Return to README.plainrsa CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon / doc

Annotation of embedaddon/ipsec-tools/src/racoon/doc/README.plainrsa, revision 1.1.1.1

1.1       misho       1: HOW-TO use plainrsa auth, contributed by Simon Chang <simonychang@gmail.com>
                      2: 
                      3: Before you begin, you should understand that the RSA authentication
                      4: mechanism hinges upon the idea of a split cryptographic key:  one used
                      5: by the public, the other readable only to you.  Any data that is
                      6: encrypted by a public key can be decrypted only by the corresponding
                      7: private key, so that the private key user can be assured that the
                      8: content of the transmission has not been examined by unauthorized
                      9: parties.  Similarly, any data encrypted by the private key can be
                     10: decrypted by the public key so that the public knows that this
                     11: transmission came from this user and nobody else (this idea is called
                     12: non-repudiation).  Also, the longer the key length, the more difficult
                     13: it would be for potential attacker to conduct brute-force discovery of
                     14: the keys.  So, what all this means for the security administrator is
                     15: that the setup needs a pair of reasonably long keys for each host that
                     16: wishes to authenticate in this manner.
                     17: 
                     18: With this in mind, it should be relatively straightforward to set up
                     19: RSA authentication.  For the purpose of this document, we assume that
                     20: we are setting up RSA authentication between two networked hosts
                     21: called Boston and Chicago.  Unless otherwise noted, all steps should
                     22: be performed on both hosts with corresponding key names.  Here are the
                     23: steps:
                     24: 
                     25: 1)  Included in each default installation of ipsec-tools is a binary
                     26: called plainrsa-gen.  This executable is used to generate a pair of
                     27: RSA keys for the host.  There are only two parameters that you should
                     28: be concerned about: -b, which sets the number of bits for the keys,
                     29: and -f, which specifies the output file for plainrsa-gen to send the
                     30: results.  On an ordinary Pentium-II with 128 MB of RAM, it takes only
                     31: seconds to generate keys that are 2048 bits long, and only slightly
                     32: longer to generate 4096-bit keys.  Either key length should be
                     33: sufficient; any longer key length actually reduces performance and
                     34: does not increase security significantly.  You should therefore run it
                     35: as:
                     36: 
                     37:        plainrsa-gen -b 2048 -f /var/tmp/boston.keys
                     38: 
                     39: 2)  When the process completes, you should have a text file that
                     40: includes both public and private keys.  GUARD THIS FILE CAREFULLY,
                     41: because once a private key is compromised it is no longer any good,
                     42: and you must generate a new pair from scratch.  Reading the file
                     43: itself, you should see several very long lines of alphanumeric data.
                     44: The only line you should be concerned with is the line towards the top
                     45: of the output file that begins with "# pubkey=0sAQPAmBdT/" or
                     46: something to that effect.  This line is your public key, which should
                     47: be made available to the other host that you are setting up.  Copy
                     48: this line to a separate file called "boston.pub" and change the
                     49: beginning of the line so that it reads ": PUB 0sAQPAmBdT/".
                     50: Alternatively, you can also grab the first line of the boston.keys
                     51: file and uncomment the line so that it reads the same as above.  Now
                     52: rename the file you generated initially to "boston.priv".
                     53: 
                     54: 3)  You should now have two files, boston.priv and boston.pub
                     55: (chicago.priv and chicago.pub on Chicago).  The first file contains
                     56: your private key and the second file your public key.  Next you should
                     57: find a way to get the public key over to the other host involved.
                     58: Boston should have (1) its own key pair, and (2) Chicago's public key
                     59: ONLY.  Do not copy Chicago's private key over to Boston, because (a)
                     60: it is not necessary, and (b) you would now have two potential places
                     61: for losing control of your private key.
                     62: 
                     63: 4)  You should now configure the racoon.conf configuration file for
                     64: each host to (a) turn on RSA authentication, and (b) designate each
                     65: host's private key and the remote host(s)'s public key(s).  Take all
                     66: your keys and place it in one directory and use the global directive
                     67: "path certificate" to specify the location of the keys.  This step is
                     68: especially important if you are running racoon with privilege
                     69: separation, because if racoon cannot find the keys inside the
                     70: directory you have just specified it will fail the authentication
                     71: process.  So, write the directive like the following:
                     72: 
                     73:        path certificate "/etc/racoon";
                     74: 
                     75: Next, you need to specify the host's own private key and the public
                     76: keys of all the remote peers involved. For your local private key and 
                     77: remote public key(s), you should use the following directives:
                     78: 
                     79:        certificate_type plain_rsa "/etc/racoon/boston.priv";
                     80:        peers_certfile plain_rsa "/etc/racoon/chicago.pub";
                     81: 
                     82: Notice the option "plain_rsa" for both directives.
                     83: 
                     84: Finally, under the "proposal" statement section, you should specify
                     85: the "rsasig" option for "authentication_method".
                     86: 
                     87: 5)  You have finished configuring the host for RSA authentication.
                     88: Now use racoonctl to reload the configuration or simply restart the
                     89: machine and you should be all set.
                     90: 
                     91: TROUBLESHOOTING
                     92: 
                     93: In the event that the hosts fail to communicate, first go back to the
                     94: instructions above and make sure that:
                     95: 
                     96: 1)  You have placed all the keys in the directory that is specified by
                     97: the "path certificate" directive.  Keep in mind that privilege
                     98: separation will force racoon to look into that directory and nowhere
                     99: else.
                    100: 2)  You have specified correctly the host's own private key and the
                    101: remote peer's public key.
                    102: 3)  You have specified the "rsasig" method for authentication in the
                    103: proposal statement.
                    104: 
                    105: If you run into any further problems, you should try to use "racoon
                    106: -v" to debug the setup, and send a copy of the debug messages to the
                    107: mailing list so that we can help you determine what the problem is.
                    108: 
                    109: Last modified: $Date: 2006/12/10 05:51:14 $