IKEv1 is an implementation of ISAKMP (Internet Security Association Key Management Protocol) using Oakley and Skeme key exchange techniques . It is a framework for authentication and key exchange between two network devices to establish, modify, and remove IPSec security associations. IKEv1 utilises UDP port 500 for communication between peers. IKEv1 requires a minimum of nine messages to be sent for main mode (6 Main Mode + 3 Quick Mode) or six for aggressive mode (3 Aggressive Mode + 3 Quick Mode)
The Oakly section provides perfect forward secrecy (PFS) for keys, identity protection and authentication. The Skeme section provides anonymity, certification and quick key refreshes.
Internet Key Exchange Version 1 has two stages of key negotiation for IKE and IPSec security association establishment: phase 1 and phase 2
Phase 1
Phase 1 negotiation can occur using Main Mode (MM) or Aggressive Mode (AM). The peer that initiates the security association process is known as an initiator, the other peer known as a responder.
Main Mode
Main mode consists of six confidential message exchanges between peers to try establish a security association .
When main mode is used, the peer IP addresses of the two IKE devices are hidden. It is very secure but does a longer duration over Aggressive Mode to establish a session.
Main Mode 1
The first message that is sent by the initiator to a responder. One or more security association proposals are offered. The responder needs to match one of them for the phase to proceed further. The proposals can contain factors such as the hash algorithm, encryption algorithm, authentication method, Diffie-Hellman group, and optionally the lifetime of the IKE Phase 1 tunnel.
Main Mode 2
If the responder matches with the initiators proposals. It will respond with a MM2 starting that the proposal has matched.
Main Mode 3
Main Mode 3 begins the Diffie-Hellman key exchange based on the group that was sent in the proposal in the first message.
Main Mode 4
The responder will sent its own key to the initiator. Encryption keys have been shared and encryption can now be established for the security association
Main Mode 5
The initiator will begin authentication by sending the peer router its IP address.
Main Mode 6
The responder will respond with a similar packet to Main Mode 5. This will establish and authentication the security association.
Aggressive Mode
Aggressive mode consists of only a three message exchange. It does not provide the same level of security as Main Mode negotiation. The peers are not encrypted in aggressive mode so can be captured by a listening third party.
Aggressive Mode 1
The initiator will send the information contained in Main Mode messages 1, 3 and 5. This is the security association proposals, the Diffie-Helman key exchange, and the initiators peer router address.
Aggressive Mode 2
The responder will sent back whether the proposals were accepted, it’s own key from the Diffie-Helman key exchange, along with it’s own peer address.
Aggressive Mode 3
MM5 is sent containing the authentication information required to establish the session.
Phase 2
Phase 2 constructs on top of the existing bidirectional IKE security association to establish one or more IPSec security associations between the two peers.
A single IPSec negotiation will result in two unidirectional IPSec security associations, one from each peer.
Perfect Forwarding Secrecy (PFS) is a additional optional function for Phase 2 that creates greater resistance to attacks and maintains data confidentially. It allows session keys to be independent of any future keys to maintain tunnel privacy.
Quick mode is used to establish IPSec security associations, using a three message exchange:
Quick Mode 1
The initiator sends agreed-upon algorithms for encryption and integrity as part of Phase 1, as well as what traffic is to be encrypted or secured.
Quick Mode 2
The responder sends back a QM2 message if it has a matching agreed-upon algorithm
Quick Mode 3
When a quick mode 3 message is sent, both routers shall have a unidirectional tunnel established to the peer
Leave a Reply