HP-UX IPSec version A.02.00 Administrator's Guide

Glossary 305
Glossary
3DES Triple Data Encryption Standard.
Uses a 168-bit key for symmetric key block
encryption. It is suitable for encrypting large
amounts of data. Last certified by the US
government (NIST) as a standard in 1999. It
must be re-certified every 5 years.
AES Advanced Encryption Standard. Uses a
symmetric key block encryption. HP-UX
IPSec supports AES with a 128-bit key. AES
is suitable for encrypting large amounts of
data. Last certified by the US government
(NIST) as a standard in 2001. It must be
re-certified every 5 years.
AH See Authentication Header.
Authentication Header (AH) The AH
provides data integrity, system-level
authentication and can provide anti-replay
protection.
Authentication The process of verifying a
user's identity or integrity of data, or the
identity of the party that sent data.
Asymmetric keys, public/private keys
Based on cryptography algorithms where
data can be encrypted with a public key but
only decrypted with the corresponding
private key. In addition, data encrypted by a
private key can be decrypted with the
corresponding public key with the assurance
that only the given private key could have
encrypted the data.
CA See Certificate Authority.
Certificate A security certificate associates
(or binds) a public key with a principal--a
particular person, device, or other entity.
The security certificate is issued by an entity,
in whom users have put their trust, called a
certificate authority (CA) that guarantees or
confirms the identity of the holder (person,
device, or other entity) of the corresponding
private key. The CA digitally signs the
certificate with the CA’s private key, so the
certificate can be verified using the CA’s
public key.
The format for public-key certificates is
defined by the International Organization
for Standardization (ISO) X.509 standard,
Version 3.
Certificate Authority (CA) Certificate
authority is a trusted third party that
authenticates users and issues certificates.
In addition to establishing trust in the
binding between a user’s public key and
other security-related information in a
certificate, the CA digitally signs the
certificate information using its private key.
Certificate Revocation List (CRL)
Certificates are issued with a specific
lifetime, defined by a start date/time and an
expiration date/time. However, situations
can arise, such as a compromised key value,
that necessitate the revocation of the
certificate. In this case, the certificate
authority can revoke the certificate. This is
accomplished by including the certificate’s
serial number on a Certificate Revocation
List (CRL) updated and published on a
regular basis by the CA and made available
to certificate users.
CRL: See Certificate Revocation List.
DES Data Encryption Standard. Uses a
56-bit key for symmetric key block
encryption. It is suitable for encrypting large
amounts of data. Last certified by the US
government (NIST) as a standard in 1999. It
must be re-certified every 5 years.