1

It seems I fail to understand few things about DH's functionality in the context of IKEv1. A little bit of context first:

During IKE Main Phase, with the 3rd and 4th messages, the peers each exchange Nonces and key exchange data. I understand that each peer takes both nonces and combines them with the PSK to obtain the SKEYID, thus both obtaining the same SKEYID.

First question: What exactly is this "key exchange data" and what is it used for?

Second question: What is the process if there is no PSK configured? What if I use X.509 certificates? What do the peers use instead of the PSK?

Then I understand that the peers each derive 3 more keys used for different purposes, from the SKEYID.

Third question: How are the 3 keys derived from the SKEYID? What is the SKEYID combined with or what is the process?

Improve this question
5
  • @CosminIonutGrosu Have you checked the RFCs, starting with 2409?
    – Zac67 ♦
    Nov 26, 2021 at 20:47
  • 1
    This similar (but more broad) question has a very detailed answer that addresses most of your questions: networkengineering.stackexchange.com/questions/55402/…
    – Jeff Wheeler
    Nov 26, 2021 at 22:23
  • @Zac67 I did check a lot of sources, but no RFCs. As all my knowledge about IPSec is surface level, the RFCs were confusing, mostly because there is very in-depth information. My question mostly came as a result to many articles describing IKE with PSK configured, and then talking about public keys, or not describing IKE with X.509 at all which made it all the more confusing. As a last resort though, I will go through them
    – Cosmin Ionut Grosu
    Nov 28, 2021 at 9:37
  • @Jeff Wheeler thank you, I'll make sure to check it out
    – Cosmin Ionut Grosu
    Nov 28, 2021 at 9:43
  • @CosminIonutGrosu Public-key authentication is in RFC 2409 clause 5.2ff. RFCs can be confusing as they're very technical but they're also exhaustive.
    – Zac67 ♦
    Nov 28, 2021 at 10:04

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.