[c-nsp] Dynamic remotes connecting to VPN 3005. Is it possible?

Michael Markstaller mm at elabnet.de
Sat Oct 2 03:49:54 EDT 2004

It's probably a bit overdone but any security measure is as weak as the
weakest component and if you have a high-secure environment, let's say
the best safe with the thickest armor available (AES) but stick the
access-code on the front of it (PSK) it's useless. Anybody can open it.

> From: Hani Mustafa [mailto:hani.mustafa at noorgroup.net] 
> Sent: Saturday, October 02, 2004 1:21 AM
> That's taking it too far. After all, the PSK's are not used 
> for the actual encryption.
True, but PSK is used to exchange the key material which makes the
"actual encryption" secure - or insecure.
Nobody might be able to break the armor of AES but having recovered the
key-material from Phase 1 it's not nescessary
and this is neither theorectical nor only my opinion:
another paper about agressive mode in detail:

The problem is even bigger with using agreessive mode by design (with
Clients/VPN3000 in this case)
and I don't understand why people still propagate and use PSK for
apperant secure encryption although it's weak and there are better
alternatives available. 
For sure, it's a bigger effort to use certs but why does someone make
the effort of creating encrypted tunnels when leaving out the last 10%
making the whole system vulnerable


More information about the cisco-nsp mailing list