IKE (Internet Key Exchange) is the protocol used to set up a security association in IPsec.

learn more… | top users | synonyms

1
vote
1answer
18 views

What are the practical risks of using IKE Aggressive mode with a pre-shared key?

Our scanning vendor is marking us down because we are using IKEv1 in Aggressive Mode with a pre-shared key. We are using Sonicwall's Global VPN Client to connect to the VPN device in question. I ...
2
votes
1answer
39 views

How does IPsec turn KEYMAT into Encryption and Authentication Keys?

IPsec is a framework protocol that consists of the sub-protocols ESP and AH. IPsec, inately, doesn't include a Key Exchange mechanism, and is therefore dependent on manually setting Keys (archaic), ...
1
vote
2answers
41 views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
3
votes
1answer
85 views

which diffie-hellman group is needed for secure ike/ipsec

We're deploying ipsec on embedded devices and getting catastrophic performance from the diffie hellman 2048 group in ike.. afterwards the shared securet is used for 3des, sha1. ipsec negiation is ...
0
votes
1answer
77 views

In IKE protocol; what is the PRF? [duplicate]

In IKE protocol; what is the PRF ? What is "the generation of a key based on modeled random oracle hash functions"?
2
votes
1answer
154 views

PRF, IKE and hash function

The term PRF is mentioned in the documentation of the IKE (Internet Key Exchange) protocol. What is a PRF? What is the difference between a PRF and a hash function? What PRFs are used in the IKE ...
2
votes
1answer
72 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
1
vote
1answer
837 views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
2
votes
1answer
224 views

PFS incentive during IKE Phase 2

I'm trying to see the actual point in implementing Perfect Forward Secrecy during Internet Key Exchange Phase 2, if it had already been used during Phase 1. Quoting the IKEv2 RFC: RFC 5596 ...
6
votes
5answers
4k views

Does IPSec use IKE or ISAKMP?

Does the IPSec protocol suite use IKE or ISAKMP? RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol ...
3
votes
1answer
233 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
1
vote
4answers
1k views

IPSec VPNs and symmetric keys

When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the ...