How vulnerable is IPSec HMAC-SHA1

Question

There are a few references out there that say HMAC-SHA2 must be used over HMAC-SHA1.

If I am using an IPsec link with HMAC-SHA1, how vulnerable is it to being intercepted and cracked?

Answer 1

For preventing interception and reading of the secret content, encryption algorithms like AES are used. HMACs do not matter at all for this part.

Assuming AES (CBC etc.) is secure, an attacker could still intercept what you're sending or receiving, but he can't read it. What he could do, however, is to change the data to something else. Again assuming AES is secure, there is no way for the attacker to give you some data that, when decrypted, is something meaningful, but it's still a problem, because automatically detecting that you got garbage is not always possible.

That's the purpose of HMAC (with either hash algorithm) in IpSec: It makes it possible to check if the content has been altered during transmission.

While raw SHA1 is not as secure as it was thought to be, the known problems don't apply to HMACs with SHA1. Essentially, the risk comes down to the possibility of an attacker guessing the right key or hash for a message, to make you believe a wrong message with garbage content is the real one (and nothing more):

For SHA1 in IpSec, it's either 2^160 possible values that the key can have (if the attacker has the key, he can generate HMACs for all received messages, ie. give you as much garbage as he wants), or 2^96 possible values for the hash itself (if the attacker manages to get that, just one block can be changed). While it could be better, it's not that bad, especially because it's very unlikely to find the right value before the transmission ends.
For SHA256, the corresponding values are 2^256 and 2^128.

(Also see RFCs 6071, 2404, 4868)