0

This guy argues it is not: https://www.youtube.com/watch?v=DuowFgNKAIg

I really confused about this. According to him, the only purpose of main mode is to make the peers anonymous, but in order to use main mode you need to manually configure the receiver's IP to setup the connection and that IP is view-able to attackers so you don't get any benefit from it.

Am I understanding this right? He seems to be saying the only reason people use main mode is because the RFC is telling them to.

Edit: OK so I'm still a little unclear on this but after reading this blog post it seems main mode does more then just protect the identities of the peers.

It also encrypts the hashed shared key right?

So with aggressive mode I can get the hashed key and ( depending on key length,my compute power, etc) potentially brute force the hash. But with main mode that hash is encrypted so I would have to crack the encryption (a far more challenging feat then brute forcing the hash of a weak password) and then also have to brute force the hash too? I guess if I have already cracked the encryption I know the shared key anyway so I don't even need the hash?

1

It also encrypts the hashed shared key right?

Correct. When using aggressive mode combined with pre-shared key (PSK) authentication the hashes in the second and third messages are sent in the clear. Which means a passive attacker can try to determine the PSK via brute force or dictionary attacks.

With the PSK an active attacker can impersonate the server and collect XAuth secrets (transmitted in the clear), which, unfortunately, was (or still is) often used in combination with aggressive mode and PSK authentication (even in large scale deployments where the PSK could be considered public).

I guess if I have already cracked the encryption I know the shared key anyway so I don't even need the hash?

That's true for IKEv1, as the PSK is used to derive SKEYID (from which the remaining key material is derived). But not for IKEv2 where an active attacker can get the AUTH payload of the initiator and attack it. Afterwards it could again impersonate the server and collect e.g. EAP-MD5/MSCHAPv2 hashes to brute-force user credentials.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.