IPsec and MITM

[amin_sh77]

Hi All,

because always I was wonndering why the IPsec VPNs is vulnerable to the MITM, and we know thats the Ipsec hosts are authinticated and encrypted from the first steps,I want to ask how this attack will pentrate this resistant and anti proof technology? and in which stage it can compromise?and what keys in IPSec is the most vulnerable?

Thanks all

[pradeepde]

With Digital Certificates, the authentication is very strong and MITM attack possibility will be very less. Because the IPSec peers will not exchange any data before the authentication succeds.

IPSec and IKE has methods to expire and change the keys dynamically. Every key will have a time period over which it will be used and at the expiry, fresh keys are generated. This is to make sure that the data is more secure even if the old key is compromised by any means. Bye the time the old key is compromised, the IKE peers would have changed the keys already. The CPFS feature goes one step ahead and makes sure the new does not have any relation to the old key.