What we are going to be covering today as we talked about it, is this concept of VPNs.
What is VPN?
What is a VPN?
A virtual
private.
What do you think a virtual private network means?
Virtual private network, Right.
It's a virtual private network, which means it's private through something else.
Private through what?
A public domain.
When I talk about VPNs here, I'm going to talk about layer three VPNs.
As I said yesterday, L2, VPNs.
I told you what those are, right?
What are l2 VPNs?
Your Mpls frame relay.
What happened?
Mpls Frame relay.
VLANs.
Right.
So encapsulation at layer two is a VPN, but l2 VPNs.
What we are going to be dealing with are the new kind which deals with layer three encapsulation known
as what?
L3 VPNs.
Now under layer three VPNs.
There are different classifications.
Many different classifications.
You have you can classify them as, let's say, site to site.
What is the side to side?
Side to side means you have two different sides.
Eight connected eventually through the Internet.
Right.
And you want to connect them together, but you want to make sure that it's secure.
So you'll create a tunnel, a VPN, between the two sites.
That would be a site to site VPN.
Now, this can be of many types.
It can be one site to another site.
You can add more sites on top of this.
So maybe you have one here, one here, one here.
But again, these are all sites connecting together.
Right.
That's one kind.
The other way.
The other kind is called remote remote access VPN.
I'm sorry, a remote access VPN.
What is a remote access VPN?
You will have a server sitting somewhere around on the internet.
Right.
And then people.
Sitting at different corners.
Now, this doesn't necessarily have to be a router.
It could be a PC connecting up to the Internet.
This address that he's receiving doesn't have to be a static address, doesn't have to be a leased line
address.
It can be a dynamic address in remote access VPN.
All these people need to connect up to the network, to their corporate network.
HQ is an internet connection.
They can create dynamic tunnels.
With your actual server or your company headquarters.
Right.
Called what?
Remote access.
VPN access.
Something remotely.
Right.
So two types of classifications we saw.
L2 and L3 VPNs.
You could characterize them on the basis of site to site or remote access VPNs.
There are still many more.
We'll see them.
We'll have a look at them when we go to that point.
There's point to point, point to multipoint and some other stuff.
Right.
So now this should be enough.
Now, when I talk about this tunnel, I say a tunnel.
A tunnel.
I talked about a tunnel.
What is this tunnel and how is this secure?
That's what we are going to be talking about today.
What is this tunnel and why?
And how is it secure?
There are two main kind of, let's say, two protocols that support tunneling out there that are very
famous there.
There's IPsec, there is SSL.
The IPsec and SSL SSL.
We are not going to have a look today for a long time to come.
Our main focus is going to be where?
IPCC.
What are the strongest technologies out there?
When you talk about VPNs here in this course, you're talking about IPsec VPNs.
Yes, you do have to worry about SSL VPN, too.
SSL is more widely used than IPsec.
By the time you are over with IPsec and SSL, you will know why SSL is more famous than IPsec.
Is it more secure?
I wouldn't think so.
IPsec, as you will see, has a lot of security measures with SSL.
VPN does not provide you.
But why is SSL more famous?
Because it's easier to implement.
That's the only reason.
And it's widely supported.
It's openly supported by a lot of vendors.
Right.
And everybody is following the same.
So SSL is a little more used than.
IPsec Wigman's.
Okay.
Have you ever heard about the TCP IP suite?
I'm sure you have the TCP IP suite.
What is the TCP IP suite?
A collection of different protocols.
Right.
There's an IP protocol in there somewhere, right?
Somewhere around the same.
There's an IP running, there's OSPF running.
So when you talk about TCP IP, you're talking about the four layers, right?
You had your application layer, then you have your layer three, layer two, layer one.
So all the protocols that are running here, Ethernet.
Our serial frame relay DLC.
Whatever is running here comes under the same suite.
Right.
You have it running here.
Right.
You might have Appletalk, Novell.
All of those things running here also comes under.
Obviously, this is the TCP IP I'm talking about the OSI here.
Only IP runs the TCP IP.
Transport.
Transport is left for an application.
Transport.
L4, L3 and these two are combined, right?
This is L4 L3.
Correct.
Thank you.
The last two are combined into one and this becomes your IP.
On top of this here can be many different protocols.
You can either have L four or you could have EGP, you can have OSPF, you could have ICMP or you could
have TCP, UDP.
If you have TCP, UDP or on layer four, if you're on layer four, you have to go right here.
So you can have port number 80, which leads you to Http and all the different services of TCP, all
the different services of UDP.
All of this comes under were under this big suite of TCP IP.
If you want to have a broader look at it, you can go to the OSI model, which can give you more wider
ranges of protocols.
But my question is, my focus right now for you guys should be have a look at the TCP IP suite just
like TCP IP is a suite exact same way.
Your IPsec is also a suite of protocols.
It's not one protocol, it's a collection, a combination of many different protocols coming together
for a great event.
Right.
You'll see many different things.
Authentication is here.
Encryption is here.
So many different things coming together to provide that one big tunnel, which gives you security in
many different ways.
Okay, let's have a look at that.
Actually, all these technologies coming together.
IPsec Right.
IPsec has mechanisms to provide you.
First of all, it's.
We call it integrity.
Integrity.
What is integrity?
If you look at it with English, pure English, what does integrity mean?
Yes.
Trustworthiness of trustworthiness of data.
Right.
If you talk about it in pure English terms, when we say, okay, this guy has integrity, what does
that mean?
That means he does what he stands for, Right?
So if he says if he says that he's going to do this or if he sees something is right, he will stand
by the right.
If you think about it in data packets, integrity of data means if I send some data from my end, anything
from let's say I have two people here.
I one guy here and one guy here.
If I'm sending him some data, I'm saying I'm going to send it through the Internet.
When I'm sending it through the Internet.
Now, two things can happen.
One is someone can sniff the packet.
Sniffing means he can see what's inside the packet.
Basically get a copy of the packet that isn't that has nothing to do with integrity.
What people could also do is tamper the data.
When I say tamper the data, let's say there's another guy here.
Right when he sees this data is going to from, let's say, Alice to Bob when he sees this data is going
from Alice to Bob.
What this guy can do is he can bring a little anarchy into the system.
Will tamper the data, maybe add certain bytes, maybe remove certain bytes, and then leave the packet
as it is so that it goes to Bob.
When you do this, the integrity of your packet has been broken.
Bob did not receive what Alice sent him.
This is integrated.
Okay.
Have we encountered this before?
Have we seen this before anywhere?
Have we used it?
We have, but not in this general sense.
But we have a little idea of how we use it.
Routing Protocol authentications.
When you have routing protocol, protocol, authentication, what do you do?
Do you send a key?
If you're using clear text, you will send a key.
But if you're not, if you're using MD5 or do you send.
You don't send the key.
You use the key to create a hash value.
Then you send that hash value.
Right.
Similarly, what's going to happen here in IPsec?
The protection, the way it provides you is Alice.
When he creates this packet and he creates this packet, he's going to take something of a snapshot
of this packet.
When I say snapshot, I'm talking in simple terms.
He's basically going to make it go through an algorithm, right, using a key.
He will have a key, let's say one key here, and the same key is on the other side.
So what Alice will do is before sending the packet out, he creates the complete packet, makes it go
through the key.
Once it goes through the key, he gets a value.
Hashing value.
That value he hides somewhere inside the packet.
Right.
And then he throws the packet off.
Now, if anybody out there tampers the packet, let's say this guy right here, the intruder, he tampers
the packet again and sends it to the other side.
Bob.
When Bob receives the packet, he's going to do two things.
First thing, he's going to make this packet that he received.
Go through what?
Through the key.
Because both of them have the same key.
He's going to make it go through the key.
Once it goes through the key, he's going to receive a result, a value.
He's going to compare that value to what?
To the value that was given inside that packet by the other guy.
He's going to compare both of them.
Will they be the same?
They will not be the same.
Why?
Because when the packet was coming in, someone tampered it.
So when he makes it go through the algorithm, he'll get a different value than the value that is inside.
So he sees that this packet has been tampered with.
I do not want to accept this.
Is this clear?
Any questions?
Good for everybody, right?
This is integrity.
The other thing, there is a difference between integrity.
Whenever you hear some anything about MD5, whenever you have everything about anything about Sha,
there's two there's two algorithms that help you do this.
