IKE Phase 2 - security risk with SHA1?

[Phil Friend]

Hi all,

Due to a 3rd party limitation for IKE phase 2, my company is being requested by them to use SHA1 for the integrity check on our site to site VPN with the 3rd party.

Can anyone specifically outline the security risk this may result in - if any ?

Kind regards,

Phil.

[Philip D'Ath]

SHA1 is considered cryptographically too weak for new deployments. You should really be using SHA2, such as SHA256, SHA384 or SHA512.