2 cissp ® Official Study Guide Eighth Edition

523
Secure Communications Protocols
Protocols that provide security services for application-specific communication channels 
are called secure communication protocols. The following list includes a small sampling of 
some of the options available:
IPsec

Internet Protocol security (IPsec) uses public key cryptography to provide encryption, 

access control, nonrepudiation, and message authentication, all using IP-based protocols. The pri-
mary use of IPsec is for virtual private networks (VPNs), so IPsec can operate in either transport 
or tunnel mode. IPsec is discussed further in Chapter 7, “PKI and Cryptographic Applications.”
Kerberos

Kerberos offers a single sign-on solution for users and provides protection 

for logon credentials. Modern implementations of Kerberos use hybrid encryption to 
provide reliable authentication protection. Kerberos is discussed further in Chapter 13, 
“Cryptography and Symmetric Key Algorithms.”
SSH

Secure Shell (SSH) is a good example of an end-to-end encryption technique. This 

security tool can be used to encrypt numerous plaintext utilities (such as rcp, rlogin, rexec), 
serve as a protocol encrypter (such as with SFTP), and function as a VPN.
Signal Protocol

This is a cryptographic protocol that provides end-to-end encryption for 

voice communications, videoconferencing, and text message services. The Signal Protocol 
is nonfederated and is a core element in the messaging app named Signal.
Secure Remote Procedure Call (S-RPC)

This is an authentication service and is simply a 

means to prevent unauthorized execution of code on remote systems.
Secure Sockets Layer (SSL)

This is an encryption protocol developed by Netscape to 

protect the communications between a web server and a web browser. SSL can be used 
to secure web, email, File Transfer Protocol (FTP) or even Telnet traffic. It is a session-
oriented protocol that provides confidentiality and integrity. SSL is deployed using a 40-bit 
key or a 128-bit key. SSL is superseded by Transport Layer Security (TLS).