Virtual Private Network Services 187communications can range in length, but are typically 16 or 32characters. The longer the key, the more difficult it is to break theencryption. The reason for this is most methods used to breakencryption involve trying every possible combination of characters,similar to trying to open a safe when the combination is not known. Asymmetric vs. Symmetric CryptographyAsymmetric and symmetric cryptography refer to the keys used toauthenticate, or encrypt and decrypt the data.Asymmetric cryptography does not use the same key to verify thedata. Asymmetric cryptography is often referred to as public keycryptography. With public key, each user gets a pair of keys, one calledthe public key and the other called the private key. The private key isalways linked mathematically to the public key to be kept secret. Allcommunications involve only public keys; the private key is nevertransmitted or shared, but used to decrypt the message. A user cangenerate their own keys using key generation software, or have keysgenerated by trusted organizations. Once a key has been generated,the user must register his or her public key with a centraladministration, called a Certifying Authority (CA). Organizations, suchas RSA Data Security and Verisign, can help users issue and registerkey pairs.The Firewall VPN uses Symmetric Cryptography. As a result, the key onboth ends of the VPN tunnel must match exactly. Authentication Header (AH)The Authentication Header is a mechanism for providing strongintegrity and authentication for IP packets. Confidentiality andprotection from traffic analysis are not provided by the AuthenticationHeader.The IP Authentication Header provides security by addingauthentication information to an IP packet. This authenticationinformation is calculated using all header and payload data in the IPpacket. This provides significantly more security that is currentlypresent in IP.Use of AH will increase the processing requirements in the Firewall andwill also increase the communication latency. The increased latency isprimarily due to the calculation and comparison of the authenticationdata by the receiver for each IP packet containing an AuthenticationHeader. Data Encryption Standard (DES)DUA1611-0AAA02.book Page 187 Thursday, August 2, 2001 4:01 PM
