cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1133
Views
10
Helpful
2
Replies

IPSec IKEv2 with PSK more secure than PKI

fsebera
Enthusiast
Enthusiast

We are moving from IKEv1 to IKEv2 on our hundreds of VPN tunnels. We are being told to use asymmetric PSK because it’s more secure than using PKI and private in-house certificates. I disagree but I’m not the expert in the area. Can anybody clarify how IKEv2 with PSK is more secure than IKEv2 with private certificates.

Thank you

Frank

 

2 REPLIES 2

Sheraz.Salim
VIP Advisor VIP Advisor
VIP Advisor

Ikev2 is the next generation encrytion which is more better than ikev1. however the converencge of Ikev2 is more faster compare of ikev1. where ikev1 in phase one have 6 packets where ikev2 4 packet.

 

now coming to your question is PSK asymmetric is more secure than PKI. no PKI is more secure if you using a public certificate.

 

- Certificates are more secure than PSK in many ways (as long as private keys remain private

 

Certificates
Pros:
  • The key used to generate certificates is stored in a single location, separate from the systems using the certificates
  • All systems may be notified of a certificate's compromise via a certificate revocation list (CRL)
  • A compromised certificate only needs to be replaced on the system to which the certificate belongs
  • The public key embedded in a certificate may be larger than a pre-shared key (1024, 2048, 4096, or more)
Cons:
  • Creating/obtaining a certificate is more complicated, time consuming and potentially expensive than using a pre-shared key

 

Pre-shared keys
Pros:
  • Convenience--no need to go through the complicated process of obtaining a certificate
Cons:
  • If a key is compromised, unauthorized access to the network may be obtained
  • There are more opportunities to get the key because the it is stored on all the IPsec peer systems
  • There is no way to automatically notify the IPsec peers the pre-shared key has been compromised
  • Replacing the pre-shared key requires updating it on all systems, which can be tedious
please do not forget to rate.

Hi Sheraz,

 

I somehow missed your response until now. My bad.

Thank you for responding and providing good detail. I was expecting there would be a technical reason, something concrete that would spell it out. 

 

Anyway, Thanks again for your help

Frank

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: