Security Considerations

The ipseckey command handles sensitive cryptographic keying information. It enables a privileged user to enter cryptographic keying information. If an adversary gains access to this information, the adversary can compromise the security of IPsec traffic. You should take the following issues into account when using the ipseckey command:

1. Is the TTY going over a network (interactive mode)?

   • If it is, then the security of the keying material is the security of the network path for this TTY's traffic. You should avoid using ipseckey(1M) over a clear-text telnet or rlogin session.

   • Even local windows might be vulnerable to attacks by a concealed program that reads window events.

2. Is the file accessed over the network or readable to the world (-f option)?

   • An adversary can read a network-mounted file as it is being read. You should avoid using a world-readable file with keying material in it.

   • If your source address is a host that can be looked up over the network, and your naming system is compromised, then any names used are no longer trustworthy.

Security weaknesses often lie in misapplication of tools, not the tools themselves. You should be cautious when using ipseckey. Use a console for the safest mode of operation, or other hard-connected TTY.