Re: [strongSwan] AH Transport AES CMAC PSK
Hi Andreas, I checked the loaded plugins and it contains cmac. Nonetheless, setting up the connection fails: root@atm:/etc/ipsec.d/examples# ipsec up host-host establishing CHILD_SA host-host generating CREATE_CHILD_SA request 0 [ N(USE_TRANSP) SA No TSi TSr ] sending packet: from 192.168.1.211[4500] to 192.168.1.212[4500] (192 bytes) received packet: from 192.168.1.212[4500] to 192.168.1.211[4500] (80 bytes) parsed CREATE_CHILD_SA response 0 [ N(NO_PROP) ] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built failed to establish CHILD_SA, keeping IKE_SA establishing connection 'host-host' failed root@atm:/etc/ipsec.d/examples# The log file is the same, what has been attached to my first mail. I have no idea. Best regards, Gyula root@atm:/etc/strongswan.d# ipsec listplugins List of loaded Plugins: charon: CUSTOM:libcharon NONCE_GEN CUSTOM:libcharon-sa-managers CUSTOM:libcharon-receiver CUSTOM:kernel-ipsec CUSTOM:kernel-net CUSTOM:libcharon-receiver HASHER:HASH_SHA1 RNG:RNG_STRONG CUSTOM:socket CUSTOM:libcharon-sa-managers HASHER:HASH_SHA1 RNG:RNG_WEAK aes: CRYPTER:AES_CBC-16 CRYPTER:AES_CBC-24 CRYPTER:AES_CBC-32 des: CRYPTER:3DES_CBC-24 CRYPTER:DES_CBC-8 CRYPTER:DES_ECB-8 rc2: CRYPTER:RC2_CBC-0 sha2: HASHER:HASH_SHA224 HASHER:HASH_SHA256 HASHER:HASH_SHA384 HASHER:HASH_SHA512 sha1: HASHER:HASH_SHA1 PRF:PRF_KEYED_SHA1 md5: HASHER:HASH_MD5 random: RNG:RNG_STRONG RNG:RNG_TRUE nonce: NONCE_GEN RNG:RNG_WEAK x509: CERT_ENCODE:X509 HASHER:HASH_SHA1 CERT_DECODE:X509 HASHER:HASH_SHA1 PUBKEY:ANY CERT_ENCODE:X509_AC CERT_DECODE:X509_AC CERT_ENCODE:X509_CRL CERT_DECODE:X509_CRL CERT_ENCODE:OCSP_REQUEST HASHER:HASH_SHA1 RNG:RNG_WEAK CERT_DECODE:OCSP_RESPONSE CERT_ENCODE:PKCS10_REQUEST CERT_DECODE:PKCS10_REQUEST revocation: CUSTOM:revocation CERT_ENCODE:OCSP_REQUEST (soft) CERT_DECODE:OCSP_RESPONSE (soft) CERT_DECODE:X509_CRL (soft) CERT_DECODE:X509 (soft) FETCHER:(null) (soft) constraints: CUSTOM:constraints CERT_DECODE:X509 (soft) pubkey: CERT_ENCODE:PUBKEY CERT_DECODE:PUBKEY PUBKEY:RSA (soft) PUBKEY:ECDSA (soft) PUBKEY:DSA (soft) pkcs1: PRIVKEY:ANY PRIVKEY:RSA (soft) PRIVKEY:ECDSA (soft) PRIVKEY:RSA PUBKEY:ANY PUBKEY:RSA (soft) PUBKEY:ECDSA (soft) PUBKEY:DSA (soft) PUBKEY:RSA pkcs7: CONTAINER_DECODE:PKCS7 CONTAINER_ENCODE:PKCS7_DATA CONTAINER_ENCODE:PKCS7_SIGNED_DATA CONTAINER_ENCODE:PKCS7_ENVELOPED_DATA pkcs8: PRIVKEY:ANY PRIVKEY:RSA PRIVKEY:ECDSA pkcs12: CONTAINER_DECODE:PKCS12 CONTAINER_DECODE:PKCS7 CERT_DECODE:X509 (soft) PRIVKEY:ANY (soft) HASHER:HASH_SHA1 (soft) CRYPTER:3DES_CBC-24 (soft) CRYPTER:RC2_CBC-0 (soft) pgp: PRIVKEY:ANY PRIVKEY:RSA PUBKEY:ANY PUBKEY:RSA CERT_DECODE:PGP dnskey: PUBKEY:ANY PUBKEY:RSA sshkey: PUBKEY:ANY CERT_DECODE:PUBKEY pem: PRIVKEY:ANY PRIVKEY:ANY HASHER:HASH_MD5 (soft) PRIVKEY:RSA PRIVKEY:RSA HASHER:HASH_MD5 (soft) PRIVKEY:ECDSA PRIVKEY:ECDSA HASHER:HASH_MD5 (soft) PRIVKEY:DSA (not loaded) PRIVKEY:DSA HASHER:HASH_MD5 (soft) PRIVKEY:BLISS (not loaded) PRIVKEY:BLISS PUBKEY:ANY PUBKEY:ANY PUBKEY:RSA PUBKEY:RSA PUBKEY:ECDSA PUBKEY:ECDSA PUBKEY:DSA (not loaded) PUBKEY:DSA PUBKEY:BLISS CERT_DECODE:ANY CERT_DECODE:X509 (soft) CERT_DECODE:PGP (soft) CERT_DECODE:X509 CERT_DECODE:X509 CERT_DECODE:X509_CRL CERT_DECODE:X509_CRL CERT_DECODE:OCSP_REQUEST (not loaded) CERT_DECODE:OCSP_REQUEST CERT_DECODE:OCSP_RESPONSE