What is Perfect Forward Secrecy in IPsec, and what does it cost?
Show the answer
Say this first
With PFS, each set of phase 2 keys comes from a fresh Diffie-Hellman exchange instead of from the phase 1 key material. If an attacker later obtains one set of keys, they cannot derive the keys of other SAs, so traffic recorded in other periods stays safe. The cost is one extra DH computation per phase 2 negotiation and rekey, and both peers must agree on the PFS group or phase 2 fails.
Go deeper
Configuration on IOS
crypto ipsec profile VTI-PROF
set transform-set TS-AES256
set pfs group19
set ikev2-profile IKEV2-PROFFor a crypto map, set pfs group19 goes under the crypto map entry.
How it works
- IKEv1: quick mode messages 1 and 2 carry KE payloads, and the new DH secret feeds the IPsec keys.
- IKEv2: the first Child SA, built in IKE_AUTH, has no DH of its own. PFS applies when Child SAs are created or rekeyed with CREATE_CHILD_SA.
Choosing the group
Use the same group as phase 1 or a stronger one. A strong phase 1 group with a weak PFS group gives the IPsec keys only the weak protection.
They will ask next
Without PFS, what is exposed if the IKE SA keys leak?
In IKEv1 the IPsec keys are derived from SKEYID_d of the ISAKMP SA plus nonces exchanged inside it. With the IKE keys and a capture of the quick modes, an attacker can compute every IPsec key made under that IKE SA. PFS breaks that chain because each Child SA adds a DH secret that was never sent.
Does PFS protect against a stolen pre-shared key?
A passive eavesdropper who only has the PSK still cannot decrypt recorded traffic, because the keys also depend on DH secrets that never crossed the wire. An active attacker with the PSK can impersonate a peer in new sessions, and no DH option prevents that. Rotate the key.
Traps
- Calling PFS a phase 1 setting. It is negotiated for the IPsec (Child) SAs.