128 bit default security strength requires 3072 bit prime DH group

diff --git a/configure.ac b/configure.ac
index a7419fded06f2fbf6afc424407b213a9c720899a..944e37e37432c91470dfd326bf480b3c016b230b 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1292,9 +1292,9 @@ ADD_PLUGIN([aes],                  [s charon scepclient pki scripts nm cmd])
 ADD_PLUGIN([des],                  [s charon scepclient pki scripts nm cmd])
 ADD_PLUGIN([blowfish],             [s charon scepclient pki scripts nm cmd])
 ADD_PLUGIN([rc2],                  [s charon scepclient pki scripts nm cmd])
-ADD_PLUGIN([sha1],                 [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
 ADD_PLUGIN([sha2],                 [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
 ADD_PLUGIN([sha3],                 [s charon scepclient pki scripts medsrv attest nm cmd aikgen])
+ADD_PLUGIN([sha1],                 [s charon scepclient pki scripts manager medsrv attest nm cmd aikgen])
 ADD_PLUGIN([md4],                  [s charon scepclient pki nm cmd])
 ADD_PLUGIN([md5],                  [s charon scepclient pki scripts attest nm cmd aikgen])
 ADD_PLUGIN([rdrand],               [s charon scepclient pki scripts medsrv attest nm cmd aikgen])

diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c
index 04f1f43ef17380a1163e38a1525bd159e9a42037..7ecba8fa9dfa9a21d07a4a4c9153d21bc4adf1e3 100644 (file)
--- a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c
+++ b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c
@@ -98,14 +98,14 @@ METHOD(plugin_t, get_features, int,
                        PLUGIN_PROVIDE(HASHER, HASH_SHA512),
                /* MODP DH groups */
                PLUGIN_REGISTER(DH, gcrypt_dh_create),
-                       PLUGIN_PROVIDE(DH, MODP_2048_BIT),
-                       PLUGIN_PROVIDE(DH, MODP_2048_224),
-                       PLUGIN_PROVIDE(DH, MODP_2048_256),
-                       PLUGIN_PROVIDE(DH, MODP_1536_BIT),
                        PLUGIN_PROVIDE(DH, MODP_3072_BIT),
                        PLUGIN_PROVIDE(DH, MODP_4096_BIT),
                        PLUGIN_PROVIDE(DH, MODP_6144_BIT),
                        PLUGIN_PROVIDE(DH, MODP_8192_BIT),
+                       PLUGIN_PROVIDE(DH, MODP_2048_BIT),
+                       PLUGIN_PROVIDE(DH, MODP_2048_224),
+                       PLUGIN_PROVIDE(DH, MODP_2048_256),
+                       PLUGIN_PROVIDE(DH, MODP_1536_BIT),
                        PLUGIN_PROVIDE(DH, MODP_1024_BIT),
                        PLUGIN_PROVIDE(DH, MODP_1024_160),
                        PLUGIN_PROVIDE(DH, MODP_768_BIT),

diff --git a/src/libstrongswan/plugins/gmp/gmp_plugin.c b/src/libstrