each other so that we

6
00:22.030 --> 00:23.280
verify that the two

7
00:23.280 --> 00:27.560
proper parties are involved in this communication.

8
00:27.560 --> 00:30.800
So in this video, we're going to talk about the various ways we can do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:27.560 --> 00:30.800
So in this video, we're going to talk about the various ways we can do

9
00:30.800 --> 00:31.720
authentication

10
00:31.720 --> 00:33.560
with IPsec.

11
00:33.560 --> 00:38.100
And then we'll wrap up with talking about a little detail about those security

12
00:38.100 --> 00:38.960
associations

13
00:38.960 --> 00:41.960
or SAs that we've mentioned previously.

14
00:41.960 --> 00:47.880
Well, let's talk a little bit more about what they actually entail.

15
00:47.880 --> 00:51.970
So let's begin by talking about the different types of authentication that we

16
00:51.970 --> 00:52.680
can use.

17
00:52.680 --> 00:58.150
The first one we're going to talk about is pre-shared key, often referred to as

18
00:58.150 --> 00:58.600
just

19
00:58.600 --> 01:02.600
PSK or just pre-shared.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:58.600 --> 01:02.600
PSK or just pre-shared.

20
01:02.600 --> 01:05.240
This is actually a fairly straightforward process.

21
01:05.240 --> 01:11.080
What we're going to do is we're going to create a key and this key is going to

22
01:11.080 --> 01:11.360
be

23
01:11.360 --> 01:15.200
manually entered on each peer.

24
01:15.200 --> 01:19.610
In a way, this is sort of like the joke I made earlier about the secret agents

25
01:19.610 --> 01:20.120
in their

26
01:20.120 --> 01:24.400
trench coats and their briefcase handcuffed to their wrist.

27
01:24.400 --> 01:31.040
We are responsible for getting this key to the other side safely and securely.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:24.400 --> 01:31.040
We are responsible for getting this key to the other side safely and securely.

28
01:31.040 --> 01:36.400
And also, since it is being done manually, sort of the biggest downside here to

29
01:36.400 --> 01:37.280
pre-shared

30
01:37.280 --> 01:44.560
key is clearly this is not going to scale very well if we have a lot of VPNs or

31
01:44.560 --> 01:45.200
IPsec

32
01:45.200 --> 01:46.200
tunnels.

33
01:46.200 --> 01:51.840
Now, one advantage to this is it is very, very easy to do.

34
01:51.840 --> 01:56.390
And therefore, I just want you to understand as we progress through this course

35
01:56.390 --> 01:57.080
, we will

36
01:57.080 --> 02:03.290
actually be doing pre-shared key on most of our IPsec tunnels because this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:57.080 --> 02:03.290
actually be doing pre-shared key on most of our IPsec tunnels because this

37
02:03.290 --> 02:04.560
being a lab,

38
02:04.560 --> 02:07.720
we're only going to build a couple tunnels here and there.

39
02:07.720 --> 02:14.280
And our main focus in this course is not really on the authentication process.

40
02:14.280 --> 02:19.310
We're going to be focusing on IPsec, yes, but not so much in on authentication

41
02:19.310 --> 02:20.160
itself.

42
02:20.160 --> 02:24.960
So we'll actually be doing quite a bit of pre-shared keys.

43
02:24.960 --> 02:30.550
And during the actual authentication process, this pre-shared key is actually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
02:24.960 --> 02:30.550
And during the actual authentication process, this pre-shared key is actually

44
02:30.550 --> 02:31.720
combined with

45
02:31.720 --> 02:38.680
other information on the peers to actually form the authentication key itself.

46
02:38.680 --> 02:43.020
That way it cannot just be simply intercepted on the wire.

47
02:43.020 --> 02:47.160
The next method is RSA signatures.

48
02:47.160 --> 02:54.780
RSA signatures involve a digital certificate used to authenticate the peers.

