CAs are responsible for managing certificate requests and issuing certificates to participating IPSec network devices. These
services provide centralized key management for the participating devices.
CAs simplify the administration of IPSec network devices. You can use a CA with a network containing multiple IPSec-compliant
devices, such as routers.
Digital signatures, enabled by public key cryptography, provide a means of digitally authenticating devices and individual
users. In public key cryptography, such as the RSA encryption system, each user has a key pair containing both a public and
a private key. The keys act as complements, and anything encrypted with one of the keys can be decrypted with the other. In
simple terms, a signature is formed when data is encrypted with a user’s private key. The receiver verifies the signature
by decrypting the message with the sender’s public key. The fact that the message could be decrypted using the sender’s public
key indicates that the holder of the private key, the sender, must have created the message. This process relies on the receiver’s
having a copy of the sender’s public key and knowing with a high degree of certainty that it does belong to the sender and
not to someone pretending to be the sender.
Digital certificates provide the link. A digital certificate contains information to identify a user or device, such as the
name, serial number, company, department, or IP address. It also contains a copy of the entity’s public key. The certificate
is itself signed by a CA, a third party that is explicitly trusted by the receiver to validate identities and to create digital
certificates.
To validate the signature of the CA, the receiver must first know the CA’s public key. Normally, this process is handled out-of-band
or through an operation done at installation. For instance, most web browsers are configured with the public keys of several
CAs by default. IKE, an essential component of IPSec, can use digital signatures to authenticate peer devices for scalability
before setting up SAs.
Without digital signatures, a user must manually exchange either public keys or secrets between each pair of devices that
use IPSec to protect communication between them. Without certificates, every new device added to the network requires a configuration
change on every other device with which it communicates securely. With digital certificates, each device is enrolled with
a CA. When two devices want to communicate, they exchange certificates and digitally sign data to authenticate each other.
When a new device is added to the network, a user simply enrolls that device with a CA, and none of the other devices needs
modification. When the new device attempts an IPSec connection, certificates are automatically exchanged and the device can
be authenticated.
Feedback