denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev1: Assume a default key length of 128-bit for AES-CBC

Browse Source 
Some implementations don't send a Key Length attribute for AES-128.
This was allowed for IKE in early drafts of RFC 3602, however, some
implementations also seem to do it for ESP, where it never was allowed.
And the final version of RFC 3602 demands a Key Length attribute for both
phases so they shouldn't do it anymore anyway.

Fixes #1064.
This commit is contained in:
Tobias Brunner
2015-08-17 17:13:50 +02:00
parent 774c8c3847
commit 636b2e9b2a
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/encoding/payloads/proposal_substructure.c
+11
View File
@@ -914,6 +914,11 @@ static void add_to_proposal_v1_ike(proposal_t *proposal,
if (encr != ENCR_UNDEFINED)
{
if (encr == ENCR_AES_CBC && !key_length)
{ /* some implementations don't send a Key Length attribute for
* AES-128, early drafts of RFC 3602 allowed that */
key_length = 128;
}
proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr, key_length);
}
}
@@ -962,6 +967,12 @@ static void add_to_proposal_v1(proposal_t *proposal,
transform->get_transform_id(transform));
if (encr)
{
if (encr == ENCR_AES_CBC && !key_length)
{ /* some implementations don't send a Key Length attribute for
* AES-128, early drafts of RFC 3602 allowed that for IKE, some
* also seem to do it for ESP */
key_length = 128;
}
proposal->add_algorithm(proposal, ENCRYPTION_ALGORITHM, encr,
key_length);
}