49
02:54.780 --> 02:58.940
The real key to this is the digital certificates.

50
02:58.940 --> 03:03.090
This makes it a little more difficult to use this in a lab environment, but
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:58.940 --> 03:03.090
This makes it a little more difficult to use this in a lab environment, but

51
03:03.090 --> 03:03.960
also much more

52
03:03.960 --> 03:09.540
scalable and generally considered a more secure method for production.

53
03:09.540 --> 03:15.890
As part of this process, a message hash is going to be derived and encrypted

54
03:15.890 --> 03:16.400
with the

55
03:16.400 --> 03:18.760
private key.

56
03:18.760 --> 03:26.280
That encrypted hash is then attached to the message and acts as a signature.

57
03:26.280 --> 03:34.010
When this traffic arrives at the remote peer, it uses the public key to decrypt
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
03:26.280 --> 03:34.010
When this traffic arrives at the remote peer, it uses the public key to decrypt

58
03:34.010 --> 03:35.280
the hash.

59
03:35.280 --> 03:41.510
Now sort of one of the key factors here is the public key is going to be used

60
03:41.510 --> 03:42.400
to decrypt

61
03:42.400 --> 03:45.740
the other devices private key.

62
03:45.740 --> 03:49.540
And of course, this will happen in both directions.

63
03:49.540 --> 03:54.100
This one is probably one of the more popular methods out there.

64
03:54.100 --> 03:56.980
There's also a slightly different version of RSA signatures RSA encrypted n

65
03:56.980 --> 04:01.740
ounces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:56.980 --> 04:01.740
ounces.

66
04:01.740 --> 04:07.180
A nounce is simply a random number that's generated by the peer.

67
04:07.180 --> 04:11.670
This is essentially adding a seed to make this harder to do something like a

68
04:11.670 --> 04:13.660
replay attack.

69
04:13.660 --> 04:18.060
So we're still going to be using RSA, but we're going to use this to encrypt

70
04:18.060 --> 04:18.660
the nounce

71
04:18.660 --> 04:22.500
value and possibly other values.

72
04:22.500 --> 04:28.750
Now of course, just like before, each peer still has to be aware of the public

73
04:28.750 --> 04:29.100
key of

74
04:29.100 --> 04:33.060
the other peer because that's going to be used to decrypt the information from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
04:29.100 --> 04:33.060
the other peer because that's going to be used to decrypt the information from

75
04:33.060 --> 04:33.820
the private

76
04:33.820 --> 04:35.120
key.

77
04:35.120 --> 04:41.060
Now once what are downside here is that these public keys must be again

78
04:41.060 --> 04:42.580
manually copied

79
04:42.580 --> 04:44.740
to each peer.

80
04:44.740 --> 04:50.520
And I think probably because of this third point, this is generally going to be

81
04:50.520 --> 04:51.500
the least

82
04:51.500 --> 04:55.340
used of the authentication methods.

83
04:55.340 --> 05:00.370
Another method that's out there is the Ecliptic Curve Digital Signature Al
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
04:55.340 --> 05:00.370
Another method that's out there is the Ecliptic Curve Digital Signature Al

84
05:00.370 --> 05:04.300
gorithm or ECDSA.

85
05:04.300 --> 05:10.700
This uses an elliptic curve analog of the DSA signature method.

86
05:10.700 --> 05:17.190
Again, DSA being Digital Signature Algorithm, these signatures are actually

87
05:17.190 --> 05:18.300
smaller than

88
05:18.300 --> 05:20.660
RSA signatures.

89
05:20.660 --> 05:27.360
And because they're smaller, they can be computed quicker than similar strength

90
05:27.360 --> 05:29.060
RSA operations.

91
05:29.060 --> 05:33.210
So this is just some general information on the different authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
05:29.060 --> 05:33.210
So this is just some general information on the different authentication

92
05:33.210 --> 05:33.940
methods.

