3

It should work similarly as to going to a random HTTPS website, where the supplied certificate is backed by a CA, and based on which a secure connection is made. Then authentication follows over the secure connection.

So why am I required to supply both user and CA certificates. In other words, why is it not merely an option?

Edit: now that I look at it, it seems that no user nor password can be supplied either, so the client authentication happens based on the user certificate. Only for PPTP a password is required (which is not a secure protocol anyway). So the question becomes: why have they chosen to support only IKEv2 with user certificates and not passwords. It can not be for security reasons since PPTP is supported.

Improve this question
0

1 Answer 1

Reset to default
4

As the name implies, the VPN type IKEv2/IPSec RSA [sic, it should actually be "IPsec" not "IPSec"] is for client authentication with an RSA certificate/key. The name was probably chosen for consistency with the existing IKEv1-based VPN types (e.g. "L2TP/IPSec RSA" or "IPSec Xauth RSA"), it might also work with ECDSA certificates/keys not only RSA, but I did not test that.

There were two other IKEv2 VPN types added in Android 11/R's built-in VPN client:

  • IKEv2/IPSec PSK for authentication of both client and server with a pre-shared key (PSK), which is not an ideal choice for remote access connections as anybody who knows the PSK can impersonate the server (an active attacker can retrieve the PSK hash and attack it via brute-force/dictionary attack).
  • IKEv2/IPSec MSCHAPv2 for client authentication with username/password using EAP-MSCHAPv2. The server is theoretically authenticated with a certificate first so the password hash is only sent to a trusted peer. However, this verification is apparently not mandatory in this client and disabled by default (don't verify server), which makes this VPN type vulnerable to active attackers unless the user makes sure to install and select the correct CA/server certificate.

For an IKEv2/IPsec VPN client with more options (e.g. split-tunneling, app filtering), you could use the open-source strongSwan VPN client app, which also works on older Android versions. (Disclaimer: I'm a developer for the strongSwan project.)

Improve this answer
3
  • So I understand that there is no particular reason why IKEv2/IPSec MSCHAPv2 is not implemented in Android 10, as it is scheduled for Android 11. PS Great work with strongSwan!
    – Davor Josipovic
    May 26, 2020 at 17:13
  • 1
    Plain Android 10 does actually not support IKEv2 in its built-in VPN client, Android 11 will be the first one (Google has been working on their own IKEv2 implementation for several years now). In earlier versions, IKEv2 is only supported via third-party app or if the device manufacturer modified the Android image, which is what e.g. Samsung has been doing for years (but since I don't have any Samsung device I don't know details).
    – ecdsa
    May 27, 2020 at 8:13
  • I wasn't aware that Samsung was modifying the original image in such a way: I am indeed using a Android 10 Samsung device. Thanks for an other informative answer!
    – Davor Josipovic
    May 27, 2020 at 11:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .