1. IPSec/IKE Public Key Encryption Aggressive Mode vulnerability Initiator Responder ----------- ----------- HDR, SA, [ HASH(1),] KEi, Pubkey_r, Pubkey_r -----> PubKey_i, PubKey_i, HASH_R HDR,HASH_I ----->

2. IPSec/IKE Public Key Encryption Aggressive Mode vulnerability “Chess Grandmaster” attack“Chess Grandmaster” attack

3. IPSec/IKE Public Key Encryption Aggressive Mode vulnerability Initiator CheaterResponder ----------- ----------- ----------- HDR, SA, KEi, Pubkey_c, Pubkey_c -----> HDR, SA, KEi, Pubkey_r, Pubkey_r -----> HDR, SA, KEr, PubKey_c, PubKey_c, HASH_R HDR, SA, KEr, Pubkey_i, Pubkey_i, HASH_C HDR,HASH_I -----> HDR, HASH_C ----->

4. IPSec/IKE Public Key Encryption Aggressive Mode vulnerability HASH_x=prf(SKEIDxc,KEx|KEc|CKY-X|CKY-Y|IDxc) HASH_C=prf(SKEIDir, Kei|Ker|CKY-I|CKY-R|IDir) prf=HMAC or Keyed MAC KEx=g^DHPrivKey_x x=i, r SKEIDir=prf(HASH(Ni|Nr), CKY-I|CKY-R)HASH_x=prf(SKEIDxc,KEx|KEc|CKY-X|CKY-Y|IDxc) HASH_C=prf(SKEIDir, Kei|Ker|CKY-I|CKY-R|IDir) prf=HMAC or Keyed MAC KEx=g^DHPrivKey_x x=i, r SKEIDir=prf(HASH(Ni|Nr), CKY-I|CKY-R) If Cheater isn’t agreed with any side, attack will be stopped in Phase 2If Cheater isn’t agreed with any side, attack will be stopped in Phase 2 If Cheater is agreed with Initiator(cheater knows DHPrivKey_i), they can fake ResponderIf Cheater is agreed with Initiator(cheater knows DHPrivKey_i), they can fake Responder Attack is possible in Main and Aggressive ModeAttack is possible in Main and Aggressive Mode

5. IPSec/IKE Public Key Encryption Aggressive Mode vulnerability How to resolve problem? In protocol first and second message apply signature: 1. SIGNi(KEi) 2. SIGNr(KEr)How to resolve problem? In protocol first and second message apply signature: 1. SIGNi(KEi) 2. SIGNr(KEr)