This key, when I say it makes it go through the key, it can make it go through the key using either
MD5 or Sha.
These are two mechanisms for integrating MD5 and Sha.
MP5 was most widely used long time back, but now they consider to be because it has a longer key to
be better.
But I mean, there is a huge debate.
If you go to the Internet and you try to look for it, there is a huge debate between MD5 and Sha,
which one is better?
But Sha is right now because they have different variants of Sha, they have Sha 128 Sha 256 out there,
right?
So it's preferred, but again, there are certain scenarios where Sha will not be supported.
So that's why they have the both of them are combined together.
You can use any one of the two.
Now, the good thing about IPsec is, as I said, that it's a combination of protocols.
There is no hard and fast rule that you should use.
You should use MD5.
It's your choice when you create the tunnel, you decide.
For example, I want to create a tunnel right now between Alice and Bob.
I will decide, okay, for these two guys they will use let's say they will use MD5.
Okay, We will see that once we create that tunnel.
Is this clear?
Until now?
Everything good?
This is integrity.
The other thing IPsec provides you.
Is you call it.
The other thing that it provides you is.
Encryption.
What is encryption?
Encryption, right.
It's a very famous term out there.
Encryption, if you want.
Again, the simplest terms.
Scrambling of data.
Encryption is scrambling.
It's different than hashing or hashing or integrity.
Both mean the same.
It means scrambling the data when Alice is sending a message to Bob.
Right.
Let's say he wants to say hello there.
And this packet has integrity.
Now no one can tamper it.
Okay.
So make sure that no one changes anything here.
Otherwise the other guy will not receive it.
Okay, so I send this out there again.
Now, obviously, this guy, the intruder.
Let's say James.
Now, James, when he sees this packet, he will not change it, but he can open it and see what's inside
the packet.
So for example, Alice and Bob, they want to exchange credit card information.
They want to exchange banking accounts, those kind of details, which nowadays we do on the Internet,
right?
Let's say they want to do that, but it's going through the public Internet and James is sitting there
waiting for you to do that.
The moment you transfer it, James will see what's inside.
So what do you do?
Integrity was there.
What else am I going to add on top of that encryption?
I'm going to encrypt this data.
Using what?
Using the same key which I had before.
The key I used for hashing the When I say hashing, I mean integrity.
I will use the terms both of them together.
So hashing integrity are the same, right?
So when I'm hashing from this side, using this key, the key that I used, I'll use the same key.
To do what?
Encryption.
When I say encryption, I mean that this data will not be sent as Hello there.
Let's have a look at a sample key.
How a key may look like.
I'm not saying it looks like this.
It may look like a key.
May be something like this.
It may say that A is B, b is C, C is D, and so on and so forth.
Maybe the key is like that.
It's much more obviously complicated than that.
But let's say that this is the key.
So hello there.
Before sending Hello there.
I'm not going to send hello there out.
I'm going to make it go through this key again, not for hashing this time, but for encryption.
So it's going to change certain things here.
H will become I.
E will become f m.
M p u i f s f.
And I'm going to send this out.
So James sees what I have you I Efsf.
Does he understand anything out of that?
Is that intelligent data?
It's not right.
What does he see?
He sees garbage when he sees this packets going through.
He sees i f m m p u i f s f, and it reaches the bomb.
Yes, it is available publicly.
Whenever you send encrypted data, it is available publicly.
But the whole point is what?
That this encrypted data should not be seen intelligently seen by others.
They should not be able to understand what it is.
How will Bob understand what this is using?
He has the same key.
Bob has the same key.
So all he needs to do is use the key.
He will use this key in reverse order.
So for me, we will be becomes a, C becomes B, D becomes C, Eventually he will get to.
Hello.
Hello there.
Right.
Both things are happening through the Internet.
Your packets are getting encrypted as well as integrity is also their hashing is also there
so no one can see what's inside that data and no one can tamper it.
Why is tampering important?
Because he now James cannot see what's inside, but just for the fun of it, because he wants to change
certain stuff, because he wants to make sure that your company is hurt.
He will add more data to it.
P f l m Right.
That's why integrity.
If he even changes a small bit, the other side will not accept the packet.
The whole point is lost.
You get it?
Any questions?
No, this is encryption integrity provided by IPsec.
But there are certain things.
Let's first see what encryption technologies are out there for you, which you can decide from.
You have.
You can use.
There's this algorithm called Des.
There's another one called three Des.
Okay.
And there's another one called This is 128.
This is 192.
This is.
What they stand for.
What they do.
Not important.
How they work.
How the algorithm was created.
Who created it?
When did they create it?
That's not your job.
Understand what your job is.
Right.
When you go, for example, fill up a tyre at a railway station, sorry, railway station.
When you go to, let's say, a gas station, you want to fill up petrol in your car.
Do you ask the guy how the machine is created?
Do you ask him where the tank is?
No.
Do you ask him how the whole thing operates, How you swipe the card?
Nothing.
You don't ask him anything.
Why?
Because you want the practical, you want the petrol, you want the gas.
Right?
So you pay and you get what you want.
Same thing here.
You don't need to know how these work.
Yes.
What you need to know is which one is better, right?
Which one is up in the market right now?
Which one has not been broken in the market right now?
Right.
And stuff like that.
Yes.
You need to know the key sizes.
Why do you need to know the key sizes?
Because there is a rule.
The higher the key size, the higher the key size that you're using, the stronger will be the encryption,
but the slower will be your tongue.
That is understood, right?
Because when I'm sending data before sending the data, I have to encrypt it.
The stronger my key, the bigger my key.
I'll take more time to encrypt and the other side will take more time to decrypt.
So the stronger, the bigger the key, the more time it takes for encryption.
That is not really the case between Des and A's, though.
Why?
Because when the algorithm changes, different A's advanced encryption.
So when A's came through, it was a little faster, even though the key size was bigger.
Okay.
That's when it was created was a 56 bit key.
56 bit key.
It worked for a long time because at that time the concept of encryption was new, so no one tried to
touch it or do anything to it.
But eventually, you know, I mean, hackers evolved much more faster than the security guys, so they
found out a way to break it.
It was broken the moment that happened.
It was a time of panic.
They created days was nothing but days multiplied by itself, three times in a moment of panic.
So the 56 bit key becomes how much?
168 bits.
He does until now.
Very strong, very strong.
I have not heard myself of an instance where it was broken and it was creating in a hurry.
I mean, think about that.
It worked for a long time, three days again.
But then later they realized that since then they sat down.
I mean, they created a conference, sat down for a long time, devised a new mechanism for encryption
that was advanced advanced encryption system, which does what it has different keys.
But the question is, does that mean the 168 bits of three days is better than the 128?
You cannot compare them together.
It's like comparing cricket and football, right?
You cannot compare Sachin Tendulkar to Lionel Messi.
You can do that.
It's the same thing here.
Three days in a year.
There are two different algorithms that they use.
Right is obviously is right now in the market most widely used since it came into play.
Okay.
So depending upon again, when you're creating a tunnel through your company, depending upon your company
load, the total amount of traffic going through the tunnel, the encryption mechanism that you're going
to be using is not going to be hard and fast.
Only once you have more load in your company, you will use a lesser encryption system as 128 If your
traffic is not that much, you'll use is 256 That is based on real life scenarios.
Experimentation.
Okay, this works best.
This gives me the best speed plus encryption.
Let's use that.
Okay.
Get any questions with encryption?
No.
What are you saying?
People are asking?
We are not it's not actually the same key for hashing and encryption.
You will not always use the same key, but we call this something as keying material.
You use the same keying material.
When I say keying material.
Now, see, this is important.
When I say keying material, this keying material is usually 1024 bits.
Concentrate here.
Yeah.
Both of them will have the same keying material.
Think about keying material as a big box of chocolates.
Both of them have the same amount of chocolates, the same size, the same number of chocolates on both
ends.
Okay.
When they want to do is from this whole bit, they will take out a chunk and this guy will take out
a chunk of, let's say 128.
You want to use 128 So they will take out 128 bit chunks, use that for encryption for MD5.
They will take out more chunks, use that for hashing and MD5 from the same keying material.
Right.
So from the 121 028 bits, you will create small small chunks of keys that you will use later.
I'll explain how this is done.
This is the most important part of the exchange.
The whole the whole point of IPsec will be this.
But before we get there, just keep this in mind though.
Keying material is not just one key that is transferred.
It's material.
It's a keying material.
Right?
Encryption is provided.
Integrity is provided.
Also.
Authentication is provided.
There are two types of Authentications, BSC and PKI.
What is authentication?
How do you say something is authentic?
Eventually, if you buy Twitter, who uses Twitter here?
Does anyone use Twitter here on Twitter or Facebook even?
There are, let's say, 1000 accounts.
Let's say any actor go out there, anyone choose anyone and will be 1000 accounts of that guy.
Let's say Ronaldo.
Cristiano Ronaldo.
1000 people have created 1000 Cristiano Ronaldo accounts because they are fans and they want to get
more likes.
Right.
And, you know, they create those pages.
You see that out there?
Out of those pages, how do you know the one which is the actual one, you will see that there will
be a verified blue tick with their name.
Happens Let me see if I have internet.
I think for any.
Even on the pages.
Yes.
This is a page, right?
This is not verified.
Or is it?
On the verified.
You'll see a tick mark here.
I don't.
See there are many Team Messi.
Lionel Messi de Messi.
You see what?
It's a verified account.
So this is some guy who just created an account named Lionel Messi, and he started tweeting about it.
Then there's another one, which is actually from the team.
Team Messi with the blue Tick, which says it is verified.
So this when you see this account, you see this is authentic.
It has a blue tick.
It is authentic.
I know that this is the actual guy.
So tomorrow when you have to tweet, you will tweet to this guy.
Correct.
This is, again, authenticity.
The same concept comes here in Alice and Bob.
When Alice and Bob are talking, how does Alice know that he's actually talking to Bob?
When I'm trying to create a tunnel with someone, I am going through the public internet.
I'm sending my traffic out.
I know.
I'm sending it to the Bob's address.
Right.
But there may be another guy here who gets that first packet.
Once he gets that first packet, he can send another.
The other negotiations will be between me and him, and I could create the tunnel with him.
I would think I'm doing it with Bob, but I'm actually doing it with someone else.
Correct.
How do I make sure that doesn't happen?
I want to do something for authentication.
I want to authenticate that I am actually creating the tunnel.
With whom?
With Bob, I'm actually doing it with Bob.
How do I do that?
Two ways.
SK and PK.
SK is Pre-shared key.
Pre-shared key.
It's a little different than how I will here have a key installed.
Let's say I'll have Cisco here as a key on the other side also, because these are two sites which belong
to me.
I'm the one who's configuring the tunnel.
I'll go to the other side and also have a pre-shared key.
Not as simple as Cisco, obviously, but it's like a code word, right?
Say they show in the movies When someone is buying drugs, what do you do?
Or maybe doing a nuclear deal?
What do you do?
You call and you have a passcode, right?
So you say that password.
The other guy knows that you are the guy who he wants to sell the drugs to.
The same concept is here, right?
When I'm creating a tunnel with Alice, eventually I'm exchanging certain parameters right through the
exchange.
There will come a point where I'll ask him, Hey, what is your key?
Throughout the exchange, there'll be a point where I'll ask him, What is your key?
The guy will reply, It's Cisco I will send out.
My key is Cisco.
They should match.
If Cisco and Cisco doesn't match, the exchange will be stopped right there.
Authenticity.
Do you understand?
Any questions?
Are you sure that you understand the right.
Will be sent, not shared will be sent for authentication.
So once exchange is taking place in the middle, Alice will send his Cisco along to Bob.
When Bob sees Cisco, he'll match it with his own.
He'll see it.
Cisco.
So for Bob, Alice is authenticated.
Then Bob needs to authenticate himself so he'll send his own Bob.
His key of Cisco sends it to the other guy when Alice receives it, Alice knows that Bob is verified
or Bob is authenticated.
Any questions?
No clear completely.
That's the other one is called PKI.
Now, we will not go into the details of PKI because you have a full VPN dedicated for PKI.
Right.
But I will still give you a faint idea of you see this verified account which I showed you.
How do you think it got verified?
Let's say this was Leo.
Let's say this was Leo Messi and this is me.
Okay, so I'm sitting here and Leo Messi needs to make sure that his Twitter account is verified.
What does he do?
He takes his account, goes to.
Twitter
authority, people who manage Twitter.
He goes to him, tells them, listen, I'm Leo Messi.
They ask him for proof.
He needs to prove himself to this Twitter's guy.
Twitter guys, these guys.
So he goes there, shows himself his card, his face, obviously.
I mean, they see him, they know it's messy.
So he goes there and does everything.
And then once they do that, they ask him for the username and password username, obviously, and they
verify his account.
Right.
So tomorrow when Alice needs to create a connection with him.
Leo Messi does not send out the key, does not have a key.
In this case, he will send out his verified status.
We call this IC identity card on which it will be verified.
Okay.
You have been verified by Twitter.
So once I see it, why will I believe it?
I will believe it because I believe Twitter.
This is a global authority.
If it verifies anybody, that means it's valid, right?
If Twitter verify is messy, I don't need to question it.
Why?
Because I know that Twitter verified it.
The same concept comes into play off in PKI public key infrastructure.
How in this case, what Bob is going to do, you won't have obviously a Twitter authority here.
You'll have something known as CA certificate authority.
Right.
And what Bob will do is he will go to the car and get an IC identity card.
See the details of which we will have to do.
Obviously, that's in your course.
Full details of what's inside that.
I see.
And how does he get that?
I see.
But for us, for now, he gets an I see from the certificate authority.
The certificate authority out there is valid.
Everybody knows it.
So if he authorizes someone, that means he's authorized.
Right.
Same way Alice will go up there and get his.
I see.
Now, when they're creating tunnels, all they need to do is what exchange, I guess you might say.
What about the intruder?
Can he get the IC for the intruder to get to the IC?
He has to go to the certificate authority, prove himself to be a part of my company, which is not
quite as simple as it seems like he has to go there and prove that he's part of me, part of my company.
So he goes there with documents which he doesn't have, so he'll never get that key, which I have.
He will never get that.
I see that.
I got it.
Yeah.
Okay.
We'll do it in more details of how it works.
I just want you to have an overview of how an IC works, how an IC works.
Okay, Let.
It's a certificate.
It's a certificate with the key.
I'll explain on that.
Okay.
Now we come to the last part of our IPsec suite.
For now, this is the last part.
We never know what's going to happen further, But for now, out of all this exchange, there is something
which never changed and which was the most important part of this whole thing.
What was that?
This right here.
When I told you encryption, I said it will happen through a key.
When I said authenticity or the key that doesn't use this key, but it has a certain different kind
of key, right?
Then I talked about hashing.
I said hashing will use a key.
The problem with the whole concept is how will both of them have the same?
Since the communication.
All of the communication is where?
Across the internet.
What if when I'm sending him the key across the tunnel?
What if someone snatches this?
I'm done, right?
Wherever I'm sending from then to Bob.
If James is sitting here and he has the same key, doesn't matter how much I encrypt, it doesn't matter
which algorithm I use, he will understand what I'm trying to send.
Is there a way to exchange this key over the internet without James getting it?
Centralized solution for.
For issuing the keys.
That's PCI.
That's the one for ISIS.
That's for authentication.
This key the problem is that for encryption, it will be used always.
That is one challenge.
The other challenge that you guys have is the data.
When you're sending data.
Right.
What hackers will do is they will collect a lot of data.
Why would they collect a lot of data?
Because then if they have a lot of data, they have a lot of sample size to test to try to break down
the key.
For example, you have a sentence.
Hello there.
Right.
Your E is not E, it's F, right.
When you have a big sentence, let's say, for example, he has a full one GB data for you.
There might be a word, say elephant.
Right.
E is repeated twice.
He'll see F twice.
He'll know that it's a vowel.
There's different ways that he can try to figure out your key.
Obviously with 56 bits or 128 bits, it's not as easy.
But they can run it through different algorithms to find out what the key is.
If they have big data sizes available.
So we need to find out a way that not a lot of data goes through the tunnel, which is a big challenge
because all your data should go through the tunnel, right?
That's one challenge that we need to look to.
Not a lot of data should go to the hacker or the attacker to for James to be able to find the key and
to exchange this key without James finding out what the keys.
Okay.
How do we do it?
There are two ways.
There are two ways of doing it.
One is called RSA.
That is a public and a private key.
The other is Diffie-Hellman.
What we are going to be doing here is Diffie-Hellman.
Now, first I'll show you what RSA is.
IPsec uses Diffie-Hellman.
But before we get there, I'm talking about key exchange.
Let me explain the two kinds of key exchanges out there.
The fourth is key exchange.
This would be your climax of the movie.
The most important part of the exchange is the key exchange.
Okay.
Let's have a look at.
There are two different kinds of key exchanges that can take place between Alice and Bob.
One is called asymmetric.
The other is.
Does anybody know the difference?
It's the same keys if you use the same key from one side.
Let's say, Alice, the data when it goes through, Alice has the same key.
It uses the same key to encrypt the data.
Send it to the other side.
Bob uses the same key to decrypt the data to get the result.
Okay, so same key on both sides.
This process is faster.
It's faster, but not as secure as asymmetrical.
Asymmetrical.
Have you used it before
in ccnA?
You've used it.
Ssh.
Do you remember?
What does it do?
What is asymmetrical keys?
Asymmetrical keys is a set of keys.
Is a set of public and private keys.
It's a pair.
A pair of keys.
So you'll have a public and a.
I'm talking about such a public and a private key.
So when the client you are the client, you try to create the connection with Alice.
Alice asks you for your username and password.
When your username and password is correct, he will send out what he will send out his public key.
For you.
This is also known as RSA.
He would send out his public key to you.
Now, this public key and the set of keys are usually of the size 1024.
Generally speaking, it can be small also, but generally you keep it around 1024 bits.
Imagine s is how much?
128.
This is 1024.
Once you receive the public key, what Bob is going to do is whatever data now Bob is going to send,
he's going to send it through what, encrypted using the public key.
1024 bit encryption.
Imagine that the only one person in the entire world who can break this 1024 key is Alice.
It's Alice.
No one else.
Why?
Because Alice is the only one who has the other half of the key in a set of private and public keys.
Whatever is encrypted by the private gets decrypted by the public.
Whatever is encrypted by the public gets decrypted by the.
This is encrypted by the public.
The only person in the world who can decrypt it is who.
Alice.
That would.
This was in case of SSH but you could also do is both of Alice and Bob both have a set of keys, a public
and a private two separate keys.
They're not linked together at all.
What they would do is they would exchange which parts?
The public.
So Alice would send his public across her public across.
Bob would send his across.
To the other side right now, When Alice needs to send anything to Bob.
It will encrypt it Using which key?
Bob's public key.
Then I'm sending it to Bob.
I will encrypt using Bob's public key and send it to Bob.
And Bob will be the only one who will be able to decrypt it.
But when Bob sends me the message, how is it going to do?
He's going to use Alice's key.
When he sends it to Alice, he's going to use Alice's Green Key to encrypt the data, and the only person
is Alice who can decrypt it.
Asymmetrical key.
Very, very secure.
Very secure.
Let me show you a video.
At the time of encryption?
Yes.
Before encryption.
It's not used right now in IPsec.
It's not used much.
It's more used in SSL VPN.
Okay, let me show you this.
If this is what I think it is,
I think this is it.
Hundreds or thousands of.
She invented to specific domains.
And what if you can spread that over a team or even.
All with centralized control and we're managing it with a simple as a yes or a no.
How long does it take to break an asymmetrical key?
This is 2048 bit key.
Can you see?
Go back to the dawn of time when everything was created.
Time spent calculating is how many years is this calculating?
Trying to crack a key, saying how much time it will take to crack this key.
Check out the years increasing.
After over 13 billion years.
You're only this close.
Yeah.
1 in 4000 600,000 chances of getting it right after 13 billion years.
So imagine how secure this symmetrical keying mechanism is.
Asymmetrical between Alice and Bob.
Right.
The keying that you're exchanging public and private, whoever gets the public to get to the private
will take him 13 billion years.
The question is, do we use it in IPsec or not?
We do not use it in IPsec.
Why?
I.
Yes.
It's A1024 bit key or 2048 in terms of the one which I just showed you to, to encrypt data on that
level will take a lot of processor on processing power on Alice.
And plus he has to do to two different things.
He has to make two different decisions for traffic coming in.
He will decrypt it using his private for traffic going out.
He will encrypt it using the other guy's public.
So two different decisions.
First, then the key size is so huge that it will take him a lot of time to encrypt and decrypt.
So although it is a good solution, it will make your tunnel very, very slow.
Right?
So to do that for our main basic principle is at the end of we need to find an exchange so that Bob
and Alice eventually have the same key on both sides.
We will use asymmetric key to get symmetric key.
So we use the mechanism of asymmetric keys only to get the end result, which will be a symmetric key.
When I say a key, it will not be a key.
It will be what?
Keying material.
A big set of a chunk of keys on both ends, which are exactly similar to each other.
Okay.
It will be symmetrical.
When I say symmetrical, it will not.
Alice will not have to think a lot.
Whatever traffic is coming in will use the same key to encrypt it.
It will go to the other side.
Bob will have only one key.
It will use the same key to decrypt it.
Okay.
Symmetrical.
How do you do this?
We do it by using Diffie-Hellman.
Two guys.
This way of key exchange was devised in 1970s.
Since then?
Until now.
Since then.
Until now, they have not been able to break it.
It is so strong that very recently they devised a newer algorithm of which is called ecdsa.
Elliptic curve DHT, which where they actually reduce the size of the key.
Because it was so strong.
It was not broken for 40 years almost.
So what they said was, since it's not broken, why don't we just try and reduce it a little?
That's wrong.
Okay, think about it this way.
You get a little concept out of this.
Think about it this way.
Have you ever seen those locks?
000 unboxes.
Right.
You put your luggage in, you block it, and you put a number on top of it.
Right.
If you want to open this combination.
How long do you think it will take you?
You will try different combinations.
You will try 0010023456789.
You will try different combinations eventually.
Eventually, let's say give and take one hour.
You might be able to solve it and get it out.
Right.
This is three bits.
What happens if you increase one more bit?
How long does it take you?
Does it take you two hours?
It will not take you two hours.
It will take you 24 hours to do it.
Now an extra bit one extra bit doesn't double your time.
It's exponential.
Why?
Because now you have much more combinations than before.
Add another bit to this.
It becomes quite impossible to solve.
Putting the lock is easy for you.
You choose one, two, three, four, five.
It's locked to open.
The lock is difficult.
To open, it becomes more difficult.
That's the same concept works on.
If you don't know the combination, you will not be able to open it.
Right now imagine uses 128 bit keys.
Imagine how difficult it will be to solve that.
The is the final exchanges, usually around 1024 bit keys.
Eventually you use 128 even that is 128 is so difficult.
Imagine which uses 10241536 bit keys.
Bit keys 768 bit keys.
Quite difficult.
How does it work?
Have you ever mixed paint?
Have you ever mixed two colors?
I don't think this pen does it.
It will just write on top of the other one.
Let me just try.
It does a little.
Is the wrong button.
Alice?
Bob.
James.
If let's say this is green with green, I mix red.
Right.
When you mix two colors together, let's say green and red, right?
Now, green is not exactly green.
Green has many different variations.
Right.
There could be a little bit of white in there.
There could be a little bit of blue in there.
But you have certain variety of, let's say, bottle green here.
You have dark red here.
You mix them together, you get brown.
Is it possible from that brown to get the exact quantity of green and red that you use?
It's very difficult.
Once you mix the colors, how will you separate them?
Can't.
Can separate.
If you have a mixture of colors, you cannot get the original colors out of them because there are thousands
of different calculations where it would you would need thousands of different ways.
You would need to find out which was the exact quantity of red and green that was used to create this
color.
Correct.
That is the same concept uses.
Check this out and concentrate here, because this is very important what Alice and Bob do.
Let's say Bob is the initiator of the connection.
What Bob will do is it will choose a color, let's say yellow.
As the public key.
Both of them, Alice and Bob.
Both of them will use this public key.
This is not a pair of keys.
This is just one key.
It's not a public and a private key.
They just choose on one color to use as public key by both of them.
They will not use it anywhere else.
Okay.
Both of them have a private key.
Let's say Alice has Blue.
Let's say Bob has read as a private key.
This private key is important.
Keep your concentration right.
Both of them have chosen on the yellow public key.
Both of them will use it.
Let's say Bob is the initiator.
What he does is he chooses public yellow and he sends to the other side, not red.
He will send to the other side Red.
Plus yellow.
He mixes his private.
He's not going to send his private.
He mixes it with what?
The yellow.
Let's say this color here becomes orange.
Okay.
So he's sending orange and yellow.
This is James right here.
He's an intruder.
Let's see what he gets.
Since yellow is public, he will get it.
He will see the yellow part.
He'll have yellow Plus what?
Orange.
Not red.
Red plus yellow, which is orange.
I don't think I have as many combinations of colors, but let's try.
Right.
So he will get what?
Both of these keys are traveling to Alice.
This is done in one packet.
In one packet.
Bob will send a public key separately and a mixture of the public and his private separately to different
keys.
They come there to Alice.
Alice receives the yellow.
He knows that yellow is here, but he doesn't do anything with the yellow.
What he does is he mixes this.
The mixture that he received.
Mixes it with what?
To get the final result.
Let's say this is black.
He mixes these two to get black, but he needs to sign something also what he signs.
What do you think he sends back?
What is he saying?
Blue and blue, plus yellow.
He will send back his private.
Sorry.
He will send his private plus the same public which both of them chose.
Let's say this color is green.
So what he sends to the other side is.
What does the intruder get?
That's what he said.
So he also gets green.
The question is, what does Bob do?
He adds to his red this green to get what color?
Think about it.
This black was made up of what?
Blue plus red.
Plus yellow.
Because this color here was red.
Plus yellow.
Right.
So blue plus red, plus yellow.
He got black.
What is this color?
A combination of blue plus yellow.
Plus red.
Which is the same thing.
So this guy will get also.
Yeah, prime numbers.
The concept is similar, but this is a little different because James here is receiving the yellow.
He's receiving the orange.
He's receiving the green.
See, Bob's private key is somewhere here.
Alice's private key is somewhere here.
James needs to figure out.
He tries to open it and to see what is the actual.
If he receives that private key, that's it for him.
Do you see what's happening?
Alice?
Alice is sending his private key to the other side.
The other guy is mixing his private with my private to get black in the middle.
The yellow is only there to create confusion.
Alice needs to send his private to the other side.
He mixes it with the yellow and sends it to the other side.
The other guy mixes all three colors to get black.
He sends his private to me, mixed again in the same yellow.
Right.
I get his private key.
I mix it with my private key again to get the same color yellow.
Same between the two.
Because they chose the same yellow only to create anarchy.
Only to create what?
Confusion in the middle.
The actual stuff is private plus private.
Eventually, both of them will have their private keys combined together.
But there is yellow in there just to create confusion.
So they add that yellow also to get the final color.
Black.
Black was never transferred or transported between the two.
Black was never sent across.
A combination of yellow and private.
A combination of yellow and private on both ends was sent across to finally get the result.
Finally equipped.
Think Which one?
This one.
The question is, can he decrypt this part?
Can't he open this?
This is just like.
That's why I said mixing of paints for him to find out the actual one.
He has to open the paints together.
These are 1024 bit keys.
He'll have to open 102 and try different combinations of 1024 bits.
Imagine how big that is.
Yeah, that's.
That's a different that's a different case.
That's a different case.
I'll explain that.
But do you understand how this key exchange takes place?
This key exchange is called Diffie-Hellman.
The Diffie Hellman Ditch the name of the guys.
The the interesting part is if you go to Diffie, Hellman,
if you open Diffie, Hellman and you open any page.
So let's say Wikipedia page of Diffie Hellman, you will find the algorithm used for Diffie.
Hellman right there.
It's an open algorithm.
Okay.
Maybe not here.
Right here.
It's open.
Algorithm is open.
It's an open warning.
Okay, listen.
This is what it is.
I'm using this.
Try to block it.
Just like that key.
You know how it works.
You don't have the key on a lock.
Works.
You just have to try the combination and open it.
But the challenge is, when you have more combinations, how will you do it?
It doesn't work on the concept of the algorithm being hidden.
It works on the concept of too many calculations.
So you have to do a lot of processing for you to be able to open that key.
And you saw how much it takes to open up a asymmetric key, A1024 bit key.
How much will it take for you to open it?
Can you make a random guess?
You can, but your possibilities are two raised to power.
1024.
For that guess to be right.
Two Raise to power.
1024.
Yeah.
One one over two.
Raise to power.
1024.
How much is that two raised to power?
Ten is 1024.
11 is 2048.
12 Is it doubles each bit that you add, the combination is double.
Imagine how much two raise to power.
1024 is 32 bits in an IP address gives you how many addresses a lot to power.
32.
Right.
So many different addresses.
If you do two power 33, that's double of the total amount of addresses you get on 32 bits, you increase
one bit, it doubles.
So imagine that's quite impossible.
That's why they have reduced now said that this is too much.
They reduce the size.
That's how secure it is.
What is secure to open that color to get the real color out of the mix one.
Write your Diffie-Hellman works.
The whole job of your Diffie-Hellman is here to mix these two colors together, the yellow and the red
to get this part.
Any questions, Any part that you did not understand?
Before we move further
at the end there will be that black is never exchanged.
They don't need to exchange it.
See, I know that the mechanism is you and me are communicating.
I need to make sure that your private and my private are mixed somehow to get the black.
So you choose the private?
I choose the private.
It's all an automated process for Diffie-Hellman.
You don't have to do anything.
It does it automatically.
He will choose his private.
I will choose my private.
We need to mix them together.
So I want to send him my private.
But how do I send it?
I mix it with the color.
I give him the color separately and I give him the mixture separately.
This is the color which I mixed it with.
And this is the color which is the mixed part of it.
He uses the same color, mixes it with his public private key and plus mixes my mixture to get the black.
I use the same mixture which he sends me mixed with my private key.
So eventually his private and my private are added.
Plus the yellow gives me black, gives him black.
In the end, both of them have black.
The keying material.
Now this keying material will be used to do s sha and all those things.
Okay.
So for things under IPsec, what the first thing was integrity.
Integrity was md5 sha to make sure no one tampers the data.
The second thing was encryption scrambling of data used with what?
What algorithms?
Des three Des As as 128 to 56.
Then we came to authentication.
Authenticate who the other guys would be used for that Pre-shared Keys and PKI public key infrastructure.
So either certificates or a key on both sides.
Remember this one part, that key, the authentication key is not used for encryption.
When I say remember Cisco on both ends that is not used for authentication.
Sorry, not encryption.
What is it used for?
Authentication only used to authenticate the other guy.
There are two keys here and do not confuse yourself.
There will be this Diffie-Hellman key.
The final result of the Diffie-Hellman key, which will be used for encryption and decryption.
Plus you will also use a key.
What is this?
Pre-shared key.
Just to make sure that Alice makes sure that he's talking to Bob.
Bob makes sure he's talking to Alice.
So they will just change.
Both of them should have, let's say, Cisco.
Cisco.
Bob has Cisco.
The other guy has Cisco just to make sure they're talking to the real guy.
That's it.
It will not be used for any kind of encryption or hashing.
Okay.
What will be used for encryption and hashing?
Which key Diffie-Hellman Your Diffie-Hellman key will be used for encryption and hashing.
Not anything else.
Is this clear?
RSA different from RSA uses the public key to encrypt and private to decrypt.
Is it the same?
Yes, but encryption and decryption is not happening.
Asymmetric encryption and decryption will happen now.
Symmetrical RSA is asymmetric.
RSA is completely asymmetric.
So RSA was the first one which I showed you.
Public.
Private.
Public.
Private.
I will give you my public.
You will give me my public.
I will use your public.
You'll use my public.
And it's not the Diffie-Hellman is this Diffie-Hellman is using public and private to finally get a
symmetrical in Diffie-Hellman is a key exchange RSA.
I will give you my public.
How will you encrypt your data using my public key using 1024 bit keys here?
I'm not.
The actual data that goes through will not be encrypted using 1024 bits out of this chunk, a small
chunk will be taken out as 128 from both ends using the same algo.
So the actual encryption will be done here?
Decryption will be done here.
Symmetrical.
