denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

child-cfg: Optionally use 96-bit truncation for HMAC-SHA-256

Browse Source 
The correct truncation is 128-bit but some implementations insist on
using 96-bit truncation.  With strongSwan this can be negotiated using
an algorithm identifier from a private range.  But this doesn't work
with third-party implementations.  This adds an option to use 96-bit
truncation even if the official identifier is used.
This commit is contained in:
Tobias Brunner
2017-05-26 11:22:27 +02:00
parent 7b476029e6
commit 7637633bb9
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/child_sa.c
+8
View File
@@ -802,6 +802,14 @@ static status_t install_internal(private_child_sa_t *this, chunk_t encr,
this->proposal->get_algorithm(this->proposal, EXTENDED_SEQUENCE_NUMBERS,
&esn, NULL);
if (int_alg == AUTH_HMAC_SHA2_256_128 &&
this->config->has_option(this->config, OPT_SHA256_96))
{
DBG2(DBG_CHD, " using %N with 96-bit truncation",
integrity_algorithm_names, int_alg);
int_alg = AUTH_HMAC_SHA2_256_96;
}
if (!this->reqid_allocated && !this->static_reqid)
{
status = charon->kernel->alloc_reqid(charon->kernel, my_ts, other_ts,