and 127 are prime). The DH algorithm uses the special properties associated with prime numbers. Modular arithmetic is based on a concept of doing addition and other operations on a circle as opposed to a line. The values in any arithmetic operation "wrap around" and are always less than a fixed number called the modulus. For example, to find 39 modulo 7, you simply calculate 39/7 (= 5 4/7) and take the remainder. In this case, 7 divides into 39 with a remainder of 4. Thus, 39 modulo 7 = 4. Note that the remainder (when dividing by 7) is always less than 7. Thus, the values "wrap around," as shown in the following example: 0 mod 7 = 0
1 mod 7 = 1
2 mod 7 = 2
3 mod 7 = 3
4 mod 7 = 4
5 mod 7 = 5
6 mod 7 = 6
7 mod 7 = 0
8 mod 7 = 1
9 mod 7 = 2
10 mod 7 = 3
and so on. In modular addition, you first add the two numbers normally, then divide by the modulus and take the remainder. Thus, (17+20) mod 7 = (37) mod 7 = 2. A simple analogy will help clarify this concept, but you have likely used it before when you calculate when you would have to get up in the morning if you want to get a certain number of hours of sleep. For example, assume you are planning to go to bed at 10 PM and want to get 8 hours of sleep. To figure out what time to set on your alarm, you count, starting at 10, the hours until midnight (in this case, two). At midnight (12), you reset to zero (you "wrap around" to 0) and keep counting until your total is 8. The result is 6 AM. What you just did is to solve (10 + 8) mod 12. As long as you do not want to sleep for more than 12 hours, you will get the right answer using this technique.
Content 3.1 Introducing VPN Technology 3.1.11 Data Integrity Data integrity guarantees that no tampering or alterations occur with data between the data’s source and destination. VPNs typically use one of three technologies to ensure integrity:
Content 3.1 Introducing VPN Technology 3.1.12 VPN Security: Authentication When conducting business remotely, you need to know who is at the other end of the phone, e-mail, or fax. The same is true of VPN networking. The device on the other end of the VPN tunnel must be authenticated before the communications path is considered secure. The following are methods used between two peers to establish that they are each connecting to the right person and not to someone pretending to be that peer: Authentication, authorization, and accounting (AAA) servers are used for more secure access in a remote-access VPN environment. When a request to establish a session comes in from a dialup client, the request is proxied to the AAA server. AAA then checks and records the following: The accounting information is especially useful for tracking client use for security auditing, billing, or reporting purposes.
Content 3.2 Understanding IPsec Components and IPsec VPN Features 3.2.1 IPsec Security Features IPsec provides a mechanism for secure data transmission over IP networks, ensuring confidentiality, integrity, and authenticity of data communications over unprotected networks such as the Internet . IPsec encompasses a suite of protocols and is not bound to any specific encryption or authentication algorithms, key generation technique, or security association (SA). IPsec provides the rules while existing algorithms provide the encryption, authentication, key management, and so on. IPsec acts at the network layer, protecting and authenticating IP packets between IPsec devices (peers), such as Cisco PIX Firewalls, Adaptive Security Apliances (ASA), Cisco routers, the Cisco Secure VPN Client, and other IPsec-compliant products. IPsec is an Internet Engineering Task Force (IETF) standard (RFC 2401-2412) that defines how a VPN can be created over IP networks. IPsec provides the following essential security functions: