IPSec uses IKE v1 primary and horizontal tunnels to establish tunnels, and uses certificates to verify identities. Which of the following messages verifies the validity of the certificate? (Multiple…

Question

Options

• AMessage 5
• BMessage 4
• CMessage 6
• DMessage 3

• A
  72% (38)
• B
  11% (6)
• D
  17% (9)

Explanation

In IKE v1 Main Mode, the six-message exchange is split into three pairs: Messages 1–2 negotiate the security association parameters, Messages 3–4 perform the Diffie-Hellman key exchange and nonce sharing, and Messages 5–6 handle authentication. When certificate-based authentication is used, both the initiator (Message 5) and the responder (Message 6) send their identity, certificate, and a digital signature - making these the two messages where certificate validity is actually verified by the peer.

Why B (Message 4) and D (Message 3) are wrong: Messages 3 and 4 carry the DH public values and nonces to establish the shared secret key material. They have nothing to do with certificates or identity verification - that work hasn't started yet at that stage.

Memory tip: Think of the six Main Mode messages in pairs - "Negotiate, Exchange, Authenticate." Certificates belong to the last pair (5 and 6), since you can only authenticate after you've set up the encrypted channel in messages 3–4. If you remember "5 and 6 = auth," you'll always land on A and C.

No community discussion yet for this question.