93
05:33.940 --> 05:39.700
Again, the two most popular would be pre-shared key in either small or lab

94
05:39.700 --> 05:41.540
environments and

95
05:41.540 --> 05:46.020
RSA in larger enterprise class environments.

96
05:46.020 --> 05:48.340
That's just a generalization.

97
05:48.340 --> 05:52.820
So let's wrap up then with talking a little bit about those security

98
05:52.820 --> 05:54.180
associations that

99
05:54.180 --> 05:57.980
we've been mentioning throughout the rest of this skill.

100
05:57.980 --> 06:03.690
The job of the security association is really to be a description of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
05:57.980 --> 06:03.690
The job of the security association is really to be a description of the

101
06:03.690 --> 06:05.420
traffic protection

102
06:05.420 --> 06:06.820
mechanisms.

103
06:06.820 --> 06:13.020
You can almost look at it as a negotiation of the parameters between the two

104
06:13.020 --> 06:13.940
peers.

105
06:13.940 --> 06:19.580
For example, what algorithms are we going to be using for our encryption?

106
06:19.580 --> 06:23.260
What are the keys that we're going to be using for the traffic encryption?

107
06:23.260 --> 06:25.460
This is that key management.

108
06:25.460 --> 06:28.740
What traffic is it that we're going to be encrypting?

109
06:28.740 --> 06:30.500
And of course, a lot more parameters.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
06:28.740 --> 06:30.500
And of course, a lot more parameters.

110
06:30.500 --> 06:35.630
We're not going to list them all out here, but this is basically so both peers

111
06:35.630 --> 06:36.300
know how

112
06:36.300 --> 06:38.660
we're handling the traffic.

113
06:38.660 --> 06:45.580
Now, both AH and ESP use these security associations.

114
06:45.580 --> 06:50.220
These essays are defined per flow.

115
06:50.220 --> 06:55.280
And again, we did mention this before, but remember that it's Ike's job to

116
06:55.280 --> 06:56.060
establish

117
06:56.060 --> 07:00.620
and maintain these security associations.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
06:56.060 --> 07:00.620
and maintain these security associations.

118
07:00.620 --> 07:04.740
This is done, of course, after authentication.

119
07:04.740 --> 07:11.780
And also keep in mind that because these essays are per flow, bidirectional

120
07:11.780 --> 07:13.220
traffic is going

121
07:13.220 --> 07:20.740
to require two security associations, one in each direction.

122
07:20.740 --> 07:26.120
So in this video, we started off by covering some popular methods of doing

123
07:26.120 --> 07:27.460
authentication.

124
07:27.460 --> 07:32.370
The most important ones, of course, being our pre-shared key, better for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
07:27.460 --> 07:32.370
The most important ones, of course, being our pre-shared key, better for

125
07:32.370 --> 07:33.940
smaller environments

126
07:33.940 --> 07:36.460
and lab environments generally.

127
07:36.460 --> 07:41.570
And then we took a look at RSA signatures using certificates, which generally

128
07:41.570 --> 07:42.140
scales

129
07:42.140 --> 07:47.420
much better and is more appropriate in an enterprise type environment.

130
07:47.420 --> 07:52.140
We wrapped up here by taking a look at some more detail about security

131
07:52.140 --> 07:53.580
associations that

132
07:53.580 --> 08:01.020
are the things exchanged by Ike to sort of negotiate the parameters for IPsec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
07:53.580 --> 08:01.020
are the things exchanged by Ike to sort of negotiate the parameters for IPsec.

133
08:01.020 --> 08:06.510
So that covers everything that we need to discuss in this skill, leaving us

134
08:06.510 --> 08:07.300
with just

135
08:07.300 --> 08:08.740
the challenge.

136
08:08.740 --> 08:13.250
So go ahead and tackle that and I'll see you in the solution video after the

137
08:13.250 --> 08:14.180
challenge.