<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi Andreas,</div>
<div><font size="2"><span style="font-size:10.5pt;">Noel suggested me to rearrange the order of plugins being loaded and it worked if I loaded hmac plugin before opensssl plugin. Please let me know if there is a fix for openssl since changing the load order
of plugin is not recommended. </span></font></div>
<div><font size="2"><span style="font-size:10.5pt;"> </span></font></div>
<div><font size="2"><span style="font-size:10.5pt;">Thanks!</span></font></div>
<div><font size="2"><span style="font-size:10.5pt;">Bettina</span></font></div>
<div> </div>
<div><font size="2"><span style="font-size:10.5pt;">To answer your question, <font size="2"><span style="font-size:11pt;">I was able to load sha2 plugin successfully. In the log it shows the following. </span></font></span></font></div>
<div> </div>
<div> </div>
<div>Mar 27 10:15:30 00[LIB] loading feature PRF:PRF_HMAC_SHA2_256 in plugin 'openssl'</div>
<div>Mar 27 10:15:30 00[LIB] loading feature PRF:PRF_HMAC_SHA2_384 in plugin 'openssl'</div>
<div>Mar 27 10:15:30 00[LIB] loading feature PRF:PRF_HMAC_SHA2_512 in plugin 'openssl'</div>
<div> </div>
<div>Here is the information from ipsec statusall that I sent earlier.</div>
<div> </div>
<div>List of registered IKE algorithms:</div>
<div> </div>
<div> encryption: DES_CBC[des] 3DES_CBC[des] IDEA_CBC[openssl] CAST_CBC[openssl] BLOWFISH_CBC[openssl] NULL[openssl]</div>
<div> AES_CBC[aes] CAMELLIA_CBC[openssl] DES_ECB[des] RC2_CBC[rc2]</div>
<div> integrity: HMAC_MD5_96[openssl] HMAC_SHA1_96[openssl] AES_XCBC_96[xcbc] HMAC_MD5_128[openssl] HMAC_SHA1_160[openssl]</div>
<div> AES_CMAC_96[cmac] HMAC_SHA2_256_128[openssl] HMAC_SHA2_384_192[openssl] HMAC_SHA2_512_256[openssl]</div>
<div> HMAC_SHA1_128[openssl] HMAC_SHA2_256_256[openssl] HMAC_SHA2_384_384[openssl] HMAC_SHA2_512_512[openssl]</div>
<div> CAMELLIA_XCBC_96[xcbc]</div>
<div> aead: AES_GCM_8[openssl] AES_GCM_12[openssl] AES_GCM_16[openssl]</div>
<div> hasher: HASH_MD4[openssl] HASH_MD5[md5] HASH_SHA1[sha1] HASH_SHA224[sha2] HASH_SHA256[sha2] HASH_SHA384[sha2]</div>
<div> HASH_SHA512[sha2]</div>
<div> prf: PRF_HMAC_MD5[openssl] PRF_HMAC_SHA1[openssl] PRF_AES128_XCBC[xcbc] PRF_HMAC_SHA2_256[openssl]</div>
<div> PRF_HMAC_SHA2_384[openssl] PRF_HMAC_SHA2_512[openssl] PRF_AES128_CMAC[cmac] PRF_FIPS_SHA1_160[fips-prf]</div>
<div> PRF_KEYED_SHA1[sha1] PRF_CAMELLIA128_XCBC[xcbc]</div>
<div> dh-group: MODP_768[openssl] MODP_1024[openssl] MODP_1536[openssl] MODP_2048[openssl] MODP_3072[openssl]</div>
<div> MODP_4096[openssl] MODP_6144[openssl] MODP_8192[openssl] ECP_256[openssl] ECP_384[openssl]</div>
<div> ECP_521[openssl] MODP_1024_160[openssl] MODP_2048_224[openssl] MODP_2048_256[openssl] ECP_192[openssl]</div>
<div> ECP_224[openssl] ECP_224_BP[openssl] ECP_256_BP[openssl] ECP_384_BP[openssl] ECP_512_BP[openssl]</div>
<div> MODP_CUSTOM[openssl]</div>
<div> random-gen: RNG_WEAK[openssl] RNG_STRONG[random] RNG_TRUE[random]</div>
<div> nonce-gen: [nonce]</div>
<div> </div>
<div>-----Original Message-----<br>
From: Andreas Steffen [<a href="mailto:andreas.steffen@strongswan.org">mailto:andreas.steffen@strongswan.org</a>]
<br>
Sent: Friday, March 27, 2015 5:01 PM<br>
To: Ko, HsuenJu; users@lists.strongswan.org<br>
Subject: Re: [strongSwan] failure with ike using sha2</div>
<div> </div>
<div>Hi Bettina,</div>
<div> </div>
<div>are you sure that you loaded the sha2 plugin because the HMAC-SHA2</div>
