helsinki-result.jp

Linux 2.6 内核上配置IPSec VPN 的工具

Mon Aug 13 2001 - Fri Aug 17 2001
$KAME: helsinki-result.jp,v 1.49 2001/08/17 14:33:48 sakane Exp $


generic
	sec* interface($B<u$1B&$@$1$@$1$I$M(B)$B$O$&$^$/F0$/!#$I$N(BSPD entry$B$H(B
	$B$I$N%$%s%?%U%'!<%9$,4XO"$E$$$F$$$k$N$+CN$k<jCJ$,I,MW(B(PF_KEY
	API$B$^$?JQ99(B?)$B!#$H$3$m$G!"(Btunnel/transport$B$O(BSPD entry$B$N(Bproperty$B$G$"$k$H(B
	$B==J,9g0U$5$l$F$$$k$+(B?

	tunnel mode$B$N(Bproposal$BHf3S!#(Bsee F-Secure

	phase 1$B$G$N(BAES/SHA2 support$BMW!#(B(AES$B$OF0:n3NG':Q(B)
	Q. $B0E9f2=$7$?7k2L$,(BIV$BD9$h$jC;$$>l9g$O!)$=$s$J$N$"$j$($J$$!)(B

	phase 1$B$G80D9$N%M%4$,$G$-$J$$!#(B($B$G$-$k!#4*0c$$$@$C$?(B)

	IPsec$B$G$N(BSHA2 support$B3NG'(B($BE:IU$9$k(Bbit$B?t(B)$B!#(B

	SSH$B<R$+$i(Btoolkit$B$rGc$C$F;H$C$F$$$k$H$3$m$,BgJQB?$$!#$J$s$+(BSSH$B<R$N(B
	$B$?$a$K(Bbakeoff$B$7$F$$$k$h$&$J5$$,$7$F$-$?!#$H$$$&$+!"(Bipsec$B<+BN(BSSH$B<R$N(B
	$BMx1W$N$?$a$N%W%m%H%3%k$8$c$J$$$+$H$$$&5$$9$i$7$F$/$k!#J#;($K$9$l$P(B
	$B$9$k$[$I(BSSH$B<R$OLY$+$k(B... (conspiracy theory)

	id payload$B$KBP$9$k(Bpolicy database$B8!:w$N8+D>$7!#(Bany$B$N>l9g(Bwildcard$B$@$H(B
	$B;W$C$F8!:w$9$Y$-!#(Bexactly right!!

	phase 2$B$G!"(Bipsec enc mode$B$,$D$$$F$$$J$+$C$?$H$-$N<h$j07$$(B
	(transport mode$B$H;W$C$F$h$$$N$G$O$J$$$+(B)$B!#(B($B=$@5:Q(B)

	$BD9$$(BKEYMAT$B$N7W;;$N$H$-!"I,MW80D9$N7W;;$K(Bbug$B$"$j(B ($B=$@5:Q(B)

	DH$B8x3+>pJs$O;vA0$K7W;;$7$H$/J}$,$$$$$+$b(B

	subjectAltName$B$H(BID payload$BHf3S$K$D$$$F$h$/9M$($J$$$H>ZL@=q$O;H$($J$$!#(B
	$B>ZL@=q$rAw$kA0$K!"$I$N(BID$B$r(BsubjectAltName$B$K;H$&$+7h$a$J$$$H$$$1$J$$$+$i!#(B

	ndp$B$r(Bbypass$B$5$;$k%U%i%0$+%]%j%7$,$"$C$?J}$,$$$$$+$b!#(B
	$B0l1~(Bipsec_setsocket(NULL)$B$O$7$F$$$k!#(Bip6_output()$B$K%U%i%0EO$9(B?
	$BH~$7$/$J$$(B... (itojun)


latest isakmpd on KAME
	Tue Aug 14 01:42:55 JST 2001
	isakmpd$B$N(Binterface selection$BIt$rD>$7$?$i(Bphase 1$B$O@.8y$7$?!#(B
	phase 2$B$,$&$^$/$$$+$J$$LOMM!#B?J,@_DjLdBj!#(B

35:36.982316 130.233.9.166:500 -> 130.233.9.165:500: isakmp 1.0 msgid 00000000: 
phase 1 ? ident[E]: [encrypted id]
2001-08-13 23:35:36: DEBUG: isakmp.c:402:isakmp_main(): malformed cookie receive
d or the spi expired.


