VPN3k: HYBRID security properties in Cisco implementation

[ovt]

Hi!

Does anybody know what security properties does the HYBRID authentication method have in Cisco implementation? Specifically, how do they transfer HASH of the pre-shared key in the Notify Payload from the VPN Client to the concentrator? Is it protected by concentrator Public key? Or is this still vulnerable to the sniffing attacks?

Thx,

Oleg Tipisov,

REDCENTER

[mchin345]

For the Cisco VPN 3000 Concentrator, Cisco VPN Client (software client) and Cisco VPN 3002 Hardware Client, Cisco has implemented a feature Hybrid Authentication Mode for IKE.

Cisco's solution extends the Hybrid Auth model by additionally requiring a group pre-shared key for VPN group identification. The group pre-shared key is used solely to associate users with their appropriate VPN groups, followed by the XAUTH exchange that then authenticates the user.