Which encryption and integrity algorithms would you choose for a new IPsec tunnel?
Show the answer
Say this first
For ESP, AES-GCM with 256-bit (or 128-bit) keys, which encrypts and authenticates in one pass, or AES-CBC with HMAC-SHA-256 or stronger where GCM is not available. For the IKE SA, AES-256 with SHA-256 or SHA-384 and DH group 19 or 20, with 14 as the minimum. Avoid DES, 3DES, MD5 and SHA-1, and DH groups 1, 2 and 5. Authenticate with certificates at scale, or long random pre-shared keys.
Go deeper
IOS-XE example
crypto ikev2 proposal PROP-STRONG
encryption aes-gcm-256
prf sha384
group 20
crypto ipsec transform-set TS-GCM esp-gcm 256
mode tunnelWith AES-GCM in an IKEv2 proposal there is no separate integrity algorithm, so you set the PRF explicitly.
Why these
- GCM is an AEAD cipher: less overhead and fast on hardware that accelerates it.
- 3DES and other 64-bit block ciphers are open to birthday attacks on long sessions (Sweet32, 2016).
- Check the platform's crypto hardware: an algorithm it does not accelerate can drop throughput a lot.
They will ask next
Is HMAC-SHA1 broken?
The SHA-1 collision attacks do not directly break HMAC-SHA1, which relies on different properties. It is still deprecated by most security policies and compliance standards, so there is no reason to choose it for a new tunnel.
Do both ends need the same transform set?
They need at least one proposal in common. You can offer several in order of preference, and the responder picks one it also allows.
Traps
- Calling 3DES strong because it is "triple". Its 64-bit block is the problem, and it is deprecated.