<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Courier New">Hello,<br>
<br>
I tried to set up an </font><font face="Courier New">ikev2/host2host-ah
connection</font><font face="Courier New"> with pre-shared key.<br>
The connection failed, when choosing aescmac as integrity
algorithm.<br>
The connection was successfully built up when choosing aesxcbc
integrity algorithm.<br>
I tried this scenario on two Debian 8.6 VMs (kernel 3.16.0-4-586
with CONFIG_CRYPTO_CMAC=m option set) with the latest StrongSwan
(v5.5.1).<br>
I checked the log files, and found "algorithm AES_CMAC_96 not
supported by kernel!" message.<br>
Additionally, I found that AES-CMAC-96 is not supported by
StrongSwan
(<a class="moz-txt-link-freetext" href="https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards">https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards</a>).<br>
<br>
From where comes this limitation?<br>
Does it come from StrongSwan implementation or from Linux kernel
(as suggested by the error message)?<br>
Does anybody have ideas?<br>
<br>
Best regards,<br>
Gyula Kovacs<br>
</font><br>
</body>
</html>