RE: difference in IKE main and aggressive mode

[Atul.Sharma@nokia.com]

> -----Original Message-----
> From: ext Markus Friedl [mailto:markus@openbsd.org]
> Sent: Thursday, December 05, 2002 10:10 AM
> To: Harshwardhan Mittal
> Cc: ipsec@lists.tislabs.com
> Subject: Re: difference in IKE main and aggressive mode
> 
> 
> On Thu, Dec 05, 2002 at 05:26:54PM +0530, Harshwardhan Mittal wrote:
> > What is the main difference in terms of security in IKE v1 main and
> > aggressive mode?
> 
> main mode provides identity protection for both sides.
> 
> aggressive mode does not, but uses less round trips.


Though there is no identity protection in Aggressive mode per se, it 
can be gotten by use of public key encryption as the authentication method.

But this is not an endorsement for Aggressive mode vis-a-vis Main mode.

There are other restrictions with Aggressive mode....e.g. SA negotiation 
is limited:
	- Cannot negotiate the DH group
	- when using revised mode of public key encryption, the hash and cipher
	  can not be negotiated