156-215.80 · Question #407
Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?
The correct answer is B. AES-CBC-256. AES-CBC-256 is not a recognized algorithm designation for IPSec Phase 2 in Check Point; CBC-mode 256-bit AES is listed simply as AES-256, while AES-GCM variants are explicitly named.
Question
Which is NOT an encryption algorithm that can be used in an IPSEC Security Association (Phase 2)?
Options
- AAES-GCM-256
- BAES-CBC-256
- CAES-GCM-128
How the community answered
(41 responses)- A17% (7)
- B73% (30)
- C10% (4)
Why each option
AES-CBC-256 is not a recognized algorithm designation for IPSec Phase 2 in Check Point; CBC-mode 256-bit AES is listed simply as AES-256, while AES-GCM variants are explicitly named.
AES-GCM-256 is a valid and explicitly supported Phase 2 encryption algorithm - it is an AEAD cipher that provides both confidentiality and integrity in a single operation.
The label 'AES-CBC-256' does not appear as a valid Phase 2 encryption proposal in Check Point VPN configuration. CBC-mode 256-bit AES is referred to simply as 'AES-256' in the proposal list, without the '-CBC' suffix. AES-GCM variants are explicitly named because they are AEAD ciphers that combine encryption and authentication, making the mode designation necessary to distinguish them.
AES-GCM-128 is a valid Phase 2 encryption algorithm explicitly listed in Check Point VPN Phase 2 proposals as an AEAD cipher suite.
Concept tested: IPSec Phase 2 valid encryption algorithm naming
Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_VPN_AdminGuide/Topics-VPNG/VPN-IKE-Properties.htm
Topics
Community Discussion
No community discussion yet for this question.