Key exchange settings

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Key exchange settings

The strength of the keys which protect the key exchange phase is enhanced by the following features:

Key lifetimes

Lifetime settings determine when a new key is generated. Any time a key lifetime is reached, the associated SA is also renegotiated. The process of generating new keys at intervals is called dynamic rekeying or key regeneration. Lifetimes allow you to force the generation of a new key after a specific interval. For example, if the communication takes 100 minutes and you specify the key lifetime as 10 minutes, 10 keys will be generated (one every 10 minutes) during the exchange. Using multiple keys ensures that if an attacker manages to gain the key to one part of a communication, the entire communication is not compromised. Automatic key regeneration is provided by default. You can override the defaults and either specify a master key lifetime in minutes or by the number of session keys, or enable master key perfect forward secrecy (PFS).

Caution should be taken when setting very different key lifetimes, since they also determine the lifetime of the SA. For example, setting a master key lifetime of 8 hours (480 minutes) and a session key lifetime (set within a filter action) of 2 hours might result in a quick mode SA that is in place for almost 2 hours after the main mode SA has expired. This has the potential to occur if the new quick mode SA is generated just before the main mode SA expires.

  • Session key limit

    Repeated rekeying off of the same master key might eventually compromise the key. For example, if Alice on Computer A sends a message to Bob on Computer B, and then a few minutes later sends another message to Bob, the same master key material can be reused since an SA was recently established with that computer. If you want to limit the number of times this reuse occurs, you can specify a session key limit.

    If you decide to enable master key perfect forward secrecy (PFS), the session key limit will be set to 1. Master key PFS forces key regeneration each time. If you specify both a master key lifetime in minutes, and a session key limit, whichever interval is reached first will start a new key.

  • Master key perfect forward secrecy (PFS)

    Master key PFS determines how a new session key is generated. Enabling master key PFS ensures that the master key keying material cannot be used to generate more than one session key.

    Master key PFS should be used with caution because it requires reauthentication and might impact performance. It is not required to be enabled on both peers.

For information about how to configure key exchange settings and methods, see Configure key exchange settings and Create key exchange security methods.