USAGI linux
	Tue Aug 14 01:42:55 JST 2001
	$B$J$s$+:#$O$^$C$F$$$k$i$7$$!#(B

	Wed Aug 15 JST
	ESP 3des, des$B$N(Bmanual key$B$O@.8y(B

	Thu Aug 16 JST
	$B$H$j$"$($:(Bpluto$B$@$1F0$+$7$?!#(Bphase 2$B$O40N;$9$k$,7k2L$N80$,0c$&!#(B


Compaq Tru54 UNIX X5.1B-BL4
	Tue Aug 14 17:09:18 JST 2001
	IPv4, ESP, tunnel mode
	phase 1/2$B$H$b(B3DES + SHA1, group 2
	phase 1 lifetime = 10min, phase 2 lifetime = 5min

	IPv6, ESP + AH, transport tunnel mode
	phase 1/2$B$H$b(B3DES + SHA1, group 2
	phase 1 lifetime = 10min, phase 2 lifetime = 5min

	IPv6, IPComp + ESP + AH, transport mode
	phase 1/2$B$H$b(B3DES + SHA1 + defalte, group 2
	phase 1 lifetime = 10min, phase 2 lifetime = 5min

	initiator/responder$B$I$A$i$b$d$C$?!#(B

	Compaq$B$,(Binitiator$B$N>l9g$KLdBj$"$j!#(B
	Compaq$BB&$O(Bphase 2 lifetime$B$N(Bproposal$B:n$jItJ,$K(Bbug$B$,5o$k$h$&$G!"(B
	GUI$B$G(B5min$B$H8@$C$F$b(B10min$B$H8@$C$F$/$k(B(phase 1 lifetime$B$NCM$r(B
	$B%3%T!<$7$F$$$k(B?)$B!#(B

	chargen$BCf$N(Brekey$BEy$b;n$7$?!#LdBj$J$7!#(B

	IPv4 over IPv6/IPv6 over IPv4$B$d$m$&$H8@$o$l$?$,$G$-$:!#(Bsec* transition
	$B=*$o$C$?$i$d$l$k$+$J!#(B

	$BL@F|(B12:00 RSA signature mode$B$G:F@o(B
	$B$`$`!"(Bauthentication-failed$B$G<:GT!#$3$C$A$NLdBj$+!)(B

	Fitec$B$H8=>]$O0l=o!#(Bopenssl 0.9.6 $B$r;H$&$HLdBj$J$7!#(B
	openssl$B$N%P!<%8%g%s2<$2$A$c$C$?$N$G(B
	ipv6 address as subjectAltName $B$O=PMh$:!#(B


Sun
	Thu Aug 16 16:30 EEST 2001
	phase1: RSA signature, 3des, sha1, dh5
	phase2: ESP transport, aes 128, sha1, dh5

	$BLdBj$J$7(B

	Sun$B$O(B phase2$B$N(BAES$B$N80D9$r$D$1$F$J$+$C$?!#(Bdraft$B$K$h$k$H(Bmust$B!#(B
	racoon$BB&$,(Bdefault$B80D9$r%;%C%H$9$k$h$&$K$7$FBP1~!#(B


IBM AIX 5.1
	Tue Aug 14 17:33:43 JST 2001
	IPv6 test$B$7$h$&$H8@$o$l$k$b!"@hJ}$N%^%7%s(B($B1s3VCO(B)$B$K(Bglobal address$B$J$7!#(B

