How Kerberos, PKI and IPsec interoperate

BROWSE BY TAG Identity Management and Access Control,   PKI and Digital Certificates,   Enterprise Identity and Access Management,   User Authentication Services,   Secure VPN Setup and Configuration,   Enterprise Network Security,   IPsec VPN Security,   Expert Archive: Identity Management and Access Control,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Identity Management and Access Control Is Identity Management as a Service (IDaaS) a good idea? How to log in to multiple servers with federated single sign-on (SSO) How to confirm the receipt of an email with security protocols Learn about enterprise strategy for server virtualization single sign-on Employee information security awareness training for new IAM systems Can you combine RFID tag technology with GPS to track stolen goods? Is there a free enterprise-caliber password-management tool? Cryptosystem attacks that do not involve obtaining the decryption key Can any firm or organization get a digital signature certificate? Should the CTO have domain administrator access? PKI and Digital Certificates Best Authentication Products DoD urges less network anonymity, more PKI use Researchers to demonstrate new EV SSL man-in-the-middle hacks Portable security storage device could replace OTP devices What is most misunderstood about EV SSL certificates? VeriSign addresses MD5 flaw Rogue digital certificates strike blow to Internet security Can any firm or organization get a digital signature certificate? How to obtain a digital certificate for a server PKI and digital certificates: Security, authentication and implementation PKI and Digital Certificates Research IPsec VPN Security Best Remote Access Products How to set up a split-tunnel VPN in Windows Vista What is the difference between a VPN and remote control? A short enterprise VPN deployment guide From the ground up: Creating secure WLANs Can S/MIME, XML and IPsec operate in one protocol layer? How to create a secure network through a shared Internet connection What firewall controls should be placed on the VPN? VoIP tools, attacks could increase threat Best practices for processing financial data through remote servers IPsec VPN Security Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary authentication server  (SearchSecurity.com) Certificate Revocation List  (SearchSecurity.com) Digital Signature Standard  (SearchSecurity.com) HDCP  (SearchSecurity.com) MD2  (SearchSecurity.com) MD4  (SearchSecurity.com) MD5  (SearchSecurity.com) nonrepudiation  (SearchSecurity.com) PKI  (SearchSecurity.com) public key  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Yes, all three are interoperable. The real question is, how? Since these are three separate and totally unrelated systems, let's examine each.

PKI (public key infrastructure), is a repository and management system for digital certificates. It can be the central authority in an organization for issuing, managing, storing, verifying, distributing and (eventually) retiring such certificates.

IPsec is a secure encrypted tunnel between two hosts communicating openly over the Internet. It's used in VPNs (virtual private networks) to provide authentication and confidentiality for traffic sent between the hosts.

Kerberos is an intricate encryption system that uses a series of tickets created and distributed by a central Kerberos server. It maintains security by issuing unique tickets for each session and transaction. Windows 2000, Windows XP and Windows 2003 Server are examples of systems that can use Kerberos.

How does it all come together? IPsec can use Kerberos for authentication and PKI to manage its digital certificates. There are packages available for mixing, matching and integrating all three systems. However, before any implementation, you should thoroughly evaluate their impact on the performance of your systems. You should also look at the number of users you have and their needs.

Each of the three systems has its pluses and minuses. PKI is not universal, Kerberos can be tricky to implement and install, and IPsec can be successfully set up without using either. Again, the best advice is to evaluate and plan before implementation.

More Information