Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
i just read following article In IPsec VPN, how is the pre-shared key encrypted?
got knowledge about phase 1
also basic line over PFS: for every new negotiation of Phase 2 SA the 2 gateways must generate new set of phase 1 keys. reference :http://www.internet-computer-security.com/VPN-Guide/PFS.
all three key pairs get generated every time i.e derivative, authentication, encryption key as well for every new phase 2 SA, if yes phase1 key generation happen every time?
The link you provided was broken, so I couldn't validate the context.
But, as I contributed to the other thread, I might be in a good place to help contribute to this =).
At the end of ISAKMP (Phase 1), three keys exist:
- Derivative Key -- this key is not used by ISAKMP, and is instead handed to IPsec so that IPsec can create its own Secret Keys
- Authentication Key -- this key is used by ISAKMP in its HMAC (aka, Hashing algorithm secured with a Secret key)
- Encryption Key -- this key is used by ISAKMP to symmetrically encrypt anything ISAKMP wants to securely to the other peer. So if the chosen Encryption algorithm for Phase1 is AES, AES will use this key to symmetrically encrypt data -- AES will not generate its own keying material.
Part of what goes into creating these three keys is a Diffie Hellman exchange executed in the Phase 1 negotiation.
The Derivative Key is given to IPsec, so that IPsec can use it as a seed value to then further generate its own Encryption and Authentication key.
The math involved to create these new IPsec keys involves two values randomly generated by each peer, and exchanged under the protection of the ISAKMP Authentication and Encryption keys.
The bolded part above is crucial. Because IF (and it's a big if) someone were able to compromise the initial DH exchange in Phase 1, they would be able to create the same three keys as above.
So to recap, without PFS, the Phase 2 encryption keys are made up of:
Derivative Key from ISAKMP + Random Values exchanged every Phase2 negotiation.
(This is somewhat simplified to facilitate communicating the underlying question posed by the OP)
Which means, if someone compromises the Phase 1 DH, they have a copy of the Derivative Key, and they have the keys needed to extract the new random values generated and exchanged by each peer.
Consequentially, they then have all the the information they need to compromise anything secured by the IPsec keys.
The main point being, if they compromise one DH exchange, they can compromise the security of the entire implementation.
.
Perfect Forward Secrecy prevents this by introducing a second DH exchange in the Phase 2 negotiation.
With PFS enabled, the IPsec keys are made up of of these values:
Derivative Key from ISAKMP + Random Values exchanged every Phase2 negotiation + Phase 2 DH Exchange.
(again, this is slightly simplified)
To compromise this implementation, a hacker would have had to brute force the Phase 1 DH exchange to create the Phase 1 keys, which gets them the Derivative Key and the Random Values exchanged in Phase 2, then again brute force the Phase 2 DH exchange. Only then would they be able to put together the IPsec security keys.
But to be clear about one of your questions... the Phase 1 keys are not regenerated every Phase 2. They new keys for each new Phase 2 come from the same Derivative Key, but different random values generated each Phase 2 exchange.
