Questions tagged [ipsec]

For questions about the cryptographic protocols which form the basis of IPsec, which is one of the common security schemes used on the throughout. For general questions about IPsec, consider if your question fits our sister sites Super User and/or Security Stack Exchange better.

Filter by
Sorted by
Tagged with
0 votes
1 answer
76 views

IKEv2 with EAP and use of anonymous identity

IKEv2 RFC7296 Section 2.16, provides overview of how IKEv2 is used with EAP. That section states the following when a different identity (IDi) is used in message 2 IKE_AUTH from initiator to responder,...
Irfan's user avatar
  • 23
0 votes
1 answer
158 views

How is the shared secret generated in IPsec using DH key generation?

I have doubt like when in the IPsec we use a DH group for key exchange. It takes a prime number and $g$ value from group bit. How does the key exchange payload and nonce help to generate the shared ...
Ruchi's user avatar
  • 1
0 votes
1 answer
118 views

What is the Diffie Hellman session key used for in IPsec protocol?

Let's say we choose AES as cryptographic algorithm for IPsec. My question is the following Is the key produced by Diffie-Hellman algorithm used as INPUT to the AES algorithm so AES does the ...
Historical Swimming's user avatar
1 vote
1 answer
227 views

some questions about IPSEC ESN

ESN feature is described in RFC 4303. Here is some questions which bothered me: When use ESN combined with AES_GCM or AES_GMAC alogrithom, do I need to add the high-order ESN bits to the packets? ...
cissie's user avatar
  • 11
1 vote
2 answers
214 views

Encrypting with nonces in IKE

In IKE exchanges, first messages sent unencrypted and unauthenticated. For authentication, messages sent encrypted with nonces. If a man in the middle is eavesdropping this conversation, he/she will ...
hadz's user avatar
  • 27
0 votes
1 answer
412 views

Usage of cookies in IKE

While creating secret keys in IKE protocol, sides use cookies but I did not understand where they come from, how they are generated and why they are used. Can someone explain? Thanks.
hadz's user avatar
  • 27
1 vote
2 answers
76 views

IKEv1 Phase 1, authentication with signature, sending certificates "optionally"

At RFC2409, section 5.1, authentication header is like: HDR*, IDii, [ CERT, ] SIG_I HDR is an ISAKMP header whose exchange type is the mode. When writen as HDR* it indicates payload encryption. IDii ...
hadz's user avatar
  • 27
1 vote
1 answer
471 views

Under which conditions certificate is required for IKEv2?

In IKEv2 document, there are expressions as [CERT,] or [CERTREQ,] in the parts of IKE_SA_INIT or IKE_AUTH exchanges. In this notation brackets indicates that it is optional. I didn't see expressions ...
NB_1907's user avatar
  • 538
0 votes
1 answer
500 views

ESP header and trailer

I investigated the IPsec Protocol. I am wondering if I can remove/reduce any field to save space, is there a way to save overhead in ESP packages?
YouKnowMe's user avatar
0 votes
1 answer
91 views

Actual need of IKEv1 Aggressive mode

I know that IKEv1 Aggressive mode is not secure as ID payload is sent out in plain text. Even though it is insecure, it still exists! Can someone tell why exactly do we need Aggressive mode? What is ...
Techievent.in's user avatar
1 vote
2 answers
789 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
Dror123's user avatar
  • 21
0 votes
1 answer
325 views

Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...
aquohn's user avatar
  • 103
0 votes
0 answers
217 views

find prime number of diffie-hellman algorithm

at IPsec, Diffie-hellman is used in framework ISAKMP resulting shared secret. some of Diffie-Hellman group may define the length of the prime number of q and the size of the secret key of K: group 1 (...
Lee Hye Won's user avatar
0 votes
2 answers
349 views

ISAKMP 'master key' PFS (phase I) vs Ipsec session key PFS (Phase II)

A question for the crypto-experts to help out a somewhat confused guy: why does PFS (perfect forward secrecy) also exist in phase II as well as in phase I? Rationale: In phase I ISAKMP, the result ...
Jeroen's user avatar
  • 1
0 votes
0 answers
36 views

How to protect traffic metadata from a malicious cloud provider?

What can be a theoretical and efficient way of protecting traffic metadata (packet size, timestamps, packet count) of enterprise when traffic is redirected to the SGX enclave residing in a cloud ...
ENIO MARKU's user avatar
3 votes
1 answer
1k views

Why can't AES-GCM be used in IKEv1 phase 1?

I was configuring a VPN on a firewall (fortigate) and realized that I could use AES-GCM for encryption in the IKEv1 phase 2 but not in the phase 1 and I was wondering why knowing that in IKEv2 we ...
user1990088's user avatar
0 votes
1 answer
548 views

If we know the pre-shared key of an IPSec tunnel, can PFS help us to stay encrypted?

Or if the "attacker" has the pre-shared key, then PFS won't help? Ex.: Heard something about China that it blocks IPSec and only allows it when you give them your pre-shared key, thus they can see ...
niving6473's user avatar
2 votes
1 answer
513 views

ipsec, esp: Which key is used to generate the HMAC

Short Question: Are the keys for the ICV calculation and the encryption the same in IPSEC/ESP? Or do there exist two keys in the SA? Long Question: Before a new IPSEC-ESP connection is established, ...
byteunit's user avatar
  • 123
2 votes
1 answer
1k views

IPsec : transmission of Initialization Vector

I am currently carrying scholar research about IPsec protocol, and I have a question regarding the IP Encapsulating Security Payload (ESP). Is the initialization vector of operation mode transmitted ...
Cedric's user avatar
  • 63
1 vote
1 answer
554 views

How does OpenVPN work?

