topic Re: Need clarification on recommended Authentication Algorithm in Prisma Access Discussions

Need clarification on recommended Authentication Algorithm

devd_25 — Wed, 06 Nov 2019 03:32:43 GMT

Quoting from the docs for Define IPSec Crypto Profiles, it says

For the authentication algorithm, use SHA-256 or higher (SHA-384 or higher preferred for long-lived transactions). Do not use SHA-512, SHA-1, or MD5.

Whereas, going from most to least secure, it recommends the below order

Authentication—sha512, sha384, sha256, sha1, md5.

Can someone please help clarify what is right or wrong ? Thanks!

Re: Need clarification on recommended Authentication Algorithm

BatD — Wed, 06 Nov 2019 07:48:27 GMT

@devd_25 The second line shows what is supported on the firewall and the first what is recommended to use.

Re: Need clarification on recommended Authentication Algorithm

Sai_Tumuluri — Wed, 06 Nov 2019 13:28:47 GMT

@devd_25 Anything from SHA256 and above is secure. To use SHA-512 or SHA-384, you need to have compatible servers and are not widely used. Other reasons include processing time. Following public links can add some more info

https://security.stackexchange.com/questions/165559/why-would-i-choose-sha-256-over-sha-512-for-a-ssl-tls-certificate

https://automationrhapsody.com/md5-sha-1-sha-256-sha-512-speed-performance/

Re: Need clarification on recommended Authentication Algorithm

devd_25 — Thu, 07 Nov 2019 08:24:35 GMT

Hi @BatD , thats right. However, if you notice, first it says

Do not use SHA-512, SHA-1, or MD5.

Then, it recommends in the order of most to least secure starting with SHA-512, implying that SHA-512 is most secure. Hence, needed clarification on that. Might be a documentation error.

Re: Need clarification on recommended Authentication Algorithm

BatD — Thu, 07 Nov 2019 08:32:08 GMT

@devd_25 This is correct, SHA-512 is indeed the most secure, but not recommended for reasons mentioned by @Sai_Tumuluri - processing resources, comapability, etc.

Re: Need clarification on recommended Authentication Algorithm

Sai_Tumuluri — Fri, 08 Nov 2019 16:29:43 GMT

@devd_25 Please mark if you are satisfied with the solution. This closes the discussion and helps others to fastly identify the solutions