nerdexam
Check_Point

156-215.80 · Question #199

Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and…

The correct answer is C. Only 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key. Using a weaker encryption key in IKE Phase 1 than in Phase 2 undermines security because Phase 1 protects the Phase 2 negotiation, creating a weak link.

VPN Solutions

Question

Your manager requires you to setup a VPN to a new business partner site. The administrator from the partner site gives you his VPN settings and you notice that he setup AES 128 for IKE phase 1 and AES 256 for IKE phase 2. Why is this a problematic setup?

Options

  • AThe two algorithms do not have the same key length and so don't work together. You will get the
  • BAll is fine as the longest key length has been chosen for encrypting the data and a shorter key
  • COnly 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer key
  • DAll is fine and can be used as is.

How the community answered

(30 responses)
  • A
    20% (6)
  • B
    13% (4)
  • C
    60% (18)
  • D
    7% (2)

Why each option

Using a weaker encryption key in IKE Phase 1 than in Phase 2 undermines security because Phase 1 protects the Phase 2 negotiation, creating a weak link.

AThe two algorithms do not have the same key length and so don't work together. You will get the

AES 128 and AES 256 are fully compatible algorithms and can be used together in IKE negotiations without causing a failure - they differ only in key length, not in algorithmic compatibility.

BAll is fine as the longest key length has been chosen for encrypting the data and a shorter key

Choosing the longer key for Phase 2 data encryption does not compensate for the weaker Phase 1 protection, because Phase 1 keys protect the very negotiation that establishes Phase 2 keys.

COnly 128 bit keys are used for phase 1 keys which are protecting phase 2, so the longer keyCorrect

IKE Phase 1 establishes the ISAKMP SA whose keys are used to encrypt and protect the Phase 2 negotiation. If Phase 1 uses only AES 128-bit keys, an attacker who breaks Phase 1 gains access to the Phase 2 key exchange material, making the stronger AES 256-bit Phase 2 encryption irrelevant. The overall security of the VPN is limited by the weakest phase - in this case Phase 1.

DAll is fine and can be used as is.

This configuration is not fine because the asymmetric key strength creates a security vulnerability where the stronger Phase 2 encryption is only as secure as the weaker Phase 1 keys protecting its negotiation.

Concept tested: IKE Phase 1 vs Phase 2 encryption key strength dependency

Source: https://sc1.checkpoint.com/documents/R77/CP_R77_VPN_AdminGuide/Content/Topics/IKE_Negotiations.htm

Topics

#IKE Phase 1#IKE Phase 2#AES key length#VPN encryption strength

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 156-215.80 Practice