A pre-shared key is used for authenticating the peers and also used in protecting the DH key exchange because it's possible to man in the middle the DH exchange.

Does this mean that if an attacker knows the pre-shared key he can man in the middle the initial IKE phase 1 negotiation so the encryption keys for the ipsec connection are compromised?


Yes, which is why people employ an attack called "Aggressive Mode IKE PSK Cracking".

  • That only applies when using Aggressive mode and IKEv1. Do you know about Main mode and/or IKEv2? – ytdpiu Jan 2 '17 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.