156-215.80 · Question #250
Which of the following actions do NOT take place in IKE Phase 1?
The correct answer is B. Diffie-Hellman key is combined with the key material to produce the symmetrical IPsec key.. IKE Phase 1 negotiates the ISAKMP SA and performs the Diffie-Hellman exchange; the derivation of the actual symmetrical IPsec session key from that keying material happens in Phase 2.
Question
Which of the following actions do NOT take place in IKE Phase 1?
Options
- APeers agree on encryption method.
- BDiffie-Hellman key is combined with the key material to produce the symmetrical IPsec key.
- CPeers agree on integrity method.
- DEach side generates a session key from its private key and peer's public key.
How the community answered
(23 responses)- A4% (1)
- B78% (18)
- C4% (1)
- D13% (3)
Why each option
IKE Phase 1 negotiates the ISAKMP SA and performs the Diffie-Hellman exchange; the derivation of the actual symmetrical IPsec session key from that keying material happens in Phase 2.
Negotiating the encryption algorithm (e.g., AES, 3DES) is a standard Phase 1 ISAKMP SA proposal step performed before the DH exchange.
Combining the DH shared secret with nonces and other keying material to produce the symmetrical IPsec encryption key is a Phase 2 (Quick Mode) operation, not Phase 1. Phase 1 only creates the secure ISAKMP channel; Phase 2 uses that channel to derive per-SA IPsec keys and negotiate the data-plane security association.
Agreeing on an integrity/hashing algorithm (e.g., SHA-1, MD5) is also part of the Phase 1 ISAKMP SA proposal and negotiation process.
Each peer deriving a shared secret from its own private DH value and the peer's public DH value is the core DH key agreement step that occurs during Phase 1.
Concept tested: IKE Phase 1 vs Phase 2 IPsec key derivation
Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14106-how-ipsecvpn.html
Topics
Community Discussion
No community discussion yet for this question.