This is the film.
Do you understand?
RSA?
Is which one your SSH.
In RSA encryption and decryption will not be done like this.
RSA.
It's a little different.
How RSA?
I'll send you my public.
You will use that public to encrypt, which is 1024 bits.
He'll use the public key to encrypt.
That's it.
And the only person in the world who can decrypt is the one with the private.
So the key element is an extension of.
You can say that.
You can say that it uses the same concept as RSA.
A similar concept at RSA.
Not to encrypt decrypt, but to find out the symmetrical something like here.
Uh huh, uh huh.
And then just authenticate for the transaction.
Just.
But that doesn't use this part, right?
Public.
Yeah, that uses RSA, that uses RSA, that also uses tokens nowadays.
You might have seen in a lot of newer ATMs that are coming in, not here, probably somewhere outside
you.
You now don't have your ATM pin, you don't use the ATM pin.
You get that secure ID, RSA signature.
You have a key on your they give you a key, a hard key, right.
With your ATM.
So once you enter the vicinity of the ATM, you can check it changes the key changes every one minute
based on the time it calculates new keys.
So when you're there, you'll have a new key.
You enter that key and it goes through.
That is SSL VPN.
That is not IPsec.
Right now we have not gone into the working of IPsec.
I'm telling you, the different modules which are there, the Diffie-Hellman module is there, encryption
module is there, authentication module is there and hashing module is there.
The good thing about this, the good thing about IPsec, you might ask the question that, okay, IPsec
is here today, but you see how rapidly the technology changes, right?
Tomorrow they need to add more encryption mechanisms or something else which was there.
Let's say for example, when it was created in the beginning when IPsec was created, it did not include
encryption.
It did not include encryption.
It had integrity, but not encryption.
But IPsec is designed in a modular way.
When I say modular way, that means tomorrow, if something else comes up, they will just add a block
to IPsec and it starts working.
Right.
Let's say tomorrow you want to create a tunnel based on fingerprints.
You want to make sure that the fingerprint matches.
You can add another module.
Module five fingerprints.
So when I want to create a tunnel, I'll have to go in there and press in my fingerprint.
The other side has to do the same press in his fingerprint.
If they will not match, obviously.
But if they are in the database, the tunnel will come up.
You can add that module also in there.
It's modular, just like encryption was not there.
They added it.
You can add more modules to IPsec.
That is the best part about it.
Okay.
Any questions?
Until now.
They will not send one of them will choose the public key.
Yes.
Yeah.
They will be chosen by the initiator of the connection.
So Bob will choose one.
He sends both of them separately.
Right.
I'm sending a public plus the mixture.
The other guy will use the same public to send it back to me.
Okay.
Any questions on again is important.
Do you want me to explain it again?
Honestly?
Here.
No, IPsec doesn't use only RSA it will use in PKI, but not for encryption, decryption for ISIS,
just for authentication.
We will see that at that time.
But most predominantly it uses IPsec.
Okay.
Let me explain the mechanism again.
Both of them need the same key so they decide on a same yellow key.
Both of them, first of all, not both of them, because Bob is the one who is creating the connection.
Their job is to mix their private keys together.
That's the whole purpose of the exchange.
They want to mix their private keys together to find the final touch.
Okay.
So what Bob does, he's the initiator.
He sends two sets of keys.
One is yellow and he mixes yellow plus blue.
Right.
So he sends another mixture, which is yellow and blue.
It's a mixture, right?
He will whoever is the guy will not be able to separate these two and sends this also along the way
to the other side.
What Alice does is since he receives this, he will add to red this mixture
of yellow and blue.
You finally get?
What?
But he also sent something along.
What?
What does he send back?
His private key mixed with yellow.
Mixed with yellow.
So what does the other side do?
He adds to this blue, red and.
So I'm sorry.
Third packages.
So the hacker sees.
That's what I showed you in the beginning.
The hacker will see the keys.
He will see the public key.
He will see the mixture of this, which is green.
He will see the mixture of these two, which is orange.
He sees the whole exchange, the hacker sees the whole exchange out there.
So for him to find out how orange was created, for him to find out how green because he needs to find
black for him to find black, he cannot mix these two together.
If he mixes these two together.
There is also yellow in there.
Two times yellow will give him something else.
So you cannot mix these two together.
You cannot mix this.
He needs to find out the exact combination that was used to create this.
Because if he gets that, if he gets the exact right out of here, he can mix it with green to get black.
If he gets from the green, he gets blue out.
He can mix it with the orange to get black, but he might have it.
Yeah.
Yes.
Which is mixed with yellow.
Yes.
The hacker, which is me.
I'm trying to solve his private key, which is mixed with the yellow.
So I try to get his private out of that yellow, which is not possible out there.
Now that I'll explain that, I'll explain how that happens.
Right.
What you need to understand is this keying material is the end of the exchange.
Only two packets needs to be exchanged.
The first where the public and the private is sent.
The other the mixture is sent from the other side.
Only the mixture is sent two packets done.
They have their they have their keying material on both ends.
They are set to do that.
Does it work with symmetric?
This is not RSA.
RSA is asymmetric, RSA is completely asymmetric.
What are the symmetric.
This is symmetrical.
Where?
Symmetrical.
I use encryption.
Which you will do.
Always uses for IPsec.
It will always use key exchange will be asymmetrical.
This is an asymmetrical key exchange, but not RSA.
It's not RSA, it's FF.
If you use RSA, the mixture will not be sent.
It will just send public, public and start encrypting.
In RSA, I'll send my public, he'll send my he'll send his public, I'll encrypt and he'll encrypt
and done.
It's just expensive on the users to do that.
So what they did was they created a separate mixture out of it.
They created a newer version of where the exchange is done, but not to do encryption decryption, but
to find a set of keys.
Then that will be used for encryption and decryption.
Kit.
Good, right.
Let's move on to how now until now, what you've done, what you've seen is just IPsec.
It's just IPsec, which is bringing all of these things together.
The way IPsec Tunnels work is an entirely different thing.
Now all of these, again, as I said, will come together to give you that tunnel.
All these features.
What are the features again?
Integrity, authentication, encryption and the key exchange.
They will come together to form the tunnel.
Right.
We have still one challenge I solved, one challenge the other challenge that I should not give the
attacker a lot of data is there to work on the key.
That challenge is still there.
Yes, I understand that he won't be able to solve the key, but the problem now comes is now both of
them have a set of keys, Right.
If you think about this, Alice, Bob and the attacker here.
I'm sorry, the attacker will see you're sending data through the Internet.
So we are going through the
database.
He's not do.
He should not build it.
So I should not give very much too much of data.
Yes, too much of data.
See what I'm talking about.
Now, both of us have this key, right?
Out of this, I will only use 128 bits for encryption.
Only 128.
Right.
So when I'm sending data out, I'll encrypt it using this.
It will be encrypted.
It will go to the other side as encrypted data.
The other side will decrypt it to get the original data.
It's only 128 bits.
It's still huge, but if you compare it to 1024, it's nothing, right?
Now with the attacker will do is he will get this data.
He's also getting all of it.
He will try to build a huge database of this data in GBS.
The more data he has, the more his chances to get the key.
We want to make sure that we find out a way that the attacker cannot crack this.
That is the challenge right now.
Should not be able to open this and see find the key.
Because if he finds the key, the whole exchange is lost.
They already have the key.
How do you solve that challenge?
You don't.
IPsec does it for you.
IPsec has devised a very, very cool mechanism to exchange keys.
In IPsec, the tunnels that you create, the VPN that you're going to be creating, you're not going
to create one tunnel.
You're going to create two tunnels.
You don't do it, though.
It does it automatically for you.
If we create one tunnel.
Out in this tunnel in total of only nine packets go through.
In the first tunnel, only nine packets go through.
This tunnel is known as Isa k MP isa cam.
Are you to totalling nine six.
Three more quick mode is also done there.
Okay.
In total of nine packets will go through.
Using this tunnel.
Okay.
The whole purpose of this tunnel is two things.
There are two things that are important through this tunnel.
Number one is key exchange.
Number two is negotiate.
Negotiate.
IPsec.
Negotiate the IPsec Tunnel.
Those of commission for a combination of policies.
Yeah.
Why do I need negotiations?
Negotiations?
Because I told you.
You have many options.
