| 6.2 |  | IOS Cryptosystem |
| 6.2.4 |  | Diffie-Hellman |

| A critical step in creating a secure VPN involves exchanging the keys. Figure shows how the Diffie-Hellman algorithm provides a way for two parties, Alice and Bob, to establish a shared secret key, even though they are communicating over an insecure channel.

This secret key is used to encrypt data using their favorite secret key encryption algorithm. Two numbers, ‘p’, a prime, and ‘g’, a number less than ‘p’ but with some restrictions, are shared.

Alice and Bob each create a large random number that is kept secret, ‘XA’ and ‘XB’, as shown in Figure . The Diffie-Hellman algorithm is now performed, whereby both Alice and Bob carry out some computations and exchange results.

The final exchange results in a common value ‘K’. Any party that knows ‘p’ or ‘g’ cannot guess or easily calculate the shared secret value, largely because of the difficulty in factoring large prime numbers.

It is important to note that Diffie-Hellman provides for confidentiality but does not provide for authentication. A means for knowing with whom the key is established has not yet been created, so the exchange can be subject to a man-in-the-middle attack. Authentication is achieved via the use of digital signatures in the Diffie-Hellman message exchange.