Libreswan supports the following authentication methods:

Pre-Shared key

The Pre-Shared Key (PSK) method uses the same secret on both endpoints. Each endpoint authenticates the other endpoint. PSKs are simple and broadly compatible. They are suitable for small-scale deployments. However, managing PSKs is risky if you reuse the key or do not rotate it frequently. For security, PSKs must have more than 64 random characters. On hosts in FIPS mode, PSKs must meet FIPS strength requirements.

Raw RSA key

This method uses an RSA public and private key pair on each peer for mutual identification. Raw RSA keys provide stronger security than PSKs and are ideal for environments where a full certificate infrastructure is not required.

X.509 certificates

This method uses X.509 certificates from a trusted Certificate Authority (CA). Each peer proves its identity with its certificate and private key. The other peer verifies the certificate against the trusted CA. This method provides the highest level of security and scalability for large enterprises. However, it is more complex. You must deploy and maintain a public key infrastructure (PKI).

NULL authentication

This method provides only encryption with no authentication between peers. Because it does not verify the identity of the remote endpoint, NULL authentication is insecure and offers no protection against man-in-the-middle attacks.

Protection against quantum computers

PPKs are not a standalone authentication method. Libreswan offers them to protect modern IKEv2 connections from attacks by quantum computers. This feature is necessary because the older IKEv1 protocol and standard IKEv2 are not quantum-resistant on their own. A PPK adds another layer of security on top of the primary authentication method. PPK security depends on using a cryptographically strong key. Distribute this key securely through an external communication channel.