IKE and Hardware Acceleration

IKE algorithms are computationally expensive, particularly in the Phase 1 exchange. Systems that handle a large number of exchanges can use a Sun Crypto Accelerator 1000 board to handle the public key operations. The Sun Crypto Accelerator 4000 board can also be used to handle expensive Phase 1 computations.

For information on how to configure IKE to offload its computations to the accelerator board, see How to Configure IKE to Find the Sun Crypto Accelerator 1000 Board. For information on how to store keys, see How to Configure IKE to Find the Sun Crypto Accelerator 4000 Board, and the cryptoadm(1M) man page.

IKE and Hardware Storage

Public key certificates, private keys, and public keys can be stored on a Sun Crypto Accelerator 4000 board. For RSA encryption, the board supports keys up to 2048 bits. For DSA encryption, the board supports keys up to 1024 bits.

For information on how to configure IKE to access the board, see How to Configure IKE to Find the Sun Crypto Accelerator 1000 Board. For information on how to add certificates and public keys to the board, see How to Generate and Store Public Key Certificates on Hardware.

IKE Utilities and Files

The following table summarizes the configuration files for IKE policy, the storage locations for IKE keys, and the various commands that implement IKE.

Table 22-2 IKE Configuration Files, Key Storage Locations, and Commands

File, Command, or Location	Description	For More Information
/usr/lib/inet/in.iked daemon	Internet Key Exchange (IKE) daemon. Activates automated key management.	in.iked(1M)
/usr/sbin/ikeadm command	IKE administration command for viewing and modifying the IKE policy.	ikeadm(1M)
/usr/sbin/ikecert command	Certificate database management command for manipulating local databases that hold public key certificates. The databases can also be stored on an attached Sun Crypto Accelerator 4000 board.	ikecert(1M)
ike/config file	Configuration file for the IKE policy in the /etc/inet directory. Contains the site's rules for matching inbound IKE requests and preparing outbound IKE requests. If this file exists, the in.iked daemon starts automatically at boot time.	ike.config(4)
ike.preshared file	Preshared keys file in the /etc/inet/secret directory. Contains secret keying material for authentication in the Phase 1 exchange. Used when configuring IKE with preshared keys.	ike.preshared(4)
ike.privatekeys directory	Private keys directory in the /etc/inet/secret directory. Contains the private keys that are part of a public-private key pair.	ikecert(1M)
publickeys directory	Directory in the /etc/inet/ike directory that holds public keys and certificate files. Contains the public key part of a public-private key pair.	ikecert(1M)
crls directory	Directory in the /etc/inet/ike directory that holds revocation lists for public keys and certificate files.	ikecert(1M)
Sun Crypto Accelerator 1000 board	Hardware that accelerates public key operations by offloading the operations from the operating system.	ikecert(1M)
Sun Crypto Accelerator 4000 board	Hardware that accelerates public key operations by offloading the operations from the operating system. The board also stores public keys, private keys, and public key certificates.	ikecert(1M)

Changes to IKE for the Solaris 10 Release

Since the Solaris 9 release, IKE includes the following functionality:

• IKE can be used to automate key exchange for IPsec over IPv6 networks. For more information, see Key Management With IKE.

  ---

  Note - IKE cannot be used to manage keys for IPsec in a non-global zone.

  ---

• Public key operations in IKE can be accelerated by a Sun Crypto Accelerator 1000 board or a Sun Crypto Accelerator 4000 board. The operations are offloaded to the board. The offloading accelerates encryption, thereby reducing demands on operating system resources. For more information, see IKE and Hardware Acceleration. For procedures, see Configuring IKE to Find Attached Hardware (Task Map).

• Public key certificates, private keys, and public keys can be stored on a Sun Crypto Accelerator 4000 board. For more information on key storage, see IKE and Hardware Storage.

• IKE can be used to automate key exchange for IPsec from behind a NAT box. The traffic must use an IPv4 network. Also, the NAT-traversing IPsec ESP keys cannot be accelerated by hardware. For more information, see IPsec and NAT Traversal. For procedures, see Configuring IKE for Mobile Systems (Task Map).

• Retransmission parameters and packet time out parameters have been added to the /etc/inet/ike/config file. These parameters tune the IKE Phase 1 (Main Mode) negotiation to handle network interference, heavy network traffic, and interoperation with platforms that have different implementations of the IKE protocol. For details about the parameters, see the ike.config(4) man page. For procedures, see Changing IKE Transmission Parameters (Task Map).