It seems I fail to understand few things about DH's functionality in the context of IKEv1. A little bit of context first:

During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange Nonces and key exchange data. I understand that each peer takes both nonces and combines them with the PSK to obtain the SKEYID, thus both obtaining the same SKEYID.

First question: What exactly is this "key exchange data" and what is it used for?

Second question: What is the process if there is no PSK configured? What if I use X.509 certificates? What do the peers use instead of the PSK?

Then I understand that the peers each derive 3 more keys used for different purposes, from the SKEYID.

Third question: How are the 3 keys derived from the SKEYID? What is the SKEYID combined with or what is the process?

  • @CosminIonutGrosu Have you checked the RFCs, starting with 2409?
    – Zac67
    Nov 26 '21 at 20:47
  • 1
    This similar (but more broad) question has a very detailed answer that addresses most of your questions: networkengineering.stackexchange.com/questions/55402/… Nov 26 '21 at 22:23
  • @Zac67 I did check a lot of sources, but no RFCs. As all my knowledge about IPSec is surface level, the RFCs were confusing, mostly because there is very in-depth information. My question mostly came as a result to many articles describing IKE with PSK configured, and then talking about public keys, or not describing IKE with X.509 at all which made it all the more confusing. As a last resort though, I will go through them Nov 28 '21 at 9:37
  • @Jeff Wheeler thank you, I'll make sure to check it out Nov 28 '21 at 9:43
  • @CosminIonutGrosu Public-key authentication is in RFC 2409 clause 5.2ff. RFCs can be confusing as they're very technical but they're also exhaustive.
    – Zac67
    Nov 28 '21 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.