# What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE:

IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more correct) would be the following

• IKEv1 aggressive mode, IKEv1 main mode and IKEv2 are pretty much the same if the attacker knows the PSK and is man-in-the-middle (i.e. he can decipher the entire flow)
• this is always possible if the attacker is man-in-the-middle and can authenticate itself as real to both sides
• IKEv1 aggressive mode sends the identifier of both sides in clear text, but
• the identifier does not carry any real secrets, i.e. the strength of IPsec does not conceptually lie on keeping identifiers secret
• an IKE identifier is like a TCP port number: it helps to select the right service/configuration, it has no influence on integrity of the authentication
• IKEv1 aggressive mode always sends those IDs in clear text, independent of the fact that PSK or pubkey is used for authentication
• IKEv1 aggressive mode, IKEv1 main mode and IKEv2 are equally good if the attacker is man-in-the-middle (but doesn’t know the PSK)
• he can not successfully authenticate → he can’t decipher the flow
• but he can see the identifiers
• and he does see “the hash”, in which the only unknown component is the PSK
• he can do an offline (dictionary) attack on the PSK now
• only IKEv1 aggressive mode reveals “the hash” to passive attackers (i.e. eavesdroppers)
• → possible offline (dictionary) attacks
• I didn’t consider an attacker talking to the IPsec gateway without being able to sniff legit VPN-clients. Aggressive mode reveals “the hash” in that case as well. – But still: a man-in-the-middle gets the hash in any case (IKEv2 and IKEv1 all modes)! Right?! – Robert Siemer Oct 28 '15 at 15:26
• related heise.de article (German) – Robert Siemer Oct 28 '15 at 15:29

## 1 Answer

As far as I understood the problem, the difference between IKEv1 Aggressive and Main Mode is how the hashed PSK is sent.

Of course, the PSK itself is never sent to the other side as both sides need to prove to each other that they know the PSK and if one side was sending it to the other one, of course, the other one will now know it. Instead, each side calculates a hash value out of several session related values and the PSK, and sends this hash to other side which is also able to calculate the same hash using the same session values and its own PSK. If the PSK used on both sides was the same, the hashes will match. The way how initiator and responder calculate that hash is slightly different, of course, so one side cannot simply send back the hash it received from the other side as that would also prove nothing. Yet, all values used to calculate the hash must be values that the other side will know just from the data of the current or previous exchanged packets, except for the PSK that each side must simple know.

Main Mode first performs a DH Key Exchange, resulting in secure key on both sides. After that has happened, all communication between both sides is always encrypted and thus not readable by an attacker who is only able to capture traffic between those two sides. The PSK hash is transferred after the key exchange, that means the calculated hash is already encrypted. Also some of the session values required to calculate that hash are sent in the same packet at the hash itself, so these values are also encrypted. An attacker who can just read interchanged traffic will not be able to see the hash, nor will he be able to get all the session related values required to even calculate it. He first had to break encryption or the DH Key Exchange.

Aggressive Mode on the other hand, sends the hashed PSK together with the DH Key Exchange payloads, as well as all the values required to calculate the hash in the very first responder packet and this packet cannot be encrypted because the key exchange has not yet completed. So an attacker, who can just read interchanged traffic, will get the unencrypted hash and also has access to all values that are required to calculate it, except for the PSK itself, of course. Now all that an attacker has to do is brute forcing the PSK, which can be very easy, if it is a poor PSK that is either very short, very simple or cannot stand up to a dictionary attack.

A man-in-the-middle attack is not required for this attack scenario as you are not trying to break the key exchange, you are trying to guess the PSK and you can do so "offline", as you have all the other values required for calculation and a hash that will tell you when you've found the right one. To perform the same attack on a Main Mode connection, you must perform a man-in-the-middle attack which means it's not enough to just see the traffic, you must be able to capture, manipulate and then forward the traffic to break yourself into the DH Key Exchange in realtime. Only then you will get an unencrypted version of the hash and the other values required to calculate it. While also possible, that's a lot harder than just sniffing some outgoing traffic somewhere.

Of course, it all depends on the strength PSK. If your PSK is 64 totally random alphanumeric characters, well, good look brute forcing that. Winning the same lottery ten times in a row is probably more likely than guessing that PSK and trying all possibilities will need more time than our sun is going to exist. The problem is rather that a lot of people don't even understand what a PSK is and consider 1234 secure enough.

Summary: Aggressive Mode is not really less secure than Main Mode. Both can be broken and both can be broken by the same attack. The difference is only, to get the values required for such an attack, it's enough to be able to sniff some traffic in Aggressive Mode (just sniffing two packets is enough), whereas in case of Main Mode you must perform a man-in-the-middle attack on the DH Key Exchange to even get the required values to make the attack possible. Once you have the value, it's equally hard to guess the PSK.

• I see where this clarifies my statements, but it does not explicitly confirm them... – Robert Siemer Nov 24 '17 at 4:45
• @RobertSiemer See the summary; basically I agree with you that aggressive mode is not insecure in itself, but it is considered less secure as it is easier to attack. Main mode requires an online MitM attack, followed by an offline password search, whereas aggressive mode can always be broken by just performing an offline password search and all that is required for that is a capture of the first two packets (even if you just get them long after this connection has died already you can run such an attack). Easier to attack == less secure. But it all depends on the PSK strength in the end. – Mecki Nov 24 '17 at 10:44