yptographic context of each session in such a way that no mixing of keys or parameters can occur between sessions. This capability is handled by IPsec through security asso- ciations (SAs). COMMON CRYPTOGRAPHIC ALGORITHMS Many encryption algorithms of variable capabilities and commercial success are available. The sym- metric encryption world has been SO far dominated by the use of DES during the last 25 years and the use of the Triple DES derivative in the last 5 years or SO. Other widely used algorithms are RC4, IDEA, etc. Details about the internal workings of these algorithms can be found in any good fundamental cryptography textbook. Triple DES is a composite algorithm, which is usually based on a two-key approach and extremely rarely on a three-key approach. Because of mathematical and efficiency reasons, a discussion of the cryptographic efficiency merits between the two approaches goes beyond this short overview. See references at the end of the chapter for more information. In the two-key approach of Triple DES, the plaintext P is encrypted with a key K1. Then the ciphertext is decrypted with a key K2 and the new result is reencrypted with the first key K1. The length of the bit concatenation of K1 and K2 creates a new effective composite key that is twice as long as single-key DES. This is the base of the increased security afforded by Triple DES. Instead of being 64 bits long, the keys are now 128 bits long, which is much more secure. This method is called encrypt decrypt encrypt (EDE). EDE has other vari- ations such as using three different keys (as explained in Schneier's book). Figure 17.5 illustrates the principle. As our emphasis is on network-processing environments, readers with an interest in chip archi- tectures may want to contemplate the fact that 1 run of DES implies 16 rounds, each of which con- tains several operations bit shifts, logical XORing, table lookups, substitutions, and permutations. A Triple DES environment requires 3X16 = 48 rounds, with different subkeys scheduled for each r