[strongSwan] EC Use on and Android
Matt Link
matt.link at cyverone.com
Wed Jun 20 02:55:58 CEST 2012
Hi Andreas,
You were correct. Once I enabled OpenSSL on the Linux box those problems
went away on my Linux boxes. However, what I am trying to do is change my
strongSwan IPSec connections between the server and my road warriors to be
Suite B compliant. So I created a set of ECDSA keys and certificates. When
I restart IPSec on the Linux server I receive no errors. However, on the
Android I get the following:
I/charon ( 2866): 00[CFG] loading ca certificates from
'/system/etc/ipsec.d/cacerts'
I/charon ( 2866): 00[CFG] loaded ca certificate "C=US, ST=CA, L=Irvine,
O=CyverONE, OU=Information Services, CN=IS, N=IS,
E=administrator at cyverone.com" from
'/system/etc/ipsec.d/cacerts/caCyCert.pem'
I/charon ( 2866): 00[CFG] loading aa certificates from
'/system/etc/ipsec.d/aacerts'
I/charon ( 2866): 00[CFG] loading ocsp signer certificates from
'/system/etc/ipsec.d/ocspcerts'
I/charon ( 2866): 00[CFG] loading attribute certificates from
'/system/etc/ipsec.d/acerts'
I/charon ( 2866): 00[CFG] loading crls from '/system/etc/ipsec.d/crls'
I/charon ( 2866): 00[CFG] loading secrets from '/system/etc/ipsec.secrets'
I/charon ( 2866): 00[LIB] building CRED_PRIVATE_KEY - ECDSA failed, tried 1
builders
I/charon ( 2866): 00[CFG] loading private key from
'/system/etc/ipsec.d/private/keyCyECRmt01.pem' failed
I/charon ( 2866): 00[DMN] loaded plugins: openssl fips-prf random pubkey
pkcs1 pem xcbc hmac kernel-netlink socket-raw android stroke eap-identity
eap-mschapv2 eap-md5
I/charon ( 2866): 00[JOB] spawning 16 worker threads
I/charon ( 2866): 09[CFG] received stroke: add connection 'home01'
I/charon ( 2866): 09[LIB] OpenSSL X.509 parsing failed
I/charon ( 2866): 09[LIB] building CRED_CERTIFICATE - ANY failed, tried 1
builders
I/charon ( 2866): 09[CFG] loading certificate from 'crtCyECRmt01.pem'
failed
I/charon ( 2866): 09[CFG] added configuration 'home01'
I/charon ( 2866): 10[CFG] received stroke: initiate 'home01'
I/charon ( 2866): 10[IKE] initiating IKE_SA home01[1] to 68.225.28.68
I/charon ( 2866): 10[IKE] configured DH group ECP_256 not supported
I/charon ( 2866): 10[MGR] tried to check-in and delete nonexisting IKE_SA
As we can see, I have three problems; It doesn't like my key, it doesn't
like my certificate, and it doesn't like the DH group specification. When I
do an ipsec statusall I get:
ipsec statusall
Status of IKEv2 charon daemon (strongSwan 4.6.2):
uptime: 21 seconds, since Jun 20 00:24:11 2012
worker threads: 8 of 16 idle, 7/1/0/0 working, job queue: 0/0/0/0,
scheduled: 0
loaded plugins: openssl fips-prf random pubkey pkcs1 pem xcbc hmac
kernel-netlink socket-raw android stroke eap-identity eap-mschapv2 eap-md5
Listening IP addresses:
2600:1010:8004:783e:0:9:40aa:ca01
xx.xxx.xx.xx
2600:100e:b011:d63c:0:8:73c4:f001
xx.xxx.xxx.xxx
Connections:
home01: xx.xxx.xxx.xx...xx.xxx.xx.xx
home01: local: [rmt01ec at cyverone.com] uses public key
authentication
home01: remote: [C=US, ST=CA, L=Irvine, O=CyverONE, OU=Information
Services, CN=IS, N=IS, E=administrator at cyverone.com] uses any authentication
home01: child: dynamic === 10.20.0.0/16 TUNNEL
Security Associations (0 up, 0 connecting):
none