	Thu Aug 16 21:00 ESST 2001
	IPv6$B$@$1(B
	phase1 pre-shared-key, 3des, sha1, dh2
	phase2 esp transport, 3des, sha1, pfs2
	$B:G=i$N(B1$B2s$OLdBj$J$7!#(B
	phase2 SA$B$r>C$7$F:F%M%4$9$k$H(Bisakmpd$B$,$@$s$^$j$K$J$k!#(B
	ibm isakmpd $B$KLdBj$"$k$C$]$$!#(B

	san diego$B$G$d$C$?;~$O(B manual $B$@$C$?$+$J!)(B
		$B$=$&$G$9(B(itojun)

	prasad$B7/$O%$%s%I$K5"$C$F$k$N$GMh$J$$!#(B

F-Secure VPN+ 5.40
	Tue Aug 14 19:44:15 JST 2001
	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 5, lifetime = 10min
	phase 2 AES + SHA1, group 5, lifetime = 2min

	IPv4, IPComp + ESP, transport mode
	phase 1 3DES + SHA1, group 5, lifetime = 10min
	phase 2 AES + SHA1 + deflate, group 5, lifetime = 2min

	$B$I$A$i$bLdBj$J$7!"(Brekey$B$b(BOK$B!#(B

	IPComp + ESP tunnel mode (IP ESP IPComp IP payload)$B$r$d$m$&$H$7$F(B
	ipcomp/tunnel//use esp/transport//use$B$H%]%j%7$r=q$$$?$i!"(B
	IKE phase 2$BE*$K(B
		$B8~$3$&(B: IPComp tunnel, ESP tunnel
		$B$3$C$A(B: IPComp tunnel, ESP transport
	$B$N(Bproposal$B$rHf3S$7$F!"(Bno proposal chosen$B$K$J$k!#$3$C$A$NLdBj(B
	(bundle$B$N<h$j07$$(B)

	$B$G$C$+$$(BDH group$B!"(Bphase 1 SHA2-256/AES$B$b$G$-$k$i$7$$!#8e$G$d$j$?$$!#(B
		(modp4096, phase 1 aes $B$O(Bok)

	Fri Aug 17 11:00 EEST 2001
	phase1: aggressive mode modp4096, aes, sha1, rsa signature
	phase2: pfs 5, esp tunnel, aes, hmac sha1

	aes for phase1 $B$b(BOK.
	f-secure$B$O(BsubjectAltName$B$K%"%I%l%9=q$+$J$$$H%Q%1%C%H$@$;$J$$!#(B
	invalid signature$B$G(Bf-secure$B$KE\$i$l$F<:GT!#860xITL@!#(B
		-> f-secure$B$O(BsubjectAltName$B$r(B1$B$D$7$+<u$1$D$1$J$$!#(B
		$B>ZL@=q$r:n$jD>$7$F@.8y!#(B

	DH$B8x3+>pJs$O;vA0$K7W;;$7$H$/J}$,$$$$$+$b(B

SecGo CryptoIP v3
	Tue Aug 14 21:41:36 JST 2001
	IPv4, ESP, transport mode
	phase 1 3DES + SHA1, group 5, lifetime = 10min
	phase 2 blowfish, group 5, lifetime = 2min

	phase 2 AES$B$b;n$=$&$H$7$?$,<:GT(B(SecGo$BB&$,(B12$B0J30$N(Balgorithm #$B$r(B
	$B;H$C$F$$$?(B or $B%3%s%Q%$%k$7$F$J$+$C$?(B)$B!#(Brekey$B$b$d$C$F$_$?!#(B

	phase 1 AES$B$b$G$-$k$i$7$$(B(SSH toolkit$B;HMQ(B)$B!#(B

	Wed Aug 15 00:16:35 JST 2001
	IPv4, ESP, transport mode
	phase 1 3DES + SHA1, lifetime = 10min
	phase 2 AES, lifetime = 2min

	tested rekey as well.

