Deffie Hellman key exchange question

23nick — Fri, 24 Jul 2020 10:18:04 GMT

Hello,

I understand that DH is used to generate a symmetric key over a unsecure channel, it is needed to send algorithm over a unsecure channel.

Below is my question:

R1------Internet------R2

For eg R1 & R2 negotiate on pre-defined key 10.

Then R1 generate random secret number 5(this will not be disclosed and it generated based on group number for eg group2, group5)

Now addition of pre-define key 10 and random secret no 5 = 15-->this key is shared to R2

R2 does same thing, addition of pre-define 10 and here random secret 15=25-->shares with R1.

Now when R1 will say whetever no i have received from R2, i will add my secret number to that.

i.e 25+5=30-->From this number they generate encryption & hashing algorithm

R2 does same process and gets same number i.e 30.

Question here is in my vpn configuration i haven't defined any pre-share no. How does R1 & R2 negotites on number 10 ?

crypto isakmp policy 1

authentication pre-share---->only used for authentication

hash md5

encryption 3des

group 2

crypto isakmp key cisco 123 address 192.1.23.3

Phase 2

crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac

access-list 101 permit ip 10.1.1.0 0.0.0.255 10.3.3.0 0.0.0.255

Crypto map CMAP 10 ipsec-isakmp

set peer 192.1.23.3

set transform-set TSET1

match address 101

int e0/0

crypto map CMAP

Thanks,

Nick

Re: Deffie Hellman key exchange question

Marius Gunnerud — Fri, 24 Jul 2020 21:00:58 GMT

The way you described the calculation of diffie hellman doesn't sound like how the calculation is made. The formula for calculating Diffie-Hellman is: (where p = prime number (public), g = random number (public), and a = secret number (private))

Site1: A = (g^a) mod p

Site2: B = (g^a) mod p

Then A and B are exchanged between the two sites where the message is decrypted by inserting A and B respectively into the equation along with using their own private number and both sides will come to the same answer.

p and g are random positive numbers that are generated (I assume by the initiator...though this I am not certain of) and agreed upon by both sides.

for example:

p = 33
g = 14

Site 1:
a = 6
A = (14^6) mod 33 = 25
B = (5^6) mod 33 = 16

Site 2:
a = 3
B = (14^3) mod 33 = 5
A = (25^3) mod 33 = 16

Then once the calculations are completed, the number 16 can be used to secure the exchange of security associations which will be used to encrypt traffic.

topic Deffie Hellman key exchange question in Network Security

Deffie Hellman key exchange question

Re: Deffie Hellman key exchange question