Detections
Analytics

1.7.1 Enabling Post-Quantum (PQ) on IKEv2 VPNs

Information

For VPN that has IKEv2 enabled, enable PQ for more secure way to exchange pre-shared secret to defend against 'Harvest Now, Decrypt Later' attack technique.

Rationale:

Post-quantum IKEv2 VPNs based on RFC 8784 work by transmitting a pre-shared secret separately (out-of-band) from the initial peering exchange (the IKE_SA_INIT Exchange). Instead of transmitting the pre-shared secret in the peering exchange, which an attacker could compromise or harvest now and decrypt later, the peering exchange only transmits a Key ID. A Key ID and a pre-shared secret comprise a unique pair called a post-quantum pre-shared key (PQ PPK).

Each IKEv2 peer uses the Key ID to look up the pre-shared secret, which is transmitted securely between administrators or pushed by Panorama, and stored locally on each IKEv2 peer. The pre-shared key is never part of the peering exchange and never traverses the post-quantum VPN, so an attacker using a quantum computer can't steal it, crack it, and use it to decrypt data harvested from a VPN.

Both IKEv2 peers must have the same active pairs of Key ID plus pre-shared secret so that when peers negotiate the connection, each peer can look up the same Key ID and retrieve the same pre-shared secret. If the responding peer doesn't have a matching Key ID or if the pre-shared secret associated with the Key ID differs from the initiator, the connection is aborted.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Navigate to Network > Network Profiles > IKE Gateways.
On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section.
Check Enable Post-Quantum Pre-Shared Key (PPK) option.
Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping.
If both sides of VPN supports more than 1 PPK key ID, then multiple PPK key ID should be configured. Configuring multiple PQ PPKs is most secure because it adds a random element to PQ PPK selection.

Default Value:

Not Configured

See Also

https://workbench.cisecurity.org/benchmarks/17915

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-18, 800-53|SC-23

Plugin: Palo_Alto

Control ID: 646f85d2f18915138ad710ceca59fd33167be82eec19a8630edebdc92e9d7a8c