VPN and Cryptographic Protocols Flashcards

Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

Answer: IPsec

IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.

What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

Answer: To negotiate and establish the Security Associations (SAs) and exchange keys

IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.

Which symmetric encryption algorithm is recommended for IPsec VPN in modern CNDA implementations due to its security and performance?

Answer: AES-256

AES-256 provides strong 256-bit encryption with hardware acceleration support and is the NIST-recommended standard for symmetric encryption.

What is the primary difference between a site-to-site VPN and a remote-access VPN?

Answer: Site-to-site connects two networks permanently; remote access connects individual users dynamically

Site-to-site VPNs create a persistent encrypted tunnel between two network gateways, while remote access VPNs connect individual clients to a corporate network.

Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?

Answer: MD5

MD5 is vulnerable to collision attacks and has been broken, making it unsuitable for use in cryptographic security protocols.

What does 'perfect forward secrecy' (PFS) protect against in a VPN?

Answer: Compromise of the long-term private key exposing past session keys

PFS generates ephemeral session keys so that compromising the long-term key does not allow decryption of previously recorded sessions.