Zyxel-communications 802.11g Wireless ADSL2+ 4-port VoIP IAD P-2602HWNL Uživatelský manuál stáhnout pdf (Strana 256)

100

101

P-2602HWNLI User’s Guide

256 Chapter 17 VPN Screens

17.12.2 Diffie-Hellman (DH) Key Groups

Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish

a shared secret over an unsecured communications channel. Diffie-Hellman is used within

IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 –

DH2) Diffie-Hellman groups are supported. Upon completion of the Diffie-Hellman

exchange, the two peers have a shared secret, but the IKE SA is not authenticated. For

authentication, use pre-shared keys.

17.12.3 Perfect Forward Secrecy (PFS)

Enabling PFS means that the key is transient. The key is thrown away and replaced by a brand

new key using a new Diffie-Hellman exchange for each new IPSec SA setup. With PFS

enabled, if one key is compromised, previous and subsequent keys are not compromised,

because subsequent keys are not derived from previous keys. The (time-consuming) Diffie-

Hellman exchange is the trade-off for this extra security.

This may be unnecessary for data that does not require such security, so PFS is disabled

(None) by default in the ZyXEL Device. Disabling PFS means new authentication and

encryption keys are derived from the same root secret (which may have security implications

in the long run) but allows faster SA setup (by bypassing the Diffie-Hellman key exchange).

17.13 Configuring Advanced IKE Settings

Click Advanced Setup in the Edit VPN Policies screen to open this screen.

1 2 ... 251 252 253 254 255 256 257 258 259 260 261 ... 441 442

Komentáře k této Příručce

Žádné komentáře

Zyxel-communications 802.11g Wireless ADSL2+ 4-port VoIP IAD P-2602HWNL Uživatelský manuál Strana 256

Komentáře k této Příručce

Související produkty a manuály pro Hardware Zyxel-communications 802.11g Wireless ADSL2+ 4-port VoIP IAD P-2602HWNL