Best Practices for Quantum Safe Key Exchange and VPN Tunnel Encryption

Important - This feature supports only Security Gateways with version R82 and higher.

Introduction

In modern cyber security environments, ensuring the robustness of encryption is important. Internet Key Exchange version 2 (IKEv2) is critical for establishing secure VPN tunnels. Quantum Safe Key Exchange includes these enhancements to IKEv2 that strengthen its resilience:

This enhancement introduces an additional exchange that can utilize the existing IKE fragmentation mechanism, which helps prevent IP fragmentation of large IKE messages.

This is particularly valuable when longer key exchange methods are employed, as it cannot be used in the initial IKEv2 exchange.

With this enhancement, IKEv2 can perform multiple key exchanges with the use of different cryptographic algorithms, including Post-Quantum algorithms.

The security of the entire exchange is designed to be at least as strong as the most secure algorithm employed, to ensure that even if one method is compromised, the overall key exchange remains protected.

These enhancements greatly improve IKEv2 performance and security, especially in environments where large key exchanges and Post-Quantum Cryptography (PQC) are being adopted.

In addition, this section includes recommended Post Quantum Encryption Best Practices for VPN tunnel encryption.

Configuring Quantum Safe Key Exchange in SmartConsole

  1. In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., click the Objects menu > Object Explorer (or press the CTRL+E keys).

  2. From the left navigation tree, click VPN Communities.

  3. Double-click an existing VPN CommunityClosed A named collection of VPN domains, each protected by a VPN gateway. object (or create a new object).

    The VPN Community object window opens and shows the Gateways page.

  4. From the navigation tree, click Encryption.

  5. Select the checkbox Quantum Safe Key Exchange.

    Note - When you select this checkbox, the VPN Community object uses the default profile.

    To change the default profile settings, you must use Management API. See Configuring Quantum Safe Key Exchange with Management API.

  6. Configure other required settings in this VPN Community object.

  7. Click OK.

  8. Install the Access Control Policy on all Security Gateways that participate in this VPN Community.

Configuring Quantum Safe Key Exchange with Management API

Refer to one of these Management API References > Chapter "VPN":

  1. If it is necessary to change the default profile settings for Quantum Safe Key Exchange, then create the required Multiple Exchanges Proposal object.

    In the Management API Reference, refer to the Chapter "VPN" > Section "Multiple Key Exchanges":

    add multiple-key-exchanges

  2. Configure IKE parameters in the VPN Community.

    In the Management API Reference, refer to the Chapter "VPN".

    • For a Meshed VPN Community, refer to the Section "VPN Community Meshed":

      add vpn-community-meshed

      set vpn-community-meshed

    • For a Star VPN Community, refer to the Section "VPN Community Star":

      add vpn-community-star

      set vpn-community-star

    Required API Parameters:

    IKE Phase

    Parameter

    Sub-Parameter

    IKE Phase 1

    ike-phase-1

    • multiple-key-exchanges

    • use-multiple-key-exchanges

    IKE Phase 2

    ike-phase-2

    • multiple-key-exchanges

    • use-multiple-key-exchanges

  3. Install the Access Control Policy on all Security Gateways that participate in this VPN Community.

    In the Management API Reference, refer to the Chapter "Policy".

    verify-policy

    install-policy

Post-Quantum VPN Tunnel Encryption Best Practices

In addition to Quantum Safe Key Exchange, we recommend Best Practices for VPN TunnelClosed An encrypted connection between two hosts using standard protocols (such as L2TP) to encrypt traffic going in and decrypt it coming out, creating an encapsulated network through which data can be safely shared as though on a physical private line. Encryption. To follow all of these Best Practices, all member gateways in the VPN Community must support all of these settings.

  1. In SmartConsole, click the Objects menu > Object Explorer (or press the CTRL+E keys).

  2. From the left navigation tree, click VPN Communities.

  3. Double-click an existing VPN Community object (or create a new object).

    The VPN Community object window opens and shows the Gateways page.

  4. From the navigation tree, click Encryption.

  5. For Encryption Method, select IKEv2 only.

  6. Select Custom encryption suite.

  7. For Encryption algorithm, select AES-256.

  8. For Data Integrity, select SHA-384.

  9. For Diffie-Hellman Group, select a group higher than 15.

  10. Select the checkbox Use Perfect Forward Secrecy.

  11. Select the checkbox Quantum Safe Key Exchange.

    Note - When you select this checkbox, the VPN Community object uses the default profile.

    To change the default profile settings, you must use Management API. See Configuring Quantum Safe Key Exchange with Management API.

  12. Configure other required settings in this VPN Community object.

  13. Click OK.

  14. Install the Access Control Policy on all Security Gateways that participate in this VPN Community.