Hi,
actually, it took me two days to figure it out - the documentation does not contain any relevant information. Contacted Cisco developer support - well, they just sent me the document which is available on their web anyway.
Now, if you pay me a hundred million dollars, I might be able I will tell you how to implement encryption on the GED-145 (application gateway) protocol.
The encryption used is actually DES, or, more specifically, its variant named Electronic Code Book (ECB), with no padding.
There's a preshared key on the ICM server running the Router > Application Gateway process, saved as a Windows registry key, at
HKEY_LOCAL_MACHINE\SOFTWARE\Cisco Systems, Inc.\ICM\[instanceName]\RouterA\Router\CurrentVersion\Configuration\ApplicationGateway called SessionKey, string "SESSIONK" by default.
When ICM Application Gateway first contacts the Application Gateway host, using the OPEN_REQ message, the third integer value will tell you wether to use encryption or not. The same message will contain the encrypted key (generated by ICM), encrypted using the preshared key, doubled (so instead of 8 bytes, it'll contain 16 bytes). You have decrypt it using the preshared kay. From now on, the payload of all messages must be encrypted/decrypted with that session key - so the QUERY_REQ and QUERY_RESP messages will have to look like: 4 bytes: message length, 4 bytes: message type, n bytes: encrypted payload. A new session key will be generated on ICM with a new session.
This provides end-to-end encryption between the ICM router and the host. Of course, it never hurts to combine this with IPSEC on the network level I guess if you are paranoid.
Hope this helps.
G.
