3

Let's assume both, my VPN client and VPN gateway has public and private keys.

I encrypt my request with VPN gateway's public key. VPN gateway gets the request, decrypts it with private key. Then, VPN gateway encrypts the shared secret key it generated with my public key, then I get this request, decrypt it and now I have a shared symmetric secret key with which I can encrypt my tcp requests. Is that how it works?

Improve this question

2 Answers 2

Reset to default
2

IPSec has many modes but there are two main forms authentication for an IPSec tunnel via Internet Key Exchange (IKE) - IKEv1 and IKEv2 (newer) which support 509.X certificates or even preshared keys (such as passwords); the IKE mode selected will then use diffie-hellman (if it's selected in the config, for example) to exchange a symmetric key (as you stated) for the tunnel session (if that's the mode you are using). At this point you have a matured Security Association (SA). Now that you have a key that you are going to use for the session, IPSec has two protocols that will encapsulate your tunnel, AH and ESP. AH, Authentication Header, provides authentication but no encryption of the tunnel. ESP, Encapsulating Security Payload, uses the encryption algorithm (3DES-CBC, AES-256-CBC, etc...) that you selected in the IPSec configuration to encapsulate the traffic (tcp, udp, icmp, etc...) as it makes its way to the other device that you have the SA with. FYI, some vendors support a mix of ESP/AH protocols.

If you want to know more about IKE and IPSec check out the RFCs, they are really detailed and informative.

Improve this answer
1

Working of VPN, I would like to share you a block diagram of VPN, which will give you an idea how VPN works,

enter image description here

So as you said, there is a secure mechanism, and tunneling protocols, it keeps communication secure and encrypted. Because of those tunneling protocols, all traffic of VPN is in tunnel over the internet. You can read more about VPN here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .