Cipher suites & what the peer still accepts

Stop offering weak algorithms

Lesson 7 of 20 · 12 min · Module 2: Who is on the other end

A tunnel that has run for ten years was configured with ten-year-old cryptography. It still comes up, and that is the problem.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Name the algorithms that should no longer be offered
Explain how the order of proposals decides what is used
Remove weak proposals without breaking the tunnel

The idea

Gateways pick the first proposal in your list that the peer also accepts. If an old, weak proposal is still listed first and the peer still accepts it, that is what protects your traffic. DES, 3DES, MD5, SHA-1 and Diffie-Hellman groups 1, 2 and 5 should not be offered any more.

# before: two proposals, the weak one first
#   ike proposal des md5 dh1
#   ike proposal aes128 sha256 dh14
# after: only the strong one
ike proposal aes128 sha256 dh14

01What is weak, and why

DES has a 56-bit key and can be searched exhaustively. 3DES is slow and has a small block size. MD5 and SHA-1 have known collision attacks. Groups 1, 2 and 5 use primes of 768, 1024 and 1536 bits, which are within reach of a well-funded attacker. AES, SHA-2 and group 14 or above are the working minimum.

02Order is a decision

Your list is in order of preference. A strong proposal in second place is used only when the first is refused. To be sure a weak suite is never chosen, do not offer it at all, and agree with the other side that it removes it too.

03Check what a tunnel really uses

The configuration shows what may be used; the SA shows what is being used.

# FortiGate
diagnose vpn ike gateway list
diagnose vpn tunnel list

# Huawei USG
display ike sa verbose
display ipsec sa

# Cisco IOS
show crypto ikev2 sa detailed
show crypto ipsec sa

Your turn

This tunnel works, but it negotiates 3DES, SHA-1 and group 2, because those proposals are listed first and the branch still accepts them. Remove the weak proposals so that only the strong ones remain. The tunnel must stay up.

What the checks look for

No weak algorithm is offered
The IKE SA uses aes256, sha256 and group 14
The child SA uses aes256 and sha256
The tunnel still carries the traffic

Try it in the editor →

Take this with you

Offer only what you are willing to use. A weak proposal that is still listed can still be chosen.

Go a little further

Add a second strong IKE proposal, aes256 sha384 dh19, above the existing one and run the lab. The tunnel uses the second, because the branch does not have the first.