IKE (Internet Key Exchange) is the protocol used to set up a security association in IPsec.

learn more… | top users | synonyms

1
vote
0answers
23 views

how IKE (Internet Key Exchange) protocol reacts to the replay attack?

I mean how IKE in any mode (quick,aggressive, main) responds to an attacker that tries to replay one or more messages?
2
votes
1answer
42 views

open source IKE for Windows 7/8 [closed]

Is there an open source implementation of Internet Key Exchange protocol for windows? I found only openiked for linux platforms. (http://www.openiked.org/)
0
votes
0answers
103 views

Real-world risk of a Cisco ASA 5505 running IKEv1 aggressive mode with PSK

We have a vendor configured Cisco ASA 5505 running on our network to provide VPN connectivity into their networks. The ASA 5505 was purchased by us but configured by the vendor and we have no ...
3
votes
1answer
100 views

IKEv2 Authentication - why/how does it work?

I am currently trying to understand the IKEv2 protocol which is used for IPsec and am wondering why/how the authentication process works. From my understanding, in the prior IKE_SA_INIT exchange, the ...
2
votes
0answers
35 views

IKE Main Mode - cookie vs. Nonce

Does replacing the values of the nonces in messages 3 and 4 with the cookie values in the headers of these messages, give an attacker any advantage? The nonce should be randomly chosen while the ...
1
vote
1answer
374 views

What are the practical risks of using IKE Aggressive mode with a pre-shared key?

Our scanning vendor is marking us down because we are using IKEv1 in Aggressive Mode with a pre-shared key. We are using Sonicwall's Global VPN Client to connect to the VPN device in question. I ...
2
votes
1answer
96 views

How does IPsec turn KEYMAT into Encryption and Authentication Keys?

IPsec is a framework protocol that consists of the sub-protocols ESP and AH. IPsec, inately, doesn't include a Key Exchange mechanism, and is therefore dependent on manually setting Keys (archaic), ...
1
vote
2answers
159 views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
4
votes
1answer
1k views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
0
votes
1answer
144 views

In IKE protocol; what is the PRF? [duplicate]

In IKE protocol; what is the PRF ? What is "the generation of a key based on modeled random oracle hash functions"?
2
votes
1answer
323 views

PRF, IKE and hash function

The term PRF is mentioned in the documentation of the IKE (Internet Key Exchange) protocol. What is a PRF? What is the difference between a PRF and a hash function? What PRFs are used in the IKE ...
2
votes
1answer
115 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
1
vote
1answer
3k views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
2
votes
1answer
296 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
7
votes
5answers
7k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
3
votes
1answer
342 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
2
votes
4answers
2k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...