Download Configuring the - Check Point Software Technologies, Ltd.

Overview
Renegotiating IKE & IPSec Lifetimes
IKE phase I is more processor intensive than IKE phase II, since the Diffie-Hellman
keys have to be produced and the peers authenticated each time. For this reason,
IKE phase I is performed less frequently. However, the IKE SA is only valid for a
certain period, after which the IKE SA must be renegotiated. The IPSec SA is valid
for an even shorter period, meaning many IKE phase II’s take place.
The period between each renegotiation is known as the lifetime. Generally, the
shorter the lifetime, the more secure the IPSec tunnel (at the cost of more
processor intensive IKE negotiations). With longer lifetimes, future VPN
connections can be set up more quickly. By default, IKE phase I occurs once a day;
IKE phase II occurs every hour but the time-out for each phase is configurable.
The IPSec lifetime can also be configured according to Kilo Bytes by using DBedit
to edit the objects_5_0.c file. The relevant properties are under the community
set:
•
ike_p2_use_rekey_kbytes. Change from false (default) to true.
•
ike_p2_rekey_kbytes. Modify to include the required rekeying value (default
50000).
Perfect Forward Secrecy
The keys created by peers during IKE phase II and used for IPsec are based on a
sequence of random binary digits exchanged between peers, and on the DH key
computed during IKE phase I.
The DH key is computed once, then used a number of times during IKE phase II.
Since the keys used during IKE phase II are based on the DH key computed during
IKE phase I, there exists a mathematical relationship between them. For this
reason, the use of a single DH key may weaken the strength of subsequent keys. If
one key is compromised, subsequent keys can be compromised with less effort.
In cryptography, Perfect Forward Secrecy (PFS) refers to the condition in which the
compromise of a current session key or long-term private key does not cause the
compromise of earlier or subsequent keys. Security gateways meet this requirement
with a PFS mode. When PFS is enabled, a fresh DH key is generated during IKE
phase II, and renewed for each key exchange.
However, because a new DH key is generated during each IKE phase I, no
dependency exists between these keys and those produced in subsequent IKE
Phase I negotiations. Enable PFS in IKE phase II only in situations where extreme
security is required.
Chapter 2
IPSEC & IKE
49