Topic

IPsec

1 post about IPsec. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Cloudflare
Preventing quantum downgrade attacks against IPsec
Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.

The best engineering reads, once a week.

Topic

1 post about IPsec. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Cloudflare
Preventing quantum downgrade attacks against IPsec
Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.

The best engineering reads, once a week.