Terms and Acronyms

• Triple Data Encryption Standard (3DES)—An enhanced DES algorithm that provides 168-bit encryption by processing data three times with three different keys.
• Adaptive Services PIC—A next-generation Physical Interface Card (PIC) that provides IPSec services and other services, such as Network Address Translation (NAT) and stateful firewall, on M-series and T-series platforms.
• Advanced Encryption Standard (AES)—A next-generation encryption method that is based on the Rijndael algorithm and uses a 128-bit block, three different key sizes (128, 192, and 256 bits), and multiple rounds of processing to encrypt data.
• authentication header (AH)—A component of the IPSec protocol used to verify that the contents of a packet have not changed (data integrity), and to validate the identity of the sender (data source authentication). For more information about AH, see RFC 2402.
• certificate authority (CA)—A trusted third-party organization that generates, enrolls, validates, and revokes digital certificates. The CA guarantees the identity of a user and issues public and private keys for message encryption and decryption.
• certificate revocation list (CRL)—A list of digital certificates that have been invalidated before their expiration date, including the reasons for their revocation and the names of the entities that have issued them. A CRL prevents usage of digital certificates and signatures that have been compromised.
• cipher block chaining (CBC)—A cryptographic method that encrypts blocks of ciphertext by using the encryption result of one block to encrypt the next block. Upon decryption, the validity of each block of ciphertext depends on the validity of all the preceding ciphertext blocks. For more information on how to use CBC with DES and ESP to provide confidentiality, see RFC 2405.
• Data Encryption Standard (DES)—An encryption algorithm that encrypts and decrypts packet data by processing the data with a single shared key. DES operates in increments of 64-bit blocks and provides 56-bit encryption.
• digital certificate—Electronic file that uses private and public key technology to verify the identity of a certificate creator and distribute keys to peers.
• ES PIC—A PIC that provides first-generation encryption services and software support for IPSec on M-series and T-series platforms.
• Encapsulating Security Payload (ESP)—A component of the IPSec protocol used to encrypt data in an IPv4 or IPv6 packet, provide data integrity, and ensure data source authentication. For more information about ESP, see RFC 2406.
• Hashed Message Authentication Code (HMAC)—A mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, such as MD5 or SHA-1, in combination with a secret shared key. For more information on HMAC, see RFC 2104.
• Internet Key Exchange (IKE)—Establishes shared security parameters for any hosts or routers using IPSec. IKE establishes the SAs for IPSec. For more information about IKE, see RFC 2407.
• Message Digest 5 (MD5)—An authentication algorithm that takes a data message of arbitrary length and produces a 128-bit message digest. For more information, see RFC 1321.
• Perfect Forward Secrecy (PFS)—Provides additional security by means of a Diffie-Hellman shared secret value. With PFS, if one key is compromised, previous and subsequent keys are secure because they are not derived from previous keys.
• public key infrastructure (PKI)—A trust hierarchy that enables users of a public network to securely and privately exchange data through the use of public and private cryptographic key pairs that are obtained and shared with peers through a trusted authority.
• registration authority (RA)—A trusted third-party organization that acts on behalf of a CA to guarantee the identity of a user.
• Routing Engine—A PCI-based architectural portion of a JUNOS-based routing platform that handles the routing protocol process, the interface process, some of the chassis components, system management, and user access.
• security association (SA)—Specifications that must be agreed upon between two network devices before IKE or IPSec are allowed to function. SAs primarily specify protocol, authentication, and encryption options.
• Security Association Database (SADB)—A database where all SAs are stored, monitored, and processed by IPSec.
• Secure Hash Algorithm 1 (SHA-1)—An authentication algorithm that takes a data message of less than 264 bits in length and produces a 160-bit message digest. For more information on SHA-1, see RFC 3174.
• Secure Hash Algorithm 2 (SHA-2)—A successor to the SHA-1 authentication algorithm that includes a group of SHA-1 variants (SHA-224, SHA-256, SHA-384, and SHA-512). SHA-2 algorithms use larger hash sizes and are designed to work with enhanced encryption algorithms such as AES.
• Security Policy Database (SPD)—A database that works with the SADB to ensure maximum packet security. For inbound packets, IPSec checks the SPD to verify if the incoming packet matches the security configured for a particular policy. For outbound packets, IPSec checks the SPD to see if the packet needs to be secured.
• Security Parameter Index (SPI)—An identifier that is used to uniquely identify an SA at a network host or routing platform.
• Simple Certificate Enrollment Protocol (SCEP)—A protocol that supports CA and registration authority (RA) public key distribution, certificate enrollment, certificate revocation, certificate queries, and certificate revocation list (CRL) queries.

Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.