Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Pre-shared Key Off-line Bruteforcing Using IKE Aggressive Mode

I have scanned our Cisco Concentrator and received this threat, do you know how to reduce this threat, how long should a pre-shared key be?

THREAT:

IKE is used during Phase 1 and Phase 2 of establishing an IPSec connection. Phase 1 is where the two ISAKMP peers establish a secure, authenticated channel with which to communicate. Every participant in IKE must possess a key which may be either pre-shared (PSK) or a public key. There are inherent risks to configurations that use pre-shared keys which are exaggerated when Aggressive Mode is used.

IMPACT:

Using Aggressive Mode with pre-shared keys is the least secure option. In this particular scenario, it is possible for an attacker to gather all necessary information in order to mount an off-line dictionary (brute force) attack on the pre-shared keys. For more information about this type of attack, visit http://www.ima.umn.edu/~pliam/xauth/.

SOLUTION:

IKE Aggressive mode with pre-shared keys should be avoided where possible. Otherwise a strong pre-shared key should be chosen.

Note that this attack method has been known and discussed within the IETF IPSec Working Group. The risk was considered as acceptable. For more information on this, visit http://www.vpnc.org/ietf-ipsec/99.ipsec/thrd2.html#01451.

1 REPLY
New Member

Re: Pre-shared Key Off-line Bruteforcing Using IKE Aggressive Mo

You can go for Digital certificate option instead of pre-shared key if you feel the pre-shared key is less secured.

Configuring the Cisco VPN 3000 Concentrator 4.7.x to Get a Digital Certificate and a SSL Certificate

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_tech_note09186a00800946f1.shtml

409
Views
0
Helpful
1
Replies
CreatePlease to create content