HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

DES Data Encryption Standard. Uses a 56-bit key for symmetric key block encryption. DES is suitable
for bulk data encryption.
DES has been cracked (data encoded using DES has been decoded by a third party).
Diameter Base A protocol that provides authentication, authorization, and accounting (AAA) services based on
the RADIUS protocol. The Diameter protocol provides the same functionality as RADIUS, with
improved reliability, security and infrastructure. See also RADIUS.
Diffie-Hellman
A public-key method to generate a symmetric key where two parties can publicly exchange values
and generate the same symmetric key. Start with prime p and generator g, which may be publicly
known (typically these numbers are from a well-known Diffie-Hellman Group). Each party selects
a private value (a and b) and generates a public value (g**a mod p) and (g**b mod p). They
exchange the public values. Each party then uses its private value and the other party's public
value to generate the same symmetric key, (g**a)**b mod p and (g**b)**a mod p, which
both evaluate to g**(a*b) mod p for future communication.
The Diffie-Hellman method must be combined with authentication to prevent man-in-the-middle
or third-party attacks (spoofing) attacks. For example, Diffie-Hellman may be used with certificate
or preshared key authentication.
Digital
Signature
Digital signatures are a variation of keyed hash algorithms that use public/private key pairs. The
sender uses its private key and the data as input to create a Digital Signature value.
EAP Extensible Authentication Protocol. A protocol that provides a framework for using multiple
authentication methods and protocols, including passwords, Kerberos, and challenge-response
protocols.
Encapsulating
Security
Payload
See ESP.
encryption The process of converting data from a readable format to nonreadable format for privacy.
Encryption functions usually take data and a cryptographic key (value or bit sequence) as input.
ESP Encapsulating Security Payload. This is part of the IPsec protocol suite. The ESP provides
confidentiality (encryption) and an antireplay service. It should be used with authentication,
either with the optional ESP authentication field (authenticated ESP) or nested in an authentication
header message. Authenticated ESP also provides data origin authentication and connectionless
integrity. When used in tunnel mode, ESP also provides limited traffic flow confidentiality.
event An action, such as creating a file, opening a file, or logging in to the system.
Extensible Authentication Protocol
See EAP.
filter A mechanism for screening unwanted objects, or the parameters that specify the objects allowed
or denied access. Typically, a filter is used to screen unwanted network packets (a packet filter).
fine-grained
privilege
A permission to perform a specific, low-level operation (for example, permission to execute a
specific system call).
firewall One or more devices or computer systems used as a barrier to protect a network against unwanted
users or harmful, intrusive applications. See also bastion host and hardened system.
hardened
system
A computer system with minimal operating system features, users, and applications that is used
as a barrier to protect a network against unwanted users or harmful, intrusive applications. Also
referred to as a bastion host.
201