Re: [IPSec] : exchange mode - query

["Qiang Zhang" <qzhang@aber-networks.com>]

In mainmode, the responder has to use the initiators Source IP address in
the IP header as identifier to search for preshared secret in the database.
Thus not suitable for remote access scenarios.

Q
----- Original Message -----
From: <Lev.Finkel@ecitele.com>
To: <ipsec@lists.tislabs.com>
Cc: <Oleg.Litvak@ecitele.com>
Sent: Tuesday, July 30, 2002 2:22 AM
Subject: [IPSec] : exchange mode - query


> Hi all,
>
> in the security consideration of some Internet drafts (e.g. Diameter) I
> found the statement that "When pre-shared keys are used for
authentication,
> IKE Aggressive Mode SHOULD be used, and IKE Main Mode SHOULD NOT be used".
> Can someone explain why it's not recommended to use Main Mode with
> pre-shared keys? It will be nice to have a reference to such explanation
in
> other docs.
>
> with regards,
> Lev Finkel
>
>