IPsec — ESP, IKE & Tunnel Mode

Layer 3 crypto suite: ESP (protocol 50) encrypts+authenticates — AH (51, auth only) is legacy; “see IPsec, think ESP”. Two phases Phase 1 (IKE, UDP 500): negotiate encryption/hash/DH group/auth (PSK or certs) → IKE SA. Diffie-Hellman shares a secret without ever sending it (that’s the mod-p exponentiation trick). Phase 2: negotiate ESP transform-set, lifetimes → […]