一种基于数字签名的IKE协议的实现与分析

One IKE Protocol Based on Digital Signature and its Analysis

一引言 现在的虚拟专用网络主要采用两种技术实现：一种技术是采用配置物理设备的方法，使得数据包在被认为安全的路由上进行明文传输，另一种技术是将数据进行加密，然后在开放的网络上进行密文传输。在采用加密方式的虚拟专用网中，关键是如何实现动态产生及分发新鲜的会话密钥，密钥分发过程是必须是安全的，能够有效地抵抗可能的攻击，这是任何一种因特网密钥交换协议(IKE)需要解决的主要问题。

This document describes one protocol which uses Diffie-Hellman algorithm and part of Session-Key Management Protocol in conjunction with ISAKMP to obtain keying materials authenticated by RSA digital signature for use with ISAKMP and for other security association such as AH and ESP for the IETF IPsec DOI. Also this document analyzes the protocol is how to resist some forms of attacks.