- MetaFrame 1.8 Service Pack 2 and Feature Release 1: Frequently Asked Questions (FAQ), Part 1
- What Functionality Requires an FR1 License?
- Do I Need to Run the Citrix XML Service?
- What Exactly Does the Encryption Service Do?
- What Happens if the Encryption Service Is Stopped?
- Should I Be Utilizing the Strong ICA Encryption Feature of FR1?
What Exactly Does the Encryption Service Do?
In addition to the Citrix XML Service, SP2 also installs the Citrix Encryption Service and configures it to automatically start. You will see visual notification of this during the installation as the initial pair of parameters for the Diffie-Hellman key agreement protocol is generated. The Diffie-Hellman protocol is used to secure the exchange of secret encryption keys between an ICA client and a MetaFrame server when any encryption level higher than Basic is used.
The parameters provided by the Encryption Service are used in conjunction with a private key generated by the MetaFrame server to create a corresponding public key. Periodically the Encryption Service will generate a new pair of parameters that are then used in subsequent secure client connections. These parameters, typically referred to as p and g, have the following properties:
p is a prime number
g is an integer less than p
So, for example, say that p = 13then g could be any integer less than 13. Of course, p is actually going to be a sufficiently large prime that it cannot be easily guessed.
Figure 4 shows the process by which a secret key is exchanged when a secure connection is initiated between an ICA client and a MetaFrame server.
Secure key exchange between a MetaFrame server and an ICA client using strong encryption.
This exchange occurs during the initial connection between the client and the server (prior to the logon screen appearing) and is why an error such as the one in figure 5 may appear if a client is requesting an encryption level that the Citrix server does not support.
The connection error generated when the MetaFrame server does not support the requested strong encryption level.
For a thorough treatment on the Diffie-Hellman agreement protocol and other encryption techniques, I highly recommend the CryptoFAQ available from the RSA Laboratories, at http://www.rsasecurity.com/rsalabs/faq. This FAQ is an excellent source of information on the cryptographic technology that is in use today. For those of you who are interested, there are also links to information on the core mathematical concepts that form the foundation of cryptography.
Citrix also provides a SecureICA whitepaper that describes in detail the process by which the secret key is generated for an encrypted ICA session. It can be found on the Citrix Web site, at http://www.citrix.com/products/sica/sicawp/start.htm.