I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can gather and from a client perspective:
- A client connects to a server, fetches its certificate and performs an asymmetric encryption function (ex: RSA) and SHA to validate the certificate’s signature
The client and server perform Diffie-Hellman to agree on a symmetric key what will be good for hours using each other’s public keys where I would a assume they use RSA and SHA functions 4 more times
Both carry one for hours using strictly AES and the symmetric key to encrypt the payload which integrity can be checked within the payload using a simple CRC. Not all packets are signed (otherwise RSA would be required every time and Diffie-Hellman would be pointless).
So my assumption would be that RSA and SHA are used fives time only at connection and possibly four times each time the symmetric key is renewed (typically every 24 hours, although I assume that the previously established tunnel could be used to renew the symmetric key). Is this correct? I was told we can’t use SHA-2 on a platform due to the lack of support of the cryptographic accelerator. Thanks.