What is Diffie-Hellman used for in IPsec, and which groups should you use?
Show the answer
Say this first
Diffie-Hellman lets the two peers compute the same secret over an untrusted network without ever sending it, and the IKE keys are derived from that secret. The group sets the math and the strength. Groups 1, 2 and 5 (768, 1024 and 1536-bit MODP) are too weak. Group 14 (2048-bit MODP) is the minimum; the elliptic-curve groups 19 (256-bit) and 20 (384-bit) give better strength for less CPU. Both peers must agree on the group.
Go deeper
| Group | Type | Use |
|---|---|---|
| 1, 2, 5 | 768, 1024, 1536-bit MODP | do not use |
| 14 | 2048-bit MODP | acceptable minimum |
| 15, 16 | 3072, 4096-bit MODP | strong but slow |
| 19 | 256-bit ECP (NIST P-256) | recommended |
| 20 | 384-bit ECP (NIST P-384) | recommended, typical for high-assurance policies |
| 21 | 521-bit ECP | strong |
| 24 | 2048-bit MODP with 256-bit subgroup | deprecated |
Points to make
- DH alone gives no authentication. The PSK or certificate check in IKE stops a man in the middle.
- DH runs in phase 1 and again in phase 2 if PFS is enabled.
- The Logjam research (2015) showed that weak and widely shared DH groups are realistic targets, which is why 1024-bit groups were dropped.
They will ask next
Why are the elliptic-curve groups faster?
They reach the same strength with much smaller numbers. A 256-bit curve is roughly as strong as 3072-bit MODP, so the math per exchange is far cheaper.
What happens when the DH groups do not match?
In IKEv1 phase 1 no proposal matches and negotiation stops after the first message pair; IOS shows the SA stuck in MM_NO_STATE. In IKEv2 the responder answers IKE_SA_INIT with INVALID_KE_PAYLOAD naming the group it wants, and the initiator retries with that group if it is in its own proposal.
Traps
- Saying Diffie-Hellman encrypts the traffic. It only produces shared key material.