While preshared keys, which are unique to each user, are fine when employed by a small number of users, deploying a unique key for each remote user in situations where there may be hundreds or thousands of remote users can be an administrative burden and a management nightmare. For simplicity, some companies deploy one key that is shared among all users. However, if the password is compromised, every user name must be associated with the new key. When deploying IPSec with IKE to many users, digital certificates are the most scalable option for enterprise security. However, a full PKI environment, which can be costly to implement and complex to deploy, is required.
Enrollment can be disruptive and add many opportunities for error.
Certain VPN implementations of Hybrid Auth are enabling companies to solve some of these issues by leveraging legacy authentication systems and by allowing the use of a PKI to be centrally deployed and managed in practical implementation phases, rather than all at once. Because there's no change in how remote users authenticate, this Hybrid Authentication environment simplifies initial digital certificate deployment, controls operational expenses, and minimizes end-user impact. The Hybrid Auth extension allows the asymmetric use of digital certificates between client and server. Companies benefit from the interoperability of standards-based IPSec with IKE as well as the increased security of the PKI at the central site, with no disruption to remote users. The XAuth standard may be seen as the next phase of PKI migration.