Security Considerations

The ipseckey command enables a privileged user to enter sensitive cryptographic keying information. If an adversary gains access to this information, the adversary can compromise the security of IPsec traffic. You should consider the following issues when you handle keying material and use the ipseckey command:

1. Have you refreshed the keying material? Periodic key refreshment is a fundamental security practice. Changing keys guards against potential weaknesses of the algorithm and keys, and limits the damage of an exposed key.

2. Is the TTY going over a network (interactive mode)?

   • If the TTY is in interactive mode, then the security of the keying material is the security of the network path for this TTY's traffic. You should avoid using the ipseckey command over a clear-text telnet or rlogin session.

   • Even local windows might be vulnerable to attacks by a concealed program that reads window events.

3. Is the file accessed over the network or readable to the world (-f option)?

   • An adversary can read a network-mounted file as it is being read. You should avoid using a world-readable file with keying material in it.

   • If your source address is a host that can be looked up over the network, and your naming system is compromised, then any names used are no longer trustworthy.

Security weaknesses often lie in misapplication of tools, not the tools themselves. You should be cautious when using the ipseckey command. Use a console or other hard-connected TTY for the safest mode of operation.