Juniper Chapter 10

Front 1

What is a VPN and what does it provide?

Back 1

Virtual Private Network. It provides a secure path for communication between private sites via a public network.

Front 2

What are the three benefits of data encryption?

Back 2

1)Provide Data confidentiality
2)Data is encrypted and decrypted using keys
3)data encryption is a reversable process

Front 3

What 2 types of keys used in encryption?

Back 3

Symmetric (secret) Keys
Asymmetric (public and private) Keys

Front 4

What does the ciphers strength depend on and what is the trade off for a stronger cipher?

Back 4

Cipher strength depends on the key size. The larger the key the stronger the cipher. The trade off for strength is speed. The larger the key the longer it take to encrypt and decrypt the information.

Front 5

What is the normal size of the keys in Symmetric Key Encryption?

Back 5

40 bits - 1024 bits

Front 6

What are three examples of symmetric key encryption?

Back 6

1)DES
2) 3DES
3) AES

Front 7

In Asymmetric Encryption what is the typical size range of the Key?

Back 7

512bits to 2048bits

Front 8

What are two examples of Asymmetric Encryption?

Back 8

1) RSA
2) DH

Front 9

What is a Hashing Algorith used for?

Back 9

To create a fingerprint of the data so that the recipient can tell the data has not been modified.

Front 10

What are two types of Hashing Algorithms and what is the out put for each?

Back 10

1) MD5 128bit output
2) SHA 160bit output

Front 11

Hashing functions must have what 2 basic properties?

Back 11

1) must be one way so that the original data can not be determined from the hashed output
2) it must be collision resistant. this is so that no two input can create the same output.

Front 12

What is Source Authentication?

Back 12

Validates datagrams by verifying that they came from the proper source

Front 13

What is used to do Source Authentication and how does it work?

Back 13

Hashed Method Authentication Code (HMAC) the sender adds a key to the data then performs a hash function. The recipient has the same key as the sender. Once the recipient receive the data-gram he separates the added hash from the data gram. He then adds the key he has and runs his on hashing function. Then he compares the two hashing output. if they match then the sender is validate if they do not match then either the data is either corrupted or been tampered with.

Front 14

What is the main key exchange that Juniper Firewalls use?

Back 14

Diffie-Hellman Key Exchange Algorithm

Front 15

What are the three groups and bits that Juniper supports for Diffie-Hellman

Back 15

Group 1 768-bit
Group 2 1024-bit
Group 5 1536-bit

Front 16

What is the DH Key process?

Back 16

1) Each device generates a public and private key
2) public key are exchanged
3) local private and remote public keys are used in DH to form a common session key

Front 17

What is IPSec?

Back 17

IP Security, is an industry standard for providing data security and integrity services

Front 18

What two protocols are defined in IPSec?

Back 18

1) Encapsulating Security Protocol
2) Authentication Header Protocol

Front 19

Describe the two IPSec modes.

Back 19

1) Tunnel mode is the most commonly used. Implemented between an IPSec gateway and a remote hot of between two IPSec gateways. End system does not need to be aware of the IPSec protocol because encryption and decryption take place on the IPSec Gateways.
2) Transparent mode is implemented between IPsec end systems. Each end system must be aware of the IPSec Protocol because it does the Encryption and Decryption.

Front 20

What is IKE?

Back 20

Internet Key Exchange Protocol.
Is a secure key management protocol used by IPSec to have information exchanged in a secure and dynamic manner with little to no intervention.

Front 21

What is ESP and how does it work?

Back 21

Encapsulating Security Payload Protocol. The esp header is inserted between the newly created IP header and the original IP header. After the original Packet there is a ESP trailor and ESP Auth added as well.

Front 22

What is contained in the ESP Header?

Back 22

1)Protocol Number 50
2) Security Parameter index which is and arbitrary 32-bit value that in combination with the IP Address and ESP uniquely ID the SA for this datagram
3) sequence number which is an unsigned 32-bit field containing a monotonically increasing counter value that is used to detect antireplat

Front 23

What is contained in the ESP Trailor?

Back 23

1)Padding/pad length. depending on the original data size padding may be required to fill the packet.
2)Next header which is information on the next expected segment.

Front 24

What us contained in the ESP Auth?

Back 24

ESP Auth is a integrity check value that is a hashed value for the entire packet.

Front 25

What is AH?

Back 25

The Authentication Header Protocol Provides only data integrity authentication and anti-replay services. AH does not provide encryption.

Front 26

How does AH protocol work?

Back 26

Places a AH inbetween the new IP header and the original IP Header and then places a AH Auth at the end of the packet.

Front 27

What is contained in the AH header?

Back 27

1) Protocol number 51
2) Next header information on the next expected segement
3) Payload length
4) SPI to uniquly ID the SA for this data gram
5) Sequence number to detect Replay attacks

Front 28

What is contained in the AH Auth?

Back 28

Contains the ICV that is the hash value for the packet.

Front 29

What attributes are exchanged between IPSec Peers as a part of the IKE process?

Back 29

1) Encryption Algorithm
2) Hash Algorithm
3) Authentication method
4) Diffie-hellman Group

Front 30

What three items are used to authenticate IKE exchanges?

Back 30

1) Preshared Keys
2)Digital Signatures
3)Public Key Encryption

Front 31

What is SA?

Back 31

Security Association is a set of policies and keys used to protect information. SAs are established upon successful completion of IKE negotiations.

Front 32

What happens in Phase 1 of IKE?

Back 32

1)Two peers Establish a Secure authenticated channel with which to communicate
2) DH Key exchange algorithm is used to generate a symmetric key common to the communication gateway.
3) runs in either main mode or aggressive mode

Front 33

What happens in Phase 2 of the IKE process?

Back 33

1)SAs are negotiated using Phase 1 secure channel
2) Proxy ID used to Identify which SA is referenced for VPN
3) DH Key exchange algorithm can be used to create PFS (perfect forward secrecy)