Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand why do we really use those pre-shared keys when creating a IPSec tunnel.

From all the reading that I have done the DH group creates the keys that are used to do the actual data encryption, hope I am correct. If yes, the pre-shared keys are used only for the authentication?

share|improve this question

The role of preshared key (or certificate) is to authenticate the other peer. Even if connection is encrypted, you need to know that the peer you are establishing connection with is the one it should be. Encryption provides confidentiality in the connection and preshared key that only you and the other party knows provides the authentication.

share|improve this answer
so this is all a part of the phase 1, correct? So in Phase 1 you use the preshared key to authenticate each other, negotiate the encryption method/authentication method. How is the preshared key actually sent to each other? – Nik Aug 15 '13 at 11:06
Yes this is all phase 1. Preshared keys are not actually sent across the network, but they are used with nonce and DH secret to generate a session key that @Dan talks in his answer. – toottoot Aug 16 '13 at 10:46

The preshared key is used for authentication, as @toottoot points out.

It also has another role. It is used in the DH calculation to generate the session keys. This gives the communicating parties a way to generate fresh session keys without additional key sharing, making it practical to change session keys frequently. By doing so, they can minimize the impact of a single compromised session key. Note that, by design, compromising a session key should not help an attacker compromise the preshared key (and therefore other session keys).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.