Best Practices for Implementing Cryptographic VPN

Question

With Marcin Latosiewicz
Welcome to the Cisco Support Community Ask the Expert conversation.  This  is an opportunity to learn and ask questions about implementing cryptographic VPN and how to prepare it for the future with expert Marcin Latosiewicz. 
Marcin will share his best practices for implementing cryptographic VPN as well as advise those customers who are looking to build a new or update their existing setups how to maximize their potential.  Additionally, Marcin will provide insight into which technologies could be applicable for new deployments and exciting new technologies that will be available in the next few months. 
Marcin Latosiewicz is a customer support engineer at the Cisco®  Technical Assistance Center in Belgium, with more than 6 years of  experience with Cisco Security products and technologies including  IPsec, VPN, internetworking appliances, network and system security,  Internet services, and  Cisco networking equipment. Prior to joining Cisco, he operated, administered, and ran UNIX and Microsoft networks for 14 years. Latosiewicz holds bachelors and masters degrees in engineering from Warsaw University of Technology. He also holds CCIE® certification in Security (No. 25784) and CCDP® certification.
Remember to use the rating system to let Marcin know if you've received an adequate response. 
Because of the volume expected during this event, Marcin might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity, VPN, shortly after the event. This event lasts through September 20, 2013. Visit this forum often to view responses to your questions and those of other Cisco Support Community members.

Answer 1

Jouni,
Good question. And answer is complex, there is in depth and there is in depth.
Most people would be satisfied by reading a summary of all the different components - encryption, hashing, signing, PKI, how IPsec and SSL/TLS work. This group also counts most of security CCIEs.
To this extent CCIE Security Study Guide (by Henry Benjamin) was a good read, if a bit outdated today.
Most people who are in depth will look first into specification.
RFC 4301 (IPsec architecture)
RFC 2246 (TLS 1.0)
Are a good start and contain references to other documents worth reading.
This is where the good folks will base their knowledge of off.
The really in depth people will look into the math behind it and will conquer topics like
Elliptic Curve Crypto ( http://en.wikipedia.org/wiki/Elliptic_curve_cryptography ) and difference between CCM, GCM and CCB, to which you have really good materials published by universities.
There are relatively a few who know this.
To start with I can suggest:
- http://www.cl.cam.ac.uk/~rja14/book.html (Ross' Anderson book is free, informative and suprisngly entertaining, this is a definitely a must-read for security/VPN).
- Have a look at books recommended by Richard Bejtlich or Bruce Scheiner - while they might not be VPN specific it's a good security read most of the time.
I'll have a look at the books at home see which one can be interesting to read, and edit this post.
M.