Which NGE IKE Diffie-Hellman group identifier has the strongest cryptographic properties?
A.
group 10
B.
group 24
C.
group 5
D.
group 20
Which NGE IKE Diffie-Hellman group identifier has the strongest cryptographic properties?
Which NGE IKE Diffie-Hellman group identifier has the strongest cryptographic properties?
why not 24? Key size limited to 128?
“If you are using encryption or authentication algorithms with a 128-bit key, use Diffie-Hellman groups 5, 14, 19, 20 or 24. If you are using encryption or authentication algorithms with a 256-bit key or higher, use Diffie-Hellman group 21 or 24.” – https://supportforums.cisco.com/document/12276506/diffie-hellman-groups
Maybe (caution this is a guess) cause it is not with a Eliptic Curve like DH Group 19 or 20
Several other internet sources explain Group 24 as “2048-bit MODP Group with 256-bit prime order subgroup” MODP Stands for ” More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)” and is defined in RFC 3526. (https://tools.ietf.org/html/rfc3526)
Group 24 is defined in RFC 5114 (https://tools.ietf.org/html/rfc5114) where you can find the ECP Groups as well
both RFCs are rather old so saying they are not “next generation” might be valid
so in short Group 24 is based on a Exponential Function not on a Eliptic Curve function (if i understand it correctly) and per Cisco this might be the reason to not qualify it as Ciscos Interpretation of Next Generation Encryption.
A strong indication for this is the fact that Group 24 is not showing up in the NGE Document from Cisco http://www.cisco.com/c/en/us/about/security-center/next-generation-cryptography.html they just talk about Group 19 and 20 since this are the DH Groups wit the Eliptic Curves.
In my opinion this is related to the fact that Group 24 is not based und Eliptic Curves and in Ciscos World Next Generation Encryptions means Eliptic Curve.
In most Internet Ressources Group 24 is explained as “2048-bit MODP Group with 256-bit prime order subgroup” (RFC 5114 for example)
and MODP stands for Modular Exponential (RFC 3526 for example).
in Ciscos NGE Paper(http://www.cisco.com/c/en/us/about/security-center/next-generation-cryptography.html) they also say “When possible, use IKE Group 19 or 20. They are the 256-bit and 384-bit ECDH groups, respectively”
(4/July/2017 Updated) New 300-209 Exam Questions:
NEW QUESTION 293
A company has a Flex VPN solution for remote access and one of their Cisco any Connect remote clients is having trouble connecting property. Which command verifies that packets are being encrypted and decrypted?
A. show crypto session active
B. show crypto ikev2 stats
C. show crypto ikev1 sa
D. show crypto ikev2 sa
E. show crypto session detail
Answer: E
NEW QUESTION 294
Refer to the exhibit, which result of this command is true?
A. Makes the router generate a certificate signing request
B. Generates an RSA key called TRIALFOUR
C. It displays the RSA public keys of the router
D. It specifies self- signed enrollment for a trust point
Answer: A
NEW QUESTION 295
An engineer is attempting to establish a new site-to-site VPN connection. The tunnel terminates on an ASA 5506-X which is behind an ASA 5515-X. The engineer notices that the tunnel is not establishing. Which option is a potential cause?
A. Certificates were not configured
B. Diffie – Helman Group is not set
C. Access lists were not applied
D. NAT – traversal is not configured
Answer: D
NEW QUESTION 296
Which algorithm does ISAKMP use to securely derive encryption and integrity keys?
A. Diffie – Hellman
B. AES
C. ECDSA
D. RSA
E. 3DES
Answer: D
NEW QUESTION 297
Which purpose of configuring perfect Forward secret is true?
A. For every negotiation of a new phase 1 SA, the two gateways generate a new set of phase 2 keys.
B. For every negotiation of a new phase 2 SA, the two gateways generate a new set of phase 1 keys.
C. For every negotiation of a new phase 1 SA, the two gateways generate a new set of phase 1 keys.
D. For every negotiation of a new phase 2 SA, the two gateways generate a new set of phase 2 keys.
Answer: A
NEW QUESTION 298
An engineer has successfully established a phase 1 tunnel, but notices that no packets are decrypted on the head end side of the tunnel. What is a potential cause for this issue?
A. different phase 2 encryption
B. misconfigured DH group
C. disabled PFS
D. firewall blocking Phase 2 ESP or AH
Answer: A
NEW QUESTION 299
Which option describes traffic that will initiate a VPN connection?
A. trusted
B. external
C. internal
D. interesting
Answer: D
NEW QUESTION 300
……
P.S. Get The Newest 300-209 Dumps In PDF And VCE From — http://www.passleader.com/300-209.html (307q VCE and PDF)
Good Luck!
What’s more, part of that new 307Q 300-209 dumps are available here:
https://drive.google.com/open?id=0B-ob6L_QjGLpVTNFVTRPdC0zTnM
Best Regards!