I am pretty new when it comes to information security. And before I move on with more specific things I wanted to ask if I understood the three main parts of IPsec correctly: authenticity, confidentiality & integrity.
My focus here lays on VPN connections and the general term of the three topics. I am going to write down what I - so far - understood and hope that you can help me by correcting wrong statements.
Maybe some facts to the background of this question. I was setting up an IPsec tunnel for test purposes and want do declare if I understood all parts correctly. So the general purpose of an IPsec (site to end / remote access) tunnel is, that e.g. a home office user is able to connect to a company network and therefore access resources that are located within this. The main focus of IPsec is to provide the three purposes of authenticity, confidentiality & integrity. But what does this mean?
Integrity: Integrity is used to make sure that nobody in between site A and B (for example) changed some parts of the shared information. Therefore a hash is calculated and added to a packet. This can be achieved by using hashing algorithms like MD5, SHA(1,2) and so on. To really make sure that no one is even able to modify the hash HMACs are used. This stands for hashed message authentication code. The main difference between a hash and a hmac is that in addition to the value that should be hashed (checksum calculated) a secret passphrase that is common to both sites is added to the calculation process. E.g. [Value that should be hashed] + [secret passhrase] -> Hashed value of this "two" inputs. Here comes my first question: Can this be compared with a "salt"? Or what exactly is the difference between a HMAC and a Hash + Salt? And what is Pepper, if a Hash + Salt equals a HMAC?
Confidentiality: Confidentiality is used to make sure that nobody in between site A and B is able to read what data or information is sent between the to sites. To achieve this encryption algorithms are used. There are two kinds of encryption algorithms, symmetric and also asymmetric ones. Symmetric algorithms allow encryption and decryption with the same key. With asymmetric algorithms you have to kinds of keys: a public one and also a private one. The public key is often available to the public while the private key is just available for "yourself" (if the mentioned keypair is yours). Everything that you encrypt with the public key can only be decrypted with the private one and vice versa. When it comes to confidentiality you often just use symmetric algorithms like DES, 3DES (both outdated) or AES. Asymmetric encryption is used to transfer a symmetric key and also to make sure that the other site is really who it seems to be (when it comes to SSL/TLS).
Authenticity: And this last sentence of the confidentiality part leads directly to the authenticity part. Authenticity is used to make sure that you really communicate with the partner you want to. To achieve these different kinds of techniques can be used, e.g. Pre-shared keys that are configured on both sites, Elliptic Curves or RSA as public/private key algorithms.
This is the part where I think that I misunderstood lots of aspects. Because I am not sure, where the exact difference between authenticity and confidentiality lays, as both seem to focus on de/encryption (except if you are using a PSK for authenticity). And I know that Diffie Hellman is used when it comes to an IPsec tunnel. As far as I know the Diffie Hellman algorithm is not an encryption algorithm, but it is used to transfer a symmetric encryption/decryption key over an unsecured network (like the internet). So is DH part of authenticity, because (e.g.) only site A and B are able to calculate and transfer a symmetric key? But how does this prove that e.g. site B is really site B and not an attacker?
Is it correct that I can compare the RSA or EC process with SSL/TLS with the exception that SSL/TLS adds digital certificates with digital signatures (HMACs) in addition?