CERT_DECODE:OCSP_RESPONSE CERT_DECODE:X509_AC CERT_DECODE:X509_AC CERT_DECODE:PKCS10_REQUEST CERT_DECODE:PKCS10_REQUEST CERT_DECODE:PUBKEY CERT_DECODE:PUBKEY CERT_DECODE:PGP CERT_DECODE:PGP CONTAINER_DECODE:PKCS12 CONTAINER_DECODE:PKCS12 openssl: CUSTOM:openssl-threading CRYPTER:AES_CBC-16 CRYPTER:AES_CBC-24 CRYPTER:AES_CBC-32 CRYPTER:CAMELLIA_CBC-16 CRYPTER:CAMELLIA_CBC-24 CRYPTER:CAMELLIA_CBC-32 CRYPTER:CAST_CBC-0 CRYPTER:BLOWFISH_CBC-0 CRYPTER:3DES_CBC-24 CRYPTER:DES_CBC-8 CRYPTER:DES_ECB-8 CRYPTER:NULL-0 HASHER:HASH_MD4 HASHER:HASH_MD5 HASHER:HASH_SHA1 HASHER:HASH_SHA224 HASHER:HASH_SHA256 HASHER:HASH_SHA384 HASHER:HASH_SHA512 PRF:PRF_KEYED_SHA1 PRF:PRF_HMAC_MD5 PRF:PRF_HMAC_SHA1 PRF:PRF_HMAC_SHA2_256 PRF:PRF_HMAC_SHA2_384 PRF:PRF_HMAC_SHA2_512
Re: [strongSwan] AH Transport AES CMAC PSK
Hi Gyula, the Linux kernel does not support AES_CMAC but strongSwan has IKE support via the cmac plugin which is enabled by default. Regards Andreas On 27.11.2016 14:46, Gyula Kovács wrote: > Hello, > > I tried to set up an ikev2/host2host-ah connectionwith pre-shared key. > The connection failed, when choosing aescmac as integrity algorithm. > The connection was successfully built up when choosing aesxcbc integrity > algorithm. > I tried this scenario on two Debian 8.6 VMs (kernel 3.16.0-4-586 with > CONFIG_CRYPTO_CMAC=m option set) with the latest StrongSwan (v5.5.1). > I checked the log files, and found "algorithm AES_CMAC_96 not supported > by kernel!" message. > Additionally, I found that AES-CMAC-96 is not supported by StrongSwan > (https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards). > > From where comes this limitation? > Does it come from StrongSwan implementation or from Linux kernel (as > suggested by the error message)? > Does anybody have ideas? > > Best regards, > Gyula Kovacs == Andreas Steffen andreas.stef...@strongswan.org strongSwan - the Open Source VPN Solution! www.strongswan.org Institute for Internet Technologies and Applications University of Applied Sciences Rapperswil CH-8640 Rapperswil (Switzerland) ===[ITA-HSR]== smime.p7s Description: S/MIME Cryptographic Signature ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users
[strongSwan] AH Transport AES CMAC PSK
Hello, I tried to set up an ikev2/host2host-ah connectionwith pre-shared key. The connection failed, when choosing aescmac as integrity algorithm. The connection was successfully built up when choosing aesxcbc integrity algorithm. I tried this scenario on two Debian 8.6 VMs (kernel 3.16.0-4-586 with CONFIG_CRYPTO_CMAC=m option set) with the latest StrongSwan (v5.5.1). I checked the log files, and found "algorithm AES_CMAC_96 not supported by kernel!" message. Additionally, I found that AES-CMAC-96 is not supported by StrongSwan (https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards). From where comes this limitation? Does it come from StrongSwan implementation or from Linux kernel (as suggested by the error message)? Does anybody have ideas? Best regards, Gyula Kovacs # /etc/ipsec.conf - strongSwan IPsec configuration file config setup conn %default ikelifetime=25m keylife=10m rekeymargin=3m keyingtries=%forever keyexchange=ikev2 authby=secret conn host-host left=192.168.1.211 leftfirewall=yes right=192.168.1.212 type=transport # ah=aesxcbc! ah=aescmac auto=start closeaction=hold dpdaction=hold # /etc/ipsec.conf - strongSwan IPsec configuration file config setup conn %default ikelifetime=25m keylife=10m rekeymargin=3m keyingtries=%forever keyexchange=ikev2 authby=secret conn host-host left=192.168.1.212 leftfirewall=yes right=192.168.1.211 type=transport # ah=aesxcbc! ah=aescmac auto=start closeaction=hold dpdaction=hold Nov 27 11:11:08 mgu charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.5.1, Linux 3.16.0-4-586, i686) Nov 27 11:11:08 mgu charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts' Nov 27 11:11:08 mgu charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts' Nov 27 11:11:08 mgu charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts' Nov 27 11:11:08 mgu charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts' Nov 27 11:11:08 mgu charon: 00[CFG] loading crls from '/etc/ipsec.d/crls' Nov 27 11:11:08 mgu charon: 00[CFG] loading secrets from '/etc/ipsec.secrets' Nov 27 11:11:08 mgu charon: 00[CFG] loading secrets from '/var/lib/strongswan/ipsec.secrets.inc' Nov 27 11:11:08 mgu charon: 00[CFG] loading secrets from '/etc/ipsec.d/examples/ipsec.secrets.mgu' Nov 27 11:11:08 mgu charon: 00[CFG] loaded IKE secret for %any Nov 27 11:11:08 mgu charon: 00[LIB] loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc cmac hmac gcm curl sqlite attr kernel-netlink resolve socket-default stroke vici updown xauth-generic Nov 27 11:11:08 mgu charon: 00[JOB] spawning 16 worker threads Nov 27 11:11:08 mgu charon: 05[CFG] received stroke: add connection 'host-host' Nov 27 11:11:08 mgu charon: 05[CFG] added configuration 'host-host' Nov 27 11:11:08 mgu charon: 09[CFG] received stroke: initiate 'host-host' Nov 27 11:11:08 mgu charon: 09[IKE] initiating IKE_SA host-host[1] to 192.168.1.211 Nov 27 11:11:08 mgu charon: 09[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] Nov 27 11:11:08 mgu charon: 09[NET] sending packet: from 192.168.1.212[500] to 192.168.1.211[500] (1156 bytes) Nov 27 11:11:09 mgu charon: 15[NET] received packet: from 192.168.1.211[500] to 192.168.1.212[500] (592 bytes) Nov 27 11:11:09 mgu charon: 15[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ] Nov 27 11:11:09 mgu charon: 15[IKE] authentication of '192.168.1.212' (myself) with pre-shared key Nov 27 11:11:09 mgu charon: 15[IKE] establishing CHILD_SA host-host Nov 27 11:11:09 mgu charon: 15[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH N(USE_TRANSP) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ] Nov 27 11:11:09 mgu charon: 15[NET] sending packet: from 192.168.1.212[4500] to 192.168.1.211[4500] (336 bytes) Nov 27 11:11:09 mgu charon: 11[NET] received packet: from 192.168.1.211[4500] to 192.168.1.212[4500] (160 bytes) Nov 27 11:11:09 mgu charon: 11[ENC] parsed IKE_AUTH response 1 [ IDr AUTH N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) N(NO_PROP) ] Nov 27 11:11:09 mgu charon: 11[IKE] authentication of '192.168.1.211' with pre-shared key successful Nov 27 11:11:09 mgu charon: 11[IKE] IKE_SA host-host[1] established between 192.168.1.212[192.168.1.212]...192.168.1.211[192.168.1.211] Nov 27 11:11:09 mgu charon: 11[IKE] scheduling reauthentication in 1300s Nov 27 11:11:09 mgu charon: 11[IKE] maximum IKE_SA lifetime 1480s Nov 27 11:11:09 mgu charon: 11[IKE] received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built Nov 27
