Virtual vpn in the cloud

 
Advantage: 
Pre shared keying provides peer-to-peer authentication thus overcoming the 
disadvantages of other keying mechanisms. PSK also enhances the benefits of using Internet 
Key Exchange protocol. 
 
Disadvantage:
If many users know the PSK, impersonating the gateway is easy and thus not 
recommendable for large-scale deployments. And also pre-shared keys are stored as plain 
text in system directories.
3.2.2
 
Digital Certificates 
Definition:
A digital certificate [27] is an electronic document that provides authentication 
to the public key and validation to the owner’s identity. This method forms the basis of 
authentication for IPSec-VPNs. It is attained from a Certificate Authority, a trusted third 
party organization. 
Working:
RSA signatures are used by Certificate Authorities, CAs, which are trusted third-
party organizations. An IPSec peer registers itself to the CA to attain a digital certificate. 
After the CA verifies the peer’s credentials, a certificate is issued. A digital certificate 
consists of the following information: 
•
The name of the public key holder. 
•
The name of a party certifying the key indeed belongs to the declared holder. 
•
The public key itself. 

---

12 
•
A digital checksum of the certificate itself encrypted with the private key of the 
party issuing the certificate. 
The agency creating a digital certificate guarantees that the public key belongs to the 
party that requests the certificate. The requesting party is the 
subject
, and the party issuing 
the certificate is the 
issuer
. The issuing agency creating the certificate collects the 
information from the subject, confirming the true identity of the requestor. Then the 
requesting party’s name, requesting party’s public key and the issuer’s own name is 
combined into a data structure and a digital checksum of the data structure is calculated. The 
certifying organization encrypts the result of this checksum using its own private key and 
appends the encrypted checksum to the certificate’s data structure. After completing this 
process anyone is allowed to examine the digital certificate and verify that a certain public 
key does in fact belong to a specific entity. This authentication method requires complete 
trust over the certificate-certifying agency.