Chapter 19 — Identity and cryptography

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Keys and certificates"]
  N2["19.2 IPsec and IKEv2"]
  N3["19.3 TLS for applications"]
  N4["19.4 Key lifecycle"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Keys and certificates"]
  N2["19.2 IPsec and IKEv2"]
  N3["19.3 TLS for applications"]
  N4["19.4 Key lifecycle"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Keys and certificates]
    |
    v
[19.2 IPsec and IKEv2]
    |
    v
[19.3 TLS for applications]
    |
    v
[19.4 Key lifecycle]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) explain certificates and keys for network devices; (2) choose VPN authentication; (3) apply TLS guidance.

19.1 Keys and certificates

Network devices prove their identity with cryptographic keys. A certificate binds a public key to a name and is signed by a certificate authority. For the council's VPN between offices, each firewall gets a certificate from the council's internal authority. This is stronger than shared passwords, which are often reused, rarely changed and hard to revoke for a single device. If one firewall is stolen, its certificate is revoked without affecting the others.

Each certificate's owner and expiry date should be recorded in an inventory.

19.2 IPsec and IKEv2

Site-to-site tunnels use IPsec (RFC 4301) with keys negotiated by IKEv2 (RFC 7296). NIST SP 800-77 Rev. 1 recommends IKEv2, certificate authentication, and modern algorithms such as AES-GCM with strong Diffie-Hellman groups. Kofi follows these recommendations and records the chosen parameters in the design, so that future reviewers can compare them with updated guidance rather than guessing what was configured.

IKEv2 negotiates keys and algorithms between the two ends and re-keys periodically, so a key exposed later reveals limited traffic. Engineers choose current algorithm suites and authenticate peers with certificates rather than shared secrets where possible.

19.3 TLS for applications

Within zones, applications such as the case management system use TLS. NIST SP 800-52 Rev. 2 recommends TLS 1.2 or 1.3 with specific cipher suites, and RFC 8446 defines TLS 1.3. Kofi checks the council's main web applications' TLS settings using reports from the council's web team and lists two older systems still allowing outdated protocol versions for remediation.

TLS protects individual application connections such as web and mail. Engineers require current protocol versions, disable outdated ones, and ensure clients validate server certificates, since encryption without validation does not confirm who is on the other end.

19.4 Key lifecycle

Keys and certificates expire and must be renewed. Expired certificates cause outages that look like network failures. Kofi adds certificate expiry dates to the monitoring and sets alerts sixty days before expiry, and documents how a certificate is revoked if a device is lost.

Keys pass through generation, distribution, use, rotation and destruction. Each stage needs a defined owner and procedure. Rotation limits the exposure if a key leaks, and an inventory with expiry dates prevents outages caused by certificates silently expiring. Revocation must also be planned, so a compromised key can be withdrawn quickly.

Worked example

The VPN profile specifies IKEv2, certificate authentication, AES-256-GCM and a 3072-bit or elliptic-curve Diffie-Hellman group, with lifetimes recorded in the design.

Synthetic case. Parameters are illustrative and synthetic.

Errors and limits

Strong algorithms do not help if private keys are stored unprotected on shared drives.

Exercises

• EX055 — Certificates vs passwords. Give two advantages of certificate authentication for site VPNs.
  Show marking criteria

  Rubric: 3 = per-device revocation and no shared secrets;; 2 = one;; 1 = vague;; 0 = none.
• EX056 — Guidance mapping. Which documents guide IPsec and TLS choices?
  Show marking criteria

  Rubric: 3 = SP 800-77r1/RFC 7296 and SP 800-52r2/RFC 8446;; 2 = some;; 1 = vague;; 0 = none.
• EX057 — Expiry alerts. Why alert sixty days before certificate expiry?
  Show marking criteria

  Rubric: 3 = time to renew without outage;; 2 = warning;; 1 = vague;; 0 = none.

Synthesis

Certificates, IKEv2 and current TLS guidance give the design strong, manageable cryptography.

Continue studying — chapter 19 of 50

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →