<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000066" bgcolor="#FFFFFF">
On 03/19/2018 10:30 AM, Tobias Brunner wrote:<br>
<blockquote type="cite"
cite="mid:459289a4-9319-5b1e-8c14-dae6e8fd01a8@strongswan.org">
<pre wrap="">Hi,
</pre>
<blockquote type="cite">
<pre wrap="">I am not able to establish a connection with the Android app yet and so
have no proposed ciphers in my log.
</pre>
</blockquote>
<pre wrap="">
Did you check the server log?</pre>
</blockquote>
Sure. Please see "Re: [strongSwan] One to Many VPN (Host-Host)",
18/03/2018 17:08, this listserv.<br>
<br>
<blockquote type="cite"
cite="mid:459289a4-9319-5b1e-8c14-dae6e8fd01a8@strongswan.org">
<blockquote type="cite">
<pre wrap="">I infer that which ciphers are supported by the app depend on the
Android kernel, at least for encryption.
</pre>
</blockquote>
<pre wrap="">
No, IPsec is handled completely in userland by libipsec on Android.
</pre>
<blockquote type="cite">
<pre wrap="">How would I find out which
ones these are, currently?
</pre>
</blockquote>
<pre wrap="">
The default ESP proposal can be found in the source [1]. Which other
algorithms are usable depends on the enabled plugins and the algorithms
supported by the used version of OpenSSL/BoringSSL (you can check the
IKE proposals, which include all supported algorithms that are not too
weak).</pre>
</blockquote>
You seem to be saying that OpenSSL/BoringSSL
is installed in Android? How can it then be completely determined
in userland by libipsec on Android? I'm just trying to find out
what is supported so I can choose what I think are the best algos.
And I'd like to know.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:459289a4-9319-5b1e-8c14-dae6e8fd01a8@strongswan.org">
<blockquote type="cite">
<pre wrap="">PFS must be manually enabled, but which levels are currently supported
in the app?
</pre>
</blockquote>
<pre wrap="">
Don't know what you mean with levels. But you don't have to enable PFS
manually (unless you refer to the server config, where you do have to
configure DH groups), see default proposals above.</pre>
</blockquote>
I have in my Android notes: "<i>The IPsec proposal is limited to
AES encryption with SHA2/SHA1 data integrity or AES-GCM
authenticated encryption. Optionally, using PFS with one of a
number of proposed ECP/MODP DH groups.</i>"<br>
<br>
Apparently PFS must be manually enabled in ESP, but which groups are
currently supported in the app?<br>
<br>
<br>
<blockquote type="cite"
cite="mid:459289a4-9319-5b1e-8c14-dae6e8fd01a8@strongswan.org"><br>
<blockquote type="cite">
<pre wrap="">And is any form of ntru supported for encryption or key
exchange in the Android app?
</pre>
</blockquote>
<pre wrap="">
No.
</pre>
</blockquote>
In Android is this a limitation of libipsec or of OpenSSL/BoringSSL
(or of something else)?<br>
<br>
<br>
<br>
<br>
</body>
</html>