<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Martin and Tobias,</span></div><div><span></span> </div><div><span>Thank you both once again for quick analysis.</span></div><div><span>Yes, the debug was definitely indicating not being compliant with the PKCS#1 standard.</span></div><div><span></span> </div><div><span>I will re-check with our hardware vendor on invalid key as they are not seeing this issue with the keys generated by the same driver they provided to us.</span></div><div><span></span> </div><div><span>Our hardware vendor had recommended recently that we disable the openssl plugin for some buggy issues(sorry, don't have the specifics yet) regarding Strongswan openssl plugin, OCF and Linux 2.6.33.5. They are able to bring up IPsec tunnel with public key certificate authentication using much earlier
strongswan 4.3.6 version + Linux 2.6.33.5 + OCF + openssl cryptodev engine and h/w driver acceleration. They are currently not supporting an upgrade to 5.0.1. That's the only variable difference on my setup and the vendors setup.</span></div><div> </div><div>Are there are any known issues using 5.0.1 version + openssl0.9.8q + OCF + kernel 2.6.33.5?</div><div>This is what we are using in our setup, in addition to hardware vendor's driver code for acceleration.</div><div> </div><div>Kiran</div><div> </div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> <div style="margin: 5px 0px; padding: 0px; border: 1px solid rgb(204, 204, 204); height: 0px; line-height: 0; font-size: 0px;" class="hr" contentEditable="false" readonly="true"></div> <b><span
style="font-weight: bold;">From:</span></b> Martin Willi <martin@strongswan.org><br> <b><span style="font-weight: bold;">To:</span></b> Kiran Joshi <kiran.joshi38@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "users@lists.strongswan.org" <users@lists.strongswan.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, January 24, 2013 2:59 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] Unable to load the private key without openssl plugin<br> </font> </div> <br>
Hi Kiran,<br><br>> 00[LIB] key integrity tests failed: chect that exp1(150380) is d(150368) mod (p(150344)-1), t=-1097449556<br>> 00[LIB] key integrity tests failed: checkt that exp2(150392) is d(150368) mod (q(150356)-1), t=-1097449556<br><br>Seems like this key is definitely invalid. By definition in PKCS#1:<br> exponent1 is d mod (p - 1)<br> exponent2 is d mod (q - 1)<br><br>But in your key, this is not the case.<br> <br>> is created with the openssl -engine cryptodev (OCF + h/w driver) option.<br><br>Looks like a bug to me in your hardware or driver.<br><br>> works fine for our SIP TLS <br><br>This is absolutely possible, for example if it regenerates the<br>exponents. Nonetheless, the key is not valid according to PKCS#1.<br><br>Regards<br>Martin<br><br><br><br> </div> </div> </div></body></html>