Guidance on the PRIME profile for IPsec (https://www.ncsc.gov.uk/guidance/using-ipsec-protect-data) does not explicitly mention the use of PFS.

Is there a recommendation for its use in the Prime profile I'm missing?


The article provides basic principles for VPN and network design, and then gives fixed sets of encryption options without further explaining what their features are. Both PRIME (IKEv2) and foundation (IKEv1) profiles seem to use Diffie-Hellman Groups for deriving key material, providing perfect forward secrecy PFS. Explaining this or the other choices made is probably just beyond the scope of the guide.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.