[strongSwan-dev] RFC 6054 support with HA plugin

[Emeric POUPON]

Hello,

I am concerned about AES-GCM issues related to segment responsibility changes (see https://tools.ietf.org/html/rfc6311#section-3.4)

https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards states RFC6454 is supported.
Could you please provide more details about it?

As far as I understand, each member of the cluster should have a unique SID assigned and use this SID when emitting packets from the kernel stack.

This raises several questions:
- how does the userland set the sid in the kernel?
- how is the sid is computed so that it is unique within the cluster? How many bits are reserved for this sid?

Regards,

Emeric

[Tobias Brunner]

Hi Emeric,

Post by Emeric POUPON
https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards states RFC6454 is supported.
Could you please provide more details about it?

I guess you mean RFC 6054, and that's explicitly marked as NOT supported.

Regards,
Tobias

[Emeric POUPON]

Post by Tobias Brunner
Hi Emeric,

Post by Emeric POUPON
https://wiki.strongswan.org/projects/strongswan/wiki/IpsecStandards states
RFC6454 is supported.
Could you please provide more details about it?

I guess you mean RFC 6054, and that's explicitly marked as NOT supported.
Regards,
Tobias

Yes my bad.
Ok for the ESP part but what about the IKE SA part?
(Maybe the message id could be used to set the GCM internal counter when changing the responsibility?)

Regards,

[Tobias Brunner]

Hi Emeric,

Post by Emeric POUPON
Yes my bad.
Ok for the ESP part but what about the IKE SA part?
(Maybe the message id could be used to set the GCM internal counter when changing the responsibility?)

The message ID is what's used as IV for IKE messages if AES-GCM is used.

Regards,
Tobias

[Emeric POUPON]

Post by Tobias Brunner
Hi Emeric,

Post by Emeric POUPON
Yes my bad.
Ok for the ESP part but what about the IKE SA part?
(Maybe the message id could be used to set the GCM internal counter when
changing the responsibility?)

The message ID is what's used as IV for IKE messages if AES-GCM is used.

Good news!
Thanks for your support!

Regards,
Emeric