Quantum Safe Key Exchange

Important - This feature supports only Security Gateways R82 and higher.

Introduction

In modern cyber security environments, ensuring the robustness of key exchanges in Internet Key Exchange version 2 (IKEv2) is critical for maintaining secure communications.

This section introduces two important enhancements to IKEv2 that strengthen its resilience:

This enhancement introduces an additional exchange that can utilize the existing IKE fragmentation mechanism, which helps prevent IP fragmentation of large IKE messages.

This is particularly valuable when longer key exchange methods are employed, as it cannot be used in the initial IKEv2 exchange.

With this enhancement, IKEv2 can perform multiple key exchanges with the use of different cryptographic algorithms, including Post-Quantum algorithms.

The security of the entire exchange is designed to be at least as strong as the most secure algorithm employed, to ensure that even if one method is compromised, the overall key exchange remains protected.

These enhancements are critical in improving IKEv2 performance and security, especially in environments where large key exchanges and Post-Quantum Cryptography (PQC) are being adopted.

Configuring Quantum Safe Key Exchange in SmartConsole

  1. In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., click the Objects menu > Object Explorer (or press the CTRL+E keys).

  2. From the left navigation tree, click VPN Communities.

  3. Double-click an existing VPN CommunityClosed A named collection of VPN domains, each protected by a VPN gateway. object (or create a new object).

    The VPN Community object window opens and shows the Gateways page.

  4. From the navigation tree, click Encryption.

  5. Select the checkbox Quantum Safe Key Exchange.

    Note - When you select this checkbox, the VPN Community object uses the default profile.

    To change the default profile settings, you must use Management API. See Configuring Quantum Safe Key Exchange with Management API.

  6. Configure other required settings in this VPN Community object.

  7. Click OK.

  8. Install the Access Control Policy on all Security Gateways that participate in this VPN Community.

Configuring Quantum Safe Key Exchange with Management API

Refer to one of these Management API References > Chapter "VPN":

  1. If it is necessary to change the default profile settings for Quantum Safe Key Exchange, then create the required Multiple Exchanges Proposal object.

    In the Management API Reference, refer to the Chapter "VPN" > Section "Multiple Key Exchanges":

    add multiple-key-exchanges

  2. Configure IKE parameters in the VPN Community.

    In the Management API Reference, refer to the Chapter "VPN".

    • For a Meshed VPN Community, refer to the Section "VPN Community Meshed":

      add vpn-community-meshed

      set vpn-community-meshed

    • For a Star VPN Community, refer to the Section "VPN Community Star":

      add vpn-community-star

      set vpn-community-star

    Required API Parameters:

    IKE Phase

    Parameter

    Sub-Parameter

    IKE Phase 1

    ike-phase-1

    • multiple-key-exchanges

    • use-multiple-key-exchanges

    IKE Phase 2

    ike-phase-2

    • multiple-key-exchanges

    • use-multiple-key-exchanges

  3. Install the Access Control Policy on all Security Gateways that participate in this VPN Community.

    In the Management API Reference, refer to the Chapter "Policy".

    verify-policy

    install-policy