From db50a35ad86c95e7b2aeb13e7dae50d3f7127336 Mon Sep 17 00:00:00 2001 From: Reto Buerki Date: Mon, 18 Mar 2013 16:13:55 +0100 Subject: [PATCH] Add NEWS about TKM separation --- NEWS | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/NEWS b/NEWS index b4bc162d0..10c8353b8 100644 --- a/NEWS +++ b/NEWS @@ -43,6 +43,14 @@ strongswan-5.0.3 any authentication. Therefore, to use this backend it has to be selected explicitly with rightauth2=xauth-noauth. +- The new charon-tkm IKEv2 daemon delegates security critical operations to a + separate process. This has the benefit that the network facing daemon has no + knowledge of keying material used to protect child SAs. Thus subverting + charon-tkm does not result in the compromise of cryptographic keys. + The extracted functionality has been implemented from scratch in a minimal TCB + (trusted computing base) in the Ada programming language. Further information + can be found at http://www.codelabs.ch/tkm/. + strongswan-5.0.2 ----------------