Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password on the user side and the same certificate on the gateway side?

share|improve this question
Is it because IKEv2 with PSK is vulernable to active PSK sniffing attacks? But strong PSKs are resistant to MITM attacks. – Moo Aug 21 '12 at 15:47
No, the PSK is exchanged using a secure key agreement mechanism. – Polynomial Aug 21 '12 at 15:51

1 Answer

up vote 2 down vote accepted

There are a few reasons why EAP is preferred over PSK:

  • PSK requires the use of a (relatively) low-entropy password, which is (relatively) easy to bruteforce.
  • PSK requires the passphrase to be stored on the server, which may result in key theft.
  • EAP allows clients to authenticate using different credentials in each direction, so a server might authenticate itself to the client with a completely type of credential than the client uses to authenticate itself to the server.
  • EAP allows clients to authenticate using their own digital certificate, which is much more secure than a password. The user just has to unlock their certificate (or certificate store) using their password on the local device.
  • IKEv2 supports EAP-only authentication, which theoretically allows any form of add-on authentication mechanism to be used.
share|improve this answer
is the passphrase stored in cleartext on the server or just the hash of it? what do you mean with add-on authentication mechanism? – Moo Aug 21 '12 at 16:07
does a length limit for PSK exist or why does it REQUIRES the use of a realtively low entropy password? – Moo Aug 21 '12 at 16:10
1  
@Moo I'm not exactly sure on the specifics. I would imagine that you could hash the password on the server side, but I'm not exactly sure what hash functions / key derivation functions are supported. There's no length limit that I'm aware of on the PSK, but the point is that the entropy of a password is much lower than that of a certificate. To gain 256 bits of entropy, you need 43 perfectly random upper/lower alphanumeric characters to represent that randomness as a password. Rather difficult to remember! – Polynomial Aug 21 '12 at 17:37
The bolt-on authentication mechanisms are anything you like. It's designed such that you can implement your own authentication tokens, as long as both your client and server applications support it. – Polynomial Aug 21 '12 at 17:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.