IKEv1 is available to authenticate its peers using two different methods.
These methods are pre-shared keys, which we saw earlier in the course demos,
and digital certificates, using a public key infrastructure.
These two methods are what make the authentication of IKE function.
Using pre-shared keys with IKE,
both ends of the link need to know the key that will
authenticate the remote end device.
This is useful and can be easy; however,
you would need to know of a secure way to get the passwords to the other end.
This could pose a security risk or at least a barrier to securing the network.
Using the PKI method, it makes the configuration so much more secure.
You can use your organization's public key infrastructure to trust the
remote device's certificate so you don't have to share passwords and so
that you can gain a little bit more security since digital certificates
are impossible to forge or manipulate.
So let's talk about the pre-shared key.
If using this method,
IKE would take the key and use it to authenticate with a
peer so that the SA can be established.
The devices compute and send a hash of the data to each other.
Using their own pre-shared keys,
they try to compute the same hash that they received.
If the two keys match up,
then they're authenticated since they both must have the same key.
Aside from the security risks of transmitting a key to the
other device for proper configuration matching,
there's another problem with this authentication method.
It doesn't scale well.
By this, I mean,
can you imagine you have to change all of the VPN passwords for
a hundred devices or hundreds of devices?
The password management would be very crazy after the first few devices,
which brings us to certificates.
Using certificates with IKE is awesome as it allows us to dynamically trust
certificates signed by the trusted certificate authorities.
This method is awesome since we don't have to share any
passwords to establish the connection.
Certificates have many advantages over our traditional pre-shared keys and
help us improve the security posture of our organization.
They also have built-in expiration dates and can't
be copied or forged by attackers, as we discussed earlier.
Since the CA is centrally managed, ensuring that your devices trust the right peers is so easy here.