You can use three days.
You can use as you can use a shower.
You can use MD5, all of those things you can use.
Which one are we using?
Is negotiation?
I'm using is from my end.
Obviously the other side should also use.
So the negotiate on that.
Done.
Where in this tunnel.
It is done in the first.
The second tunnel now here.
A lot of people get confused, but keep your concentration.
The second tunnel.
A government which is also known as phase two.
Tunnel.
Phase two tunnel, not phase two.
There is a difference between phase two tunnel and phase two.
Phase two tunnel.
Right.
The only thing that goes through here is data.
No negotiations.
So basically, if you want to talk in language, you could say that this is your control plane as a
separate tunnel.
And this phase two tunnel is your data tunnel.
Your data traffic goes through the phase two tunnel.
Your control traffic goes through the phase one tunnel or the ice tunnel.
This is also called IPsec Tunnel.
Your actual tunnel?
Is this to set up this tunnel?
You use the first one.
To set up this.
Good things.
No, I'm fine with it.
But I can sense things like this in my.
I'm not really in camp is a simple exchange on UDP.
UDP 500 is a camp is a protocol which works on UDP 500.
All the exchanges that take place happen on UDP hyphen in total of nine packets.
Right.
And then your phase two tunnel, I'll talk about the headers that are going to be used there.
That's for later.
For now, we need to fix how camp takes place.
I don't know.
Yeah.
What I received from other side.
Probably the policies should match for the ice.
It should match.
Yeah, it should match negotiation.
Right.
That's what negotiation is.
Let me explain what these nine packets are and how are they traversed from one place to another one
by one.
Now, again, from anything from any perspective, you look at IPsec, this is the most important part.
The nine packets which are going through the most important.
Okay.
Trust me on this.
You need to know this for any IPsec VPN, whatever IPsec VPNs you're doing from now.
When I said the base.
Remember the base I was talking about yesterday when I was talking about the base.
This is what I mean.
This is what I meant.
Right here is from AT&T.
The AT&T guys came.
You only bunch of them.
A bunch of them are there.
Right.
Okay.
So you're the only one who's here for VPN in the morning, but you're the only one in the morning.
Yesterday.
I don't think you knew that the class was here, right?
I knew.
Assignments.
So as I was saying, I camp we will have a look at the packet exchange, the most important part of
it.
We will also see it practically, but I don't think we have time for that today.
We'll only talk about the exchange today.
We'll create the tunnel tomorrow and have a look at your package.
Okay.
This is what happens.
Packet number one.
Now, all of this all of this communication is happening on UDP port number, which 500.
All of this communication of nine packets is happening on UDP 500.
So the first packet goes out.
Right.
The source and destination of this packet is going to be public.
Alice To public.
Bob.
UDP source port 500 destination port.
And then the final Isa camp is here.
This is how the package travels from public to public.
Very, very, very important.
This part.
Concentrate public to public.
Camp always goes from my public address to the other guy's public address.
If you're doing it between the two routers, the routers, public address to the other side's public
address, my eventual job is to go into protect my private networks right over the public domain.
But the ice camp will be first exchanged through the public networks.
Okay.
In this ice camp packet inside here at this layer seven, inside this, you will see policies.
What kind of policies?
Alice will say, I'm using encryption three days, for example, for hashing.
I'm using Sha.
Okay.
Then he will say an authentication.
Mechanism.
I'm using SRC, not PKI and the group.
Group is Diffie-Hellman group.
There are three groups one, two and five.
It's just the key sizes.
Group one is 768.
Group two is 1024.
Group five is 1536.
The size of the keys.
You can see that when you're creating the tunnel, you'll see the size of the keys.
The key size, the group that you can use on the side, which you can use on that router.
So some some routers will also give you group seven available to them.
But most of the times these days you will always use group two.
You will not go to 7 or 5 because again, that will be too processor intensive.
Most of the time you'll use two.
Now there are different variants out there.
They have group 20 1716.
Those are in a newer version, but we'll get to that.
Okay.
So this is what Pre-shared key and everything here.
It will be sent basically.
I'm not sending everything here.
I'm just telling him what I'm going to use.
I'm sending him.
This is known as policy.
The first packet is also known as policies.
I'm sending him all the policies that I am going to use for from my side.
There is a twist, though.
What is that?
There are two tunnels being created, right?
One here and the other one is the data tunnel.
These policies that I'm exchanging is not to protect the second tunnel.
It is to protect the first tunnel.
Why?
Because eventually, through this tunnel, I am also going to exchange my pre-shared key.
My actual preset key will also be exchanged through this tunnel.
There will be only used to authenticate the peers.
But I don't want anyone, anyone else getting that because then tomorrow he can create a tunnel with
me using the same sk.
I need to protect that too.
So these set of policies that I'm negotiating in the first packet is to protect the first tunnel, phase
one tunnel.
So this happens before the tunnel was created, before the second tunnel is created.
This after this happens after the first one was created.
This is not a tunnel.
No.
The exchange of policy?
Yes.
When does it happen?
Before the tunnel.
Before the first tunnel.
The first one.
Before the first one.
It's the creation of the tunnel.
This part is the creation.
So negotiation should happen first, right?
When I want to communicate to you first, we negotiate.
I tell you my name.
You tell me your name.
Then we have certain conversation.
Then we have a trust between us.
That's what happening right now.
I'm sending them my first policies.
The other guy will reply with what?
Packet number two.
What will be in there?
Three days.
QA group.
Let's say two.
If any one of the packets don't match here.
If I'm using on one side, PK on the other side, this exchange will drop.
If I'm using three days on one side, on the other side, this exchange will drop.
Okay, so it should match for the communication to take place.
Packet one and two.
Packet three from Alice.
That's exactly right.
You can visit a protocol.
It's a protocol.
I say camp is a protocol which works on UDP 500 protocol, which has these things.
Define the nine packets, define the first packet.
Should be this, the second packet should be this.
The third packet should be this.
The fourth packet should be this.
If the first and the second don't match, drop the second and the third don't match drop.
Do we have any other options in the coming apart from Acanthoderes this year?
For most of the tunnels this is the one.
There are certain other extensions, but they're also part of icecap also.
So usually you'll use icecap.
It's I think it's Internet Security Association key management protocol.
Then there are just this and they'll come after.
I'll show you.
We have not reached there yet.
They'll come after the sixth packet.
Today we'll do only until the sixth packet.
Okay, so now
we know not the tunnel.
The negotiation of what we are going to use for the tunnel exchange is private.
I'm only on the second tunnel yet.
I'm only on the second packet.
There are still seven more packets left.
Okay, so the first and the second are done in the first.
I'm telling him I'm using encryption, three days, authentication, all of this.
It should match from the other side.
The other side should say, okay, I'm also going to use the same.
The third packet I will send my public and the mixture.
Plus I will also send something known as nonce.
Nonce is nothing but prime numbers.
A certain variations of prime numbers.
Random numbers.
Open.
Clear.
Text.
I'll send it to the other side.
Why?
I'll show you why.
So I'll just send a combination of 0101, just for simplicity's sake.
I'm just sending zero one.
It's just prime numbers and certain alphabets together to the other side.
The moment the other side receives this, does he get his black key?
He does.
He mixes this mixture with his private to get the black key.
Right.
So at the end of third packet, Bob will have.
What does Bob send back?
Is his mixture.
And this nonce.
But this nonce he will encrypt.
Using what?
The black key.
This nonce will be encrypted using the black key.
Why?
I'll explain why.
When this packet reaches Alice.
Does he have the black key?
He mixes this mixture with his private to get the black key.
Right.
Then he will use that black key to decrypt this nonce.
If he is successful in doing that, that means his exchange was successful.
Do you understand?
I'm sending you something.
I'm sending you a mixture of my keys, my private plus yellow.
I'm sending it to you.
Plus I'll send you some clear text.
I'll send a message.
Hello there to you.
Right.
Once you receive that, I'm the one who sent it.
So I know what I sent.
Right.
When you receive it, what you're going to do, you.
The moment you receive the mixture, you mix it with your private to get the black key.
I don't have the black key yet, but you have it.
You send me same notes back.
You send it back to me again, but you will encrypt it using your black.
The actual key which you got, the final key, which I should also get since he encrypts it using his
black, he also sends me the mixture.
