<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I have been testing StrongSwang with Ed25519 and Ed448 and found a roadblock:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I got the sample "Roadwarrior with virtual IP" with "pubkey" authentication scenario in the tutorials with Ed25519 keys without much problem (using "pki" to generate the keys/certificates). Due to lack of support for Ed448 keys in the "pki" tool, I followed
the document "<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Guide for building an EDDSA pki" [0] to first create a valid certificate chain
using Ed25519 that strongswan had no problem working with (after minimal modifications to the DN and subjectAltName values).</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">The problem appeared when I repeated the same steps to create an Ed448 certificate chain: while
the certificates and keys were created without problems, StrongSwan refuses to load the certificates or keys.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">StrongSwan 8.7.2 changelog [1] claims that the openssl plugin added support for both Ed25519 and
Ed448 keys and certificates for signing.<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">I am running Linux Ubuntu 18.04, with strongswan 8.4.2 compiled from sources and openssl plugin
enabled against the system OpenSSL 1.1.1<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Does working with Ed448 certificates require a special and inexistent module just like 25519 already
has? Is there any special step to force strongswan to use the openssl plugin to manage these certificates that I should follow?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Cheers,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Rodrigo.<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">[0]:
<a href="https://tools.ietf.org/html/draft-moskowitz-eddsa-pki-02" style="" id="LPNoLP844145">
https://tools.ietf.org/html/draft-moskowitz-eddsa-pki-02</a><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; line-height: normal; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">[1]:
<a href="https://www.strongswan.org/blog/2018/12/27/strongswan-5.7.2-released.html" style="" id="LPNoLP662364">
https://www.strongswan.org/blog/2018/12/27/strongswan-5.7.2-released.html</a></span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span>>swanctl --load-all<br>
</span>
<div>no files found matching '/etc/swanctl/conf.d/*.conf'<br>
</div>
<div>loading '/etc/swanctl/x509/moon.strongswan.org.cert.pem' failed: parsing X509 certificate failed<br>
</div>
<div>loading '/etc/swanctl/x509ca/intermediate.cert.pem' failed: parsing X509 certificate failed<br>
</div>
<div>loading '/etc/swanctl/x509ca/ca.cert.pem' failed: parsing X509 certificate failed<br>
</div>
<div>building CRED_PRIVATE_KEY - ANY failed, tried 9 builders<br>
</div>
<div>loaded private key from '/etc/swanctl/private/moon.strongswan.org.key.pem'<br>
</div>
<div>no authorities found, 0 unloaded<br>
</div>
<div>loaded pool 'rw_pool'<br>
</div>
<div>successfully loaded 1 pools, 0 unloaded<br>
</div>
<div>loaded connection 'rw'<br>
</div>
<div>successfully loaded 1 connections, 0 unloaded</div>
<div><br>
</div>
<div><br>
</div>
<div>><span>pki --print --in /etc/swanctl/x509ca/ca.cert.pem -v 4 <br>
</span>
<div> file content is not binary ASN.1<br>
</div>
<div> -----BEGIN CERTIFICATE-----<br>
</div>
<div> -----END CERTIFICATE----- <br>
</div>
<div>L0 - x509:<br>
</div>
<div>=> 618 bytes @ 0x55ae96c8c880<br>
</div>
<div> 0: 30 82 02 66 30 82 01 E6 A0 03 02 01 02 02 09 00 0..f0...........<br>
</div>
<div> 16: B8 A2 8D 65 18 AC D4 F6 30 05 06 03 2B 65 71 30 ...e....0...+eq0<br>
</div>
<span></span>...</div>
<div><span> 608: CE 3C 48 DB 2F DF 64 DF 1B 00 .<H./.d...<br>
</span>
<div>L1 - tbsCertificate:<br>
</div>
<div>=> 490 bytes @ 0x55ae96c8c884<br>
</div>
<div> 0: 30 82 01 E6 A0 03 02 01 02 02 09 00 B8 A2 8D 65 0..............e<br>
</div>
<div> 16: 18 AC D4 F6 30 05 06 03 2B 65 71 30 68 31 0B 30 ....0...+eq0h1.0<br>
</div>
...</div>
<div><span></span>
<div> 480: 75 74 69 6F 6E 73 2E 63 6F 6D utions.com<br>
</div>
<div>L2 - DEFAULT v1:<br>
</div>
<div>L3 - version:<br>
</div>
<div>=> 1 bytes @ 0x55ae96c8c88c <br>
</div>
<div> 0: 02 .<br>
</div>
<div> X.509v3<br>
</div>
<div>L2 - serialNumber:<br>
</div>
<div>=> 9 bytes @ 0x55ae96c8c88f <br>
</div>
<div> 0: 00 B8 A2 8D 65 18 AC D4 F6 ....e....<br>
</div>
<div>L2 - signature:<br>
</div>
<div>L3 - algorithmIdentifier: <br>
</div>
<div>L4 - algorithm:<br>
</div>
<div> 'id-Ed448'<br>
</div>
<div>L2 - issuer:<br>
</div>
<div>=> 106 bytes @ 0x55ae96c8c89f<br>
</div>
<div> 0: 30 68 31 0B 30 09 06 03 55 04 06 13 02 49 45 31 0h1.0...U....IE1<br>
</div>
...
<div> 96: 03 0C 07 52 6F 6F 74 20 43 41 ...Root CA<br>
</div>
<div> 'C=IE, ST=DU, L=Dun Laoghaire, O=Viavi, OU=protocols, CN=Root CA'<br>
</div>
<div>L2 - validity:<br>
</div>
<div>L3 - notBefore:<br>
</div>
<div>L4 - utcTime:<br>
</div>
<div> 'Jan 15 11:19:08 UTC 2020'<br>
</div>
<div>L3 - notAfter:<br>
</div>
<div>L4 - utcTime:<br>
</div>
<div> 'Jan 10 11:19:08 UTC 2040'<br>
</div>
<div>L2 - subject:<br>
</div>
<div>=> 106 bytes @ 0x55ae96c8c929<br>
</div>
<div> 0: 30 68 31 0B 30 09 06 03 55 04 06 13 02 49 45 31 0h1.0...U....IE1<br>
</div>
...
<div> 96: 03 0C 07 52 6F 6F 74 20 43 41 ...Root CA<br>
</div>
<div> 'C=IE, ST=DU, L=Dun Laoghaire, O=Viavi, OU=protocols, CN=Root CA'<br>
</div>
<div>L2 - subjectPublicKeyInfo: <br>
</div>
<div>-- > --<br>
</div>
<div>L0 - subjectPublicKeyInfo: <br>
</div>
<div>L1 - algorithm:<br>
</div>
<div>L2 - algorithmIdentifier: <br>
</div>
<div>L3 - algorithm:<br>
</div>
<div> 'id-Ed448'<br>
</div>
<div>-- < --<br>
</div>
<div>unsupported public key algorithm<br>
</div>
<span></span><span>OpenSSL X.509 parsing failed<br>
</span>
<div>building CRED_CERTIFICATE - X509 failed, tried 4 builders<br>
</div>
<div>parsing input failed<br>
</div>
<span></span><br>
</div>
<span></span><br>
</div>
</body>
</html>