论文部分内容阅读
文中介绍了IKE中密钥的产生过程,明确该过程可能产生对系统安全不利的弱密钥。对于IKE部署中是否需要进行弱密钥过滤的问题,IKE相关的多个标准文档中并未给出一致的结论,亦未给出充分的依据。在此背景下,对IKE标准文档中要求必须使用的密码算法、部分建议使用的密码算法的弱密钥进行了研究。结合IKE的实际使用情况,包括密钥生存周期、IKE/IPsec报文格式等,分析了弱密钥对IKE系统的影响,明确给出了目前涉及的密码算法都不需要进行弱密钥过滤的结论。
This paper introduces the generation process of key in IKE and makes it clear that the process may produce a weak key that is unfavorable to system security. For the problem of whether the weak key filtering needs to be performed in the IKE deployment, no consistent conclusions are given in the standard documents related to IKE and no sufficient basis is provided. In this context, we study the cryptographic algorithms that must be used in the IKE standard document and some of the weak cryptographic algorithms we recommend. According to the actual usage of IKE, including key lifetime and IKE / IPsec message format, the impact of weak key on IKE system is analyzed. It is clear that the current cryptographic algorithms do not need weak key filtering in conclusion.