ECC Based IKE Protocol Design for Internet Applications

Abstract

The Internet Key Exchange (IKE) protocol is most widely used as a secure key exchange protocol to exchange key materials and negotiate security associations between two security gateways for any secure communications over Internet. However, the original IKE is too flexible, complex and weak to denial-of-service (DoS) attack; several enhanced IKE version have been proposed to replace the original one. In this paper, an elliptic curve cryptography (ECC) based and certificate less IKE protocol is proposed. It eliminates the use of certificates for authentication, replaces the RSA based Diffie-Hellman (DH) key exchange by Elliptic Curve Diffie-Hellman (ECDH) key exchange, and instead of cookies, hash value of initiator's public key, identity and IP address is used to prevent DoS attack. One advantage of the proposed scheme is that it provides same level of security as RSA with less key size, as well as it generates an ECC based common secret key, used for symmetric encryption, which requires less processing time, less computation cost and less storage space than the time required in the public key encryption-based techniques.