I'm confused with the technologies that OpenVPN uses. The official site mentions it uses SSL/TLS in-place of IKEv1/IKEv2, and uses IPSec ESP to secure the data, and yet that it isn't compatible with ...
chirond's user avatar
  • 105
1 vote
2 answers
467 views

IKEv2 DH Group on SonicWall

I am developing internal standards for IPsec VPN setup on SonicWall firewalls, and I have been learning about IKEv2. When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and ...
Jeff Baird's user avatar
2 votes
2 answers
220 views

Bellovin ESP Attack on UDP Packets

In Bellovin's ESP Attack, it is stated that: If $L_A$, $L_B$ are using UDP, attack is easier: Wait till session ends Allocate $L_B$'s UDP port to $X_B$ Replay all packets So, how ...
aselimkaya's user avatar
0 votes
2 answers
790 views

why IPSec transport mode is restricted for host-to-host communication , or host-to-gateway where gateway acts as a host only?

Transport mode is allowed between two end hosts only; tunnel mode is required when at least one of the endpoints is a "security gateway" (intermediate system that implements IPsec functionality, e.g....
Elena Gurevich's user avatar
2 votes
1 answer
2k views

Why a "Next Header" field is part of ESP trailer?

Please explain are there any reason under the hood to place "Next Header" field in ESP trailer instead of ESP Header ?
Elena Gurevich's user avatar
3 votes
1 answer
9k views

IPSec vs SSL : Similarities and Differences

I am studying SSL and IPSec. I can pretty much nail down the "very high level" differences and similarities between the two, but am struggling to find a "lower level" (but not too deep) look. This ...
AConcernedSloth's user avatar
1 vote
1 answer
873 views

Does IKEv1 support multiple combinations of a source IP range?

I saw in several places online that the different between IKEv1 and IKEv2 is the use of multiple combinations of a source IP range as left and right subnets (locally and remote), a destination IP ...
Omer Anisfeld's user avatar
0 votes
1 answer
4k views

How is the SPI determined/negotiated in phase 2 of IKE (v1)?

While I am aware that the SPI (along with destination IP and protocol) is used to uniquely identify an incoming SA on a peer, for the life of me I am not able to understand how that particular SPI ...
Qurious's user avatar
1 vote
0 answers
251 views

Key exchange during IKE_AUTH phase of IKEv2

This is what a casual IKEv2 handshake looks like : ...
sasuke_X220's user avatar
1 vote
1 answer
342 views

Why TLS uses in-band handshake signalling

TLS uses handshake protocol to compute session keys to be used later to protect bulk of application data transfer. The handshake protocol and application protocol uses same transport layer port. ...
Vakul Garg's user avatar
-1 votes
1 answer
340 views

ESP in tunnel mode [closed]

When Encapsulating Security Payload (ESP) is used in the tunnel mode, a new IP header is computed and added. Why is this necessary? Thank you.
Ng Clement's user avatar
2 votes
1 answer
394 views

where does the prime number taken in DH algorithm in IPSEC

I am studying & configuring IPSEC ikev1 and in between i am analysing the wireshark captures. I am using the linux kernel for TCP/IP stack and user-space i took ipsec-tools. In the first two ...
Kumar2080's user avatar
3 votes
1 answer
765 views

Can authenticated encryption reduce bandwidth overhead of per-packet encryption?

I know that authenticated encryption modes of operation like GCM offer certain security advantages, as well as increased performance. (On my laptop with AES-NI, the benchmark performance of ...
Dan Lenski's user avatar
8 votes
1 answer
674 views

Detection of weak keys for AES-GCM

There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
budderick's user avatar
  • 425
0 votes
1 answer
2k views

IPSec recomendations about rekeying

IPSec like strongSwan can be configured to do rekeying after time or bytes transferred or packets transmitted. Is there any recommendations to set those settings? Maybe according to algorithms used?
Maciej S's user avatar
  • 111
5 votes
1 answer
374 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
Sky Passaro's user avatar
1 vote
0 answers
291 views

AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
Max Rottenkolber's user avatar
4 votes
1 answer
4k views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
Robert Siemer's user avatar
2 votes
0 answers
386 views

What are the well known protocols that offer perfect forward secrecy? [closed]

As far as I know these are the well known protocols that offer PFS TLS/SSL (with DHE-RSA, DHE-DSS, ECDHE-RSA or ECDHE-ECDSA) SSH (RFC4253) OTR (Protocol Version 3 Spec) IPsec (with IKEv1 and IKEv2)...
placeybordeaux's user avatar
1 vote
1 answer
2k views

IPsec authentication and encryption lgorithms

I am looking for the implementation of IPsec security algorithms for both authentication and Encryption. Is there any open source implementation available for the same ? And if someone supposed to ...
ronex dicapriyo's user avatar
4 votes
1 answer
15k views

Does IKEv2 protocol have two modes like IKE

IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.
Gev_sedrakyan's user avatar
2 votes
1 answer
653 views

Bellovin 96' attack on IPsec ESP protocol on encryption only option

Can you explain the actual attack? Why does the attacker need to firstly send some arbitrary UDP packet? How can the attacker break the privacy between A and B? Link: The article of Bellovin I'm ...
Bush's user avatar
  • 2,130
9 votes
1 answer
48k views

What is the "shared secret" used for in IPSec VPN?

Can somebody explain what the "shared secret" and "password" do when opening/creating a VPN tunnel? In this specific case I setup a VPN to my Fritz!Box and I had to provide a shared secret (which was ...
Krumelur's user avatar
  • 1,145