I am currently trying to understand the IKEv2 protocol which is used for IPsec and am wondering why/how the authentication process works.

From my understanding, in the prior IKE_SA_INIT exchange, the Initiator and Responder agree on a crypto suite, send each other their DH values and a nonce.

The following IKE_AUTH exchange is supposed to verify the peers identity to each other. The protocol derived a lot of keys from the shared secret SKEYSEED that got calculated using the DH values and nonces.
In the IKE_AUTH exchange a one of the keypairs is used to basically just sign a block of data - a copy of the prior IKE_SA_INIT exchange, the peer's nonce and prf(SK, ID).

What I don't understand is the fact that since the DH values and nonces are sent unauthenticated and unencrypted in the IKE_SA_INIT exchange, couldn't an attacker just spoof the identity of the opposing communication partner and perform a MitM attack?

At what point in the protocol would such a MitM attack, that e.g. replaces the DH values, be recognized by the other side?

Thank you very much in advance!


The point of DH is that only the two parties can generate a shared secret (gxy) for the DH exchange. SKEYSEED is not the shared secret for the DH exchange. In fact its derived from the DH shared secret and the nonces; not from the transmitted DH parameters. SKEYSEED is never transmitted over the wire.

Once the DH exchange is complete, and encryption/integrity keys are generated, the AUTH messages are used to prove the identity of each side.

RFC 5996: Section 1.2

The initiator asserts its identity with the IDi payload, proves knowledge of the secret corresponding to IDi and integrity protects the contents of the first message using the AUTH payload (see Section 2.15). It might also send its certificate(s) in CERT payload(s) and a list of its trust anchors in CERTREQ payload(s). If any CERT payloads are included, the first certificate provided MUST contain the public key used to verify the AUTH field.

For a MitM attack to work you would need to know the DH shared secret. You can't simply replace the DH parameters. The values exchanged are gx mod p and gy mod p. You need to know x or y. These are not easily calculated because you need to perform a discrete log on a (what should be) very large number.

You can try and impersonate one side of the negotiation, but that's not really a MitM. And IKEv2 is not what would protect against this type of attack. That would be the job of firewall rules and what not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.