I/charon ( 2717): 10[IKE] configured DH group ECP_256 not supported
I/charon ( 2717): 10[MGR] tried to check-in and delete nonexisting IKE_SA
And an ipsec listalgs shows:
ipsec listalgs
List of registered IKEv2 Algorithms:
encryption: AES_CBC[openssl] CAMELLIA_CBC[openssl] BLOWFISH_CBC[openssl]
3DES_CBC[openssl] DES_CBC[openssl]
DES_ECB[openssl] NULL[openssl]
integrity: CAMELLIA_XCBC_96[xcbc] AES_XCBC_96[xcbc] HMAC_SHA1_96[hmac]
HMAC_SHA1_128[hmac] HMAC_SHA1_160[hmac]
HMAC_MD5_96[hmac] HMAC_MD5_128[hmac] HMAC_SHA2_256_128[hmac]
HMAC_SHA2_256_256[hmac]
HMAC_SHA2_384_192[hmac] HMAC_SHA2_384_384[hmac]
HMAC_SHA2_512_256[hmac]
aead:
hasher: HASH_SHA1[openssl] HASH_MD4[openssl] HASH_MD5[openssl]
HASH_SHA224[openssl] HASH_SHA256[openssl]
HASH_SHA384[openssl] HASH_SHA512[openssl]
prf: PRF_KEYED_SHA1[openssl] PRF_FIPS_SHA1_160[fips-prf]
PRF_AES128_XCBC[xcbc] PRF_CAMELLIA128_XCBC[xcbc]
PRF_HMAC_SHA1[hmac] PRF_HMAC_MD5[hmac] PRF_HMAC_SHA2_256[hmac]
PRF_HMAC_SHA2_384[hmac]
PRF_HMAC_SHA2_512[hmac]
dh-group: MODP_2048[openssl] MODP_2048_224[openssl]
MODP_2048_256[openssl] MODP_1536[openssl] MODP_3072[openssl]
MODP_4096[openssl] MODP_6144[openssl] MODP_8192[openssl]
MODP_1024[openssl] MODP_1024_160[openssl]
MODP_768[openssl] MODP_CUSTOM[openssl]
random-gen: RNG_STRONG[random] RNG_TRUE[random]
My config files follow:
ipsec.conf
config setup
crlcheckinterval=180
strictcrlpolicy=no
plutostart=no
charondebug="ike 3, knl 3, cfg 3"
#
# This section contains Default configuration parameters.
#
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
ike=aes128-sha256-ecp256!
esp=aes128gcm16!
#
# Next comes the Connection Specific configuration.
#
conn home01
left=%defaultroute
leftsourceip=%config
leftcert=crtCyECRmt01.pem
leftid=rmt01ec at cyverone.com
leftfirewall=yes
right=xx.xxx.xx.xx
rightsubnet=10.20.0.0/16
rightid="C=US, ST=CA, L=Irvine, O=CyverONE, OU=Information
Services, CN=IS, N=IS, E=administrator at cyverone.com"
auto=start
ipsec.secrets
: ECDSA keyCyECRmt01.pem
Clearly, the ECP algorithms are missing even though the OpenSSL plugin
appears to be loading. I believe this to be a problem with the way I have
compiled strongSwan for the android but I'm not sure where I went wrong.
Hopefully you will have some insights.
Thanks,
Matt
-----Original Message-----
From: Andreas Steffen [mailto:andreas.steffen at strongswan.org]
Sent: Monday, June 18, 2012 9:10 PM
To: Matt Link
Cc: users at lists.strongswan.org
Subject: Re: [strongSwan] Error Creating ECDSA with PKI
Hi Matt,
did you enable the openssl plugin (./configure --enable-openssl)?
If yes, your OpenSSL library might have ECC disabled.
Regards
Andreas
On 06/19/2012 01:05 AM, Matt Link wrote:
> Hi All,
>
>
>
> When I run the command:
>
>
>
> pki --gen --type ecdsa --size 256 > myKey.der
>
>
>
> I get the following error:
>
>
>
> building CRED_PRIVATE_KEY - ECDSA failed, tried 1 builders
>
>
>
> I'm running strongSwan 4.5.3. I don't find anything else in the logs.
> I've probably missed something obvious but any help would be appreciated.
>
>
>
> Thanks,
>
> Matt
======================================================================
Andreas Steffen andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution! www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==
More information about the Users
mailing list