denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Demote AES-XCBC/CMAC PRFs in default proposal

Browse Source 
These are rarely used, so strictly propose HMAC-based PRFs first.

References strongswan/strongswan#1026
References strongswan/strongswan#1044
This commit is contained in:
Tobias Brunner
2022-05-10 09:04:42 +02:00
parent aef6b5e385
commit 5cf82de69a
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/proposal/proposal.c
+16 -1
View File
@@ -1114,6 +1114,7 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
break;
case AUTH_HMAC_MD5_96:
/* no, thanks */
break;
default:
break;
}
@@ -1130,6 +1131,20 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
case PRF_HMAC_SHA2_256:
case PRF_HMAC_SHA2_384:
case PRF_HMAC_SHA2_512:
add_algorithm(this, PSEUDO_RANDOM_FUNCTION, prf, 0);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
/* Round 2 adds rarely used algorithms with at least 128 bit strength */
enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &prf, &plugin_name))
{
switch (prf)
{
case PRF_AES128_XCBC:
case PRF_AES128_CMAC:
add_algorithm(this, PSEUDO_RANDOM_FUNCTION, prf, 0);
@@ -1140,7 +1155,7 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
}
enumerator->destroy(enumerator);
/* Round 2 adds algorithms with less than 128 bit security strength */
/* Round 3 adds algorithms with less than 128 bit security strength */
enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &prf, &plugin_name))
{