So once I see both things together, I receive the mixture.
I'll use the mixture quickly to find my black.
I will use that black to decrypt what he sent me.
If it is the same thing which I had sent before, that means our exchange was successful.
This is no, this is not hashing.
This is just to make sure this is just a dummy value, to make sure that the key exchange was successful.
Eventually it means whatever Bob is encrypting, I can decrypt it.
Right.
That's the whole purpose of it.
So they make sure that whatever Bob can encrypt, I can decrypt.
So we have the same key.
That's it.
It's just a random value just for this purpose.
By the end of the fourth packet.
Both of them know which policies to use.
Let's say they've already settled on it.
They know that for this tunnel three days is to be used and Sha is to be used.
Group.
Group was two.
So the size of this public is group two.
Size that is already used.
Nirosha.
And the three from this side.
They know three days and sha from this side is supposed to be used.
Both of them have the keying material so now they can do the rest of the stuff.
Packets.
One, two, three, four.
Done.
I guess.
One, two, three, four.
Done by the end of the fourth pocket, your actual tunnel is up.
The first tunnel is completely up.
What do I mean by that?
Your traffic will still go from public Alice to public, Bob.
It will still be on UDP 500 to 500.
It will still be isakmp.
But now inside this icy camp, it will be encrypted and hashed inside the icy cap at layer seven.
Whatever information you send now will be encrypted using this, not the whole key.
Obviously, a small amount of this key.
So whatever you're sending now will be encrypted and the other side will have to decrypt it.
So the intruder here will not be able to see what's in the fifth packet.
The first four packets is completely open.
He will see the policies that are being exchanged.
He will see the public key.
He will see the nonce, but he will not see anything else.
Why?
Because the fifth packet is important.
The fifth packet will be used.
For what?
Be ask.
Validation.
Alice is letting Bob know that he is Alice.
Bob will let Alice know that he is Bob.
How?
They will try to exchange the Cisco.
I'll send him Cisco.
He will send me Cisco.
Through the.
That's me.
That's encrypted.
Yes.
In the fifth packet, what's inside is.
I can't hear.
The key will be here.
The Pre-shared key.
She's not performing.
That is something which I want you to do.
We'll show when we do the practical.
I want you to do it.
I'll give you two things to do.
Hashing and encryption.
There's a practical I have on it.
So once you do it, we will see.
We'll see that.
Practically which one is done first?
Hashing or ESP?
Okay.
We'll still have to go through the headers.
We have not gone through the headers because the header and the ESP header, we have to go through that.
But that is package 767, eight, 789.
We'll do that later.
But do you understand this until packet number six.
Until the packet number six.
Fifth and sixth is protected completely.
So your pre-shared key, no one ever will be able to see it.
The fifth packet is I am sending you my key.
Sixth is you are sending me your key.
I appreciate not the session.
Not the session session.
Key is with you.
You have the session key already.
You don't need to exchange it.
By the end of the fourth packet, you have the session key, your actual encryption decryption key.
You already have it by the end of which packet?
Fought back my sixth and the seventh packet.
Let me explain that.
We still have time.
My sixth and the seventh packet are simple.
By the way, the first six packets are known as.
This mode is known as main mode, also called phase one.
It's also called phase one exchange.
Main mode.
First six packets.
The other three packets left.
I called quick mode or also phase two.
Not the phase two tunnel.
It's not the phase two tunnel.
It's the negotiation of the phase two tunnel and negotiated policies until now, only for what?
Phase one tunnel?
My phase two policies can be entirely different than the phase one policies.
Okay, so here I'm using three dozen right in the seventh packet.
Now everything is protected.
So the good thing is that no one in the world will see what you're negotiating.
Yes, they can see the Eichkamp exchange, but who cares about that?
Because the actual stuff is happening after the fifth packet.
The first few packets are available to anybody.
Everyone can see that.
Right.
So in the sixth packet.
This is done.
Then the seventh is the first packet of humane mode in total three packets.
Seventh packet.
I will send him again.
I want to use, let's say ease and MD5 for we call this transform set.
Transform set is your phase two.
Phase two is also known as Transform set phase two.
What we're using practically is called transform set.
Basically, I'm saying that for the actual data tunnel, I'm going to be using what is and MD5, What
am I talking about?
I'm saying for this tunnel, for the encryption and decryption of this tunnel, I'm going to use MD5
MD5.
The other side should agree on the same.
If he uses Des here, my packets will stop at the eighth packet.
My exchange is stopped.
My tunnel is not created.
My exchange will be stopped right there.
Okay.
So here also, both of the sides should agree on a yes, that's it.
Seventh and eight is.
That's all it is.
Finish your exchange is done.
You have negotiated the exchange.
You know what policies you are using.
You know that you'll be using as.
You know, that will be used, you know, will be used here.
You know, MD5 is used for hashing, MD5 is used for hashing.
You have your keying material.
Both of you have your keying material right now.
The keying material which was used here is different than the key material used here.
Why here you were using what?
So this he gets it from here again, he goes to the king material, gets it out of there, keeps it
for the IPsec community.
Yes.
Anything related to this?
So as I was saying this.
You.
The second is, would it be the same with the SK?
No, it is still again the same.
I told you it's 1024 bit material right out of that 1024 bit material.
One half was used for the first key for the first tunnel.
Then for the second part, another part is removed and used for the second part.
So the session key and the shift key are the same.
Just two different words for the same name, the shared.
What do you mean by shared key?
There's something called a shared key.
That's SK.
That's not the same.
That's only for authentication.
They're not the same.
That was only the fifth and the sixth packet.
The shared key has nothing to do with this.
All the encryption and decryption are done on which keying material answered.
Which keying material is used for encryption decryption the keying material not your SK even this right
now, the actual tunnel encryption decryption will be done using the material.
One part was removed for the first tunnel.
The second part is removed to negotiate the second tunnel at the end of the eighth packet.
The ninth packet is just an acknowledgement.
When I need for the second time I wouldn't need to a second term.
Why not?
Because it's already protected, right?
It's inside now.
You're not going to use the same tunnel.
It's a separate new tunnel which is inside the customer.
No, it's not.
It's a completely separate tunnel.
It doesn't work on UDP 500.
This tunnel that you'll be using here does not work on UDP 500.
It has a different protocol of working, which is either ESP or H.
We will talk about that later.
For now, you have to understand that this negotiation, which is happening on seven and eight, is
only to negotiate.
What kind of protocol?
Only two things.
Hashing.
I don't need authentication anymore.
Authentication is done already.
I don't need group anymore.
That has already been solved.
The only thing that is supposed to be done here is to make sure you have your three days or whatever
you're using the negotiate on S and Sha or MD5, whatever you're using.
So you choose.
I'm going to use S and MD5 and MD5.
They match from both ends.
It's done.
Any questions?
These two things are not related.
How is it secure from the handle?
I mean, you said these are these are related in a way, this because the first tunnel gives the second
tunnel the key, the keying material, the black the black key came out from the first half.
We use it for the second half.
That is the one which is used for the second time.
The whole purpose of the first tunnel is what?
Excuse me.
You can ask me if you have anything.
Yeah.
The whole purpose of the first tunnel is what?
To get the key.
That is the whole purpose plus negotiation.
I told you two things.
One is to exchange the key.
The second is to get what forgot.
The first is to get the key.
The second is what To negotiate the policies that happens before the before the second tunnel here.
Also seven and eight.
I'm doing what I'm negotiating policies for the second time.
That is the whole point.
To get the keys and to negotiate the second tunnel.
What encryption mechanism am I going to use in the second tunnel?
Right.
And what hashing mechanism am I going to use in the second tunnel since that negotiation also needs
to be protected.
So I also need a separate set of policies for the first tunnel to protect that negotiation.
Okay.
The last packet is only an acknowledgement sent by the first guy saying that everything is okay.
Just one packet to check if everything is acknowledged.
Basically saying that I have received everything.
The other guy knows that the other guy has received everything and he has everything.
So everything is okay.
Just an acknowledgement.
Very small packet from me to the other side.
Net.
We will talk more about this second tunnel tomorrow, how it is created.
This is a black, right?
Yeah.
Which mechanism is it?
Symmetric or.
The black is symmetrical, but it was generated by the symmetrical.
Right.
Asymmetrical exchange to find the symmetrical.