Aggressive ModeQ: Does strongSwan support IKEv1 Aggressive Mode?A: Since version 5.0.0 the answer is yes. For previous releases, where the IKEv1 protocol was handled by the pluto daemon, the answer is and remains no. However, the strongSwan developers still recommend to avoid its use with pre-shared keys. This is due to a known weakness of the protocol. With Aggressive Mode, a hash of the pre-shared key is transmitted in clear-text. An eavesdropper can capture this hash and run an offline brute-force attack against it. Once the pre-shared key is known MITM attacks to gather the XAuth credentials can easily be executed. Aggressive Mode is therefore incompatible with the basic principles of the strongSwan project which is to deliver a product that meets high security standards. That's why, in order to use Aggressive Mode with pre-shared keys as responder (i.e. on gateways) it is required to set charon.i_dont_care_about_security_and_use_aggressive_mode_psk=yes in strongswan.conf. As promised often in numerous public and private talks strongSwan then changes its name to weakSwan. It is not required to set this option for clients as they often have no other choice.To avoid Aggressive Mode with pre-shared keys (and other short-comings of IKEv1 Main or Aggressive Mode) the best option is to switch to IKEv2. But even for IKEv1 strongSwan 5.0.0 now provides an easy to deploy alternative: hybrid authentication. This mode uses a certificate to authenticate the gateway and only XAuth to authenticate the client, during Phase 1 (Main or Aggressive Mode) the client is not authenticated.
