3

I am trying to understand why do we really use those pre-shared keys when creating a IPSec tunnel.

From all the reading that I have done the DH group creates the keys that are used to do the actual data encryption, hope I am correct. If yes, the pre-shared keys are used only for the authentication?

Adi
  • 44,095
  • 16
  • 138
  • 170
Nik
  • 33
  • 1
  • 3

2 Answers2

3

The role of preshared key (or certificate) is to authenticate the other peer. Even if connection is encrypted, you need to know that the peer you are establishing connection with is the one it should be. Encryption provides confidentiality in the connection and preshared key that only you and the other party knows provides the authentication.

toottoot
  • 101
  • 6
  • so this is all a part of the phase 1, correct? So in Phase 1 you use the preshared key to authenticate each other, negotiate the encryption method/authentication method. How is the preshared key actually sent to each other? – Nik Aug 15 '13 at 11:06
  • Yes this is all phase 1. Preshared keys are not actually sent across the network, but they are used with nonce and DH secret to generate a session key that @Dan talks in his answer. – toottoot Aug 16 '13 at 10:46
1

The preshared key is used for authentication, as @toottoot points out.

It also has another role. It is used in the DH calculation to generate the session keys. This gives the communicating parties a way to generate fresh session keys without additional key sharing, making it practical to change session keys frequently. By doing so, they can minimize the impact of a single compromised session key. Note that, by design, compromising a session key should not help an attacker compromise the preshared key (and therefore other session keys).

Dan
  • 156
  • 3