Tag Info

New answers tagged

0

In IPSec transport mode, only the IP payload is encrypted, and the original IP headers are left intact. It also allows devices on the public network to see the final source and destination of the packet. With this capability, you can enable special processing in the intermediate network based on the information in the IP header. However, the ...


0

From Cisco: http://www.ciscopress.com/articles/article.asp?p=25477 Tunnel mode is most commonly used between gateways, or at an end-station to a gateway, the gateway acting as a proxy for the hosts behind it. Transport mode is used between end-stations or between an end-station and a gateway, if the gateway is being treated as a host—for ...


1

ISAKMP can be viewed as the conception framework and IKE as the concrete realization of ISAKMP. The actual implementation of IKE then uses both Oakley and SKEME to achieve its goals (all implementation but cisco one, as it doesn't use nor Oakley nor SKEME, then the confusion with ISAKMP in the cisco world, correct me if I'm wrong). in the development world, ...


1

If you are directly on the path of the information, then there is absolutely nothing preventing you from pretending you are that IP address. If you were the first device along the network that Alice talked with, you could absolutely convince her that you are Bob's IP. This is a big part of why browsers require signed certificates in order to trust SSL ...


0

So non-encrypted communication can be subject to Man in the Middle, the randomization of sequence numbers which I believe you are referencing is for thwarting data injections, that is someone could just send a packet into the stream and it can be accepted if the sequence number is known. For instance, a firewall may keep track of a tcp session to allow ...


0

Imagine the scenario using physical letters, as it's easier to picture. Say I send a letter with a return address that doesn't correspond with my actual house (or somewhere I can collect mail). What will happen to the letter? As long as the send address is correct, the mail service will deliver this letter to the correct person. However, when they want ...


0

No answer The answer to your question is dependent on which cloud storage provider you are talking about, there is no official "cloud storage security layer" shared across all providers. The best way to secure cloud data is still an open ended question, so the different attempts at it are myriad.


1

The IPsec stack does not create it's own keys, or request any keys for that matter, instead the IKE daemon generates as much key material as required for the negotiated encryption and authentication algorithms using the PRF+ (which can basically return an arbitrary amount of key material). How key material is taken from the expanded KEYMAT is described in ...


0

ISAKMP isn't a protocol as much as a framework for key exchanges (I know it has protocol in the name). Implementations of the framework include the Internet Key Exchange (IKE) and Kerberized Internet Negotiation of Keys (KINK). If you read the ISAKMP RFC (RFC2408) it has a nice diagram for where ISAKMP sits in the network stack. RFC2408 Section 2.2 ...


1

According to this and Wikipedia, the OSI Session Layer is responsible for setting up any kind of conversation/dialogue. As ISAKMP runs on top of UDP (port 500) and it sets up a secure and authenticated channel for communication, i would say that it is part of OSI Session Layer.



Top 50 recent answers are included