Oullim information technologies SECUREWORKS VPN gateway 3.0
	Tue Aug 14 21:48:36 JST 2001
	phase 2 AES/blowfish$B$O$I$&$@$M$H%J%s%Q$7$F$_$k$b!"(Bnot ready$B!#(B
	$BL@F|$+L@8eF|$M$H$N$3$H!#(B

	Wed Aug 15 17:15:09 JST 2001
	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 2, lifetime = 10min
	phase 2 AES + SHA1, group 2, lifetime = 2min

	$B<:GT!#@hJ}$,(BAES$B$N$H$-$K(BESP ICV check$B$K<:GT$9$k!#(B

	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 2, lifetime = 10min
	phase 2 AES + MD5, group 2, lifetime = 2min

	$B$*$J$8$/<:GT(B

	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 2, lifetime = 10min
	phase 2 3DES + MD5, group 2, lifetime = 2min

	$B@.8y!#(B

	$B@hJ}$,$3$&$$$&$NEj$2$F$/$k$N$G!"$3$C$A$OE\$k(B(id payload$B$N=g=x$,(B
	$BIaDL$G$O$J$$(B)$B!#(B

>11:59.824877 130.233.10.30:500 -> 130.233.9.166:500: isakmp 1.0 msgid 75973360: phase 2/others ? oakley-quick:
>    (hash: len=20)
>    (sa: doi=ipsec situation=identity
>        (p: #1 protoid=ipsec-esp transform=1 spi=6fd60ca5
>            (t: #1 id=3des (type=lifetype value=sec)(type=life value=0078)(type=enc mode value=tunnel)(type=auth value=hmac-md5)(type=group desc value=modp1024))))
>    (nonce: n len=16)
>    (ke: key len=128)
>    (id: idtype=IPv4 protoid=0 port=0 len=4 130.233.9.166)
>    (id: idtype=IPv4net protoid=0 port=0 len=8 192.168.10.0/255.255.255.0)

	Wed Aug 15 18:39:11 JST 2001
	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 2, lifetime = 10min
	phase 2 AES, group 2, lifetime = 2min

	IKE$BE*$K$OBg>fIW!#(BIPsec$BE*$K$^$@BLL\!#(B

	Wed Aug 15 19:09:05 JST 2001
	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 2, lifetime = 10min
	phase 2 AES, group 2, lifetime = 2min

	IPv4, ESP, tunnel mode
	phase 1 3DES + SHA1, group 2, lifetime = 10min
	phase 2 AES + SHA1, group 2, lifetime = 2min

	$B8~$3$&$,(BAES code$B$r=$@5$7$?!#(BIKE$BE*$K$b(BIPsec$BE*$K$bBg>fIW!#(B
	rekey$B$b0l1~@.8y(B($B8~$3$&$O(Breal lifetime == soft, real * 1.2 == hard$B$H$+$K(B
	$B@_Dj$7$F$$$k$N$G$A$g$C$H%X%s$@$C$?$1$I(B)$B!#(B

	Thu Aug 16 22:01:57 JST 2001
	$B$b$&$$$A$I!#$"$H$O(BID payload$B$N=g=x$@$1!#(B

	Fri Aug 17 02:00 JST$B:"(B
	$B:FD)@o!#@.8y!#(B


Trilogy AdmitOne 2.6
	Tue Aug 14 21:58:01 JST 2001
	30$BJ,8e$H8@$o$l$?!#(B

	Wed Aug 15 01:53:42 JST 2001
	$BL@F|!#(B

	Wed Aug 15 16:09:50 JST 2001
	IPv4, ESP, transport mode
	phase 1 3DES + SHA1, group 1, lifetime = 10min
	phase 2 AES + SHA1, group 1, lifetime = 2min

	Trilogy$BB&$O(BIKE phase 2$B$N(Bkey length$B$,(Bbyte$BC10L$@$H;W$C$F$$$k$i$7$/(B
	negotiation$B<:GT!#=$@58e:FD)@o!#(B

	Wed Aug 15 17:40:05 JST 2001
	IPv4, ESP, transport mode
	phase 1 3DES + SHA1, group 1, lifetime = 10min
	phase 2 AES + SHA1, group 1, lifetime = 2min

	$B:FD)@o!#$3$A$i$,(Binitiator$B$N$H$-$O$&$^$/$$$/!#$"$A$i$,(Binitiator$B$N(B
	$B>l9g!"(Bid payload$B$K(Bproto=icmp$B$,Kd$^$C$F$*$j!"$3$A$i$N(Bkernel policy
	proto=any$B$K(Bmatch$B$;$:(Bno policy found$B$K$J$k!#MW=$@5!#(B