Certificate authorities (CAs) are responsible for managing certificate
requests and issuing certificates to participating IPSec network devices. These
services provide centralized key management for the participating devices.
CAs simplify the administration of IPSec network devices. You can use a
CA with a network containing multiple IPSec-compliant devices such as routers.
Digital signatures, enabled by public key cryptography, provide a means
of digitally authenticating devices and individual users. In public key
cryptography, such as the RSA encryption system, each user has a key pair
containing both a public and a private key. The keys act as complements, and
anything encrypted with one of the keys can be decrypted with the other. In
simple terms, a signature is formed when data is encrypted with a user's
private key. The receiver verifies the signature by decrypting the message with
the sender's public key. The fact that the message could be decrypted using the
sender's public key indicates that the holder of the private key, the sender,
must have created the message. This process relies on the receiver's having a
copy of the sender's public key and knowing with a high degree of certainty
that it really does belong to the sender and not to someone pretending to be
the sender.
Digital certificates provide the link. A digital certificate contains
information to identify a user or device, such as the name, serial number,
company, department, or IP address. It also contains a copy of the entity's
public key. The certificate is itself signed by a certification authority (CA),
a third party that is explicitly trusted by the receiver to validate identities
and to create digital certificates.
In order to validate the signature of the CA, the receiver must first
know the CA's public key. Normally this process is handled out-of-band or
through an operation done at installation. For instance, most web browsers are
configured with the public keys of several CAs by default. The Internet Key
Exchange (IKE), an essential component of IPSec, can use digital signatures to
scalably authenticate peer devices before setting up security associations.
Without digital signatures, one must manually exchange either public
keys or secrets between each pair of devices that use IPSec to protect
communications between them. Without certificates, every new device added to
the network requires a configuration change on every other device with which it
communicates securely. With digital certificates, each device is enrolled with
a certification authority. When two devices wish to communicate, they exchange
certificates and digitally sign data to authenticate each other. When a new
device is added to the network, one simply enrolls that device with a CA, and
none of the other devices needs modification. When the new device attempts an
IPSec connection, certificates are automatically exchanged and the device can
be authenticated.