I want to better understand the Identity Protection portion of Phase 1 of the (6) frame ISAKMP Exchange
Per the model offered at Network Lessons (https://networklessons.com/cisco/ccie-routing-switching/ipsec-internet-protocol-security), the first step in Phase 1 is the Negotiation step, in which the two sides agree on things like a Hashing Algorithm and Key Lifetime. The second step involves determining the strength of the key to be used: picking a Diffie-Hellman group. And the third step involves Authentication: demonstrating to each other that we are who we claim to be.
I believe that the particular conversation I'm debugging succeeds at Step 1 and Step 2 but fails in Step 3. So i want to examine this step in more detail. Regrettably, the protocol exchange in this step is encrypted. I have a model for what this protocol exchange looks like (https://devcentral.f5.com/s/articles/understanding-ikev1-negotiation-on-wireshark-34187), but I want to see the specifics of this conversation's exchange. So I am turning to Wireshark's ability to decrypt ISAKMP IKEv1 frames, given the Initiator's Cookie and Encryption Key, as described in https://osqa-ask.wireshark.org/questions/12019/how-can-i-decrypt-ikev1-andor-esp-packets
In Wireshark, I have follows the path: Preferences... Protocols... ISAKMP... IKEv1 Decryption Table... Edit... +... and entered the Initiator's SPI in the "Initiator's COOKIE" field. In the Encryption Field, I tried entering a hex version of the Pre-Shared Key, but that didn't work: the "Encrypted Data" portion of the 5th Frame (the beginning of the Authentication exchange) remains encrypted.
I have a suspicion that Wireshark doesn't want the actual Pre-Shared Key here; rather, I have a suspicion that it wants a derivative of the PSK, produced by the Initiator and stored on the Initiator.
Question #1: I have a Windows 10 Client: would anyone know how to extract the Encryption Key (derived from the PSK) from the Windows 10 Client?
Question #2: Would anyone have suggestions for further reading (education) about how the first (6) frames of the ISAKMP exchange works, in addition to the ones I reference above?
Question #3: Would anyone have suggestions around what might be failing in this particular conversation? I post the pcap to CloudShark -- see Comments & Annotations for my analysis thus far: https://www.cloudshark.org/captures/fd0832453f6d
--sk