<div>algorithms for the prf_plus seem to fail. ipsec statusall should list</div>
<div>the sha2 plugin.</div>
<div> </div>
<div>Regards</div>
<div> </div>
<div>Andreas</div>
<div> </div>
<div>On 03/27/2015 04:05 PM, Ko, HsuenJu wrote:</div>
<div>> Hi ,</div>
<div>> </div>
<div>> I got error of “key derivation failed” when I configured ike using sha2.</div>
<div>> I don’t have problem with md5 or sha1. And I am using strongswan</div>
<div>> 5.1.1. Here is the corresponding log. Can someone tell me what I did</div>
<div>> wrong or is this a bug?</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> Thanks!</div>
<div>> </div>
<div>> Bettina</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> ike=aes128-sha256-modp2048!</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> Mar 27 10:15:41 11[IKE] SKEYSEED => 32 bytes @ 0x41c89760</div>
<div>> </div>
<div>> Mar 27 10:15:41 11[IKE] 0: 40 06 D6 2C 40 06 D8 24 40 F5 00 20 41 C7</div>
<div>> BB 20 @..,@..$@.. A..</div>
<div>> </div>
<div>> Mar 27 10:15:41 11[IKE] 16: 00 00 00 00 00 00 00 00 00 00 00 00 00 00</div>
<div>> 00 00 ................</div>
<div>> </div>
<div>> Mar 27 10:15:41 11[IKE] key derivation failed</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> ike=aes128-sha384-modp2048!</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> Mar 27 10:46:03 09[IKE] SKEYSEED => 48 bytes @ 0x41c8bf70</div>
<div>> </div>
<div>> Mar 27 10:46:03 09[IKE] 0: 43 36 20 31 35 20 31 34 20 30 42 20 38 38</div>
<div>> 20 36 C6 15 14 0B 88 6</div>
<div>> </div>
<div>> Mar 27 10:46:03 09[IKE] 16: 46 20 43 38 20 38 45 20 35 34 20 42 44 20</div>
<div>> 38 42 F C8 8E 54 BD 8B</div>
<div>> </div>
<div>> Mar 27 10:46:03 09[IKE] 32: 20 31 46 20 32 38 20 36 44 20 33 41 20 20</div>
<div>> 2E 2E 1F 28 6D 3A ..</div>
<div>> </div>
<div>> Mar 27 10:46:03 09[IKE] key derivation failed</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> ike=aes128-sha512-modp2048!</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> Mar 27 10:48:17 09[IKE] SKEYSEED => 64 bytes @ 0x41c8bf70</div>
<div>> </div>
<div>> Mar 27 10:48:17 09[IKE] 0: 31 45 20 38 33 20 31 33 20 38 39 20 31 36</div>
<div>> 20 34 1E 83 13 89 16 4</div>
<div>> </div>
<div>> Mar 27 10:48:17 09[IKE] 16: 36 20 35 32 20 32 30 20 39 34 20 31 43 20</div>
<div>> 44 36 6 52 20 94 1C D6</div>
<div>> </div>
<div>> Mar 27 10:48:17 09[IKE] 32: 20 38 39 20 37 38 20 42 43 20 39 41 20 20</div>
<div>> 69 2E 89 78 BC 9A i.</div>
<div>> </div>
<div>> Mar 27 10:48:17 09[IKE] 48: 2E 2E 2E 2E 46 52 20 2E 2E 2E 2E 78 2E 2E</div>
<div>> 0A 20 ....FR ....x...</div>
<div>> </div>
<div>> Mar 27 10:48:17 09[IKE] key derivation failed</div>
<div>> </div>
<div>> </div>
<div>> </div>
<div>> _______________________________________________</div>
<div>> Users mailing list</div>
<div>> <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a></div>
<div>> <a href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></div>
<div>> </div>
<div> </div>
<div> </div>
<div>-- </div>
<div>======================================================================</div>
<div>Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a></div>
<div>strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org">www.strongswan.org</a></div>
<div>Institute for Internet Technologies and Applications</div>
<div>University of Applied Sciences Rapperswil</div>
<div>CH-8640 Rapperswil (Switzerland)</div>
<div>===========================================================[ITA-HSR]==</div>
<div> </div>
<div> </div>
</span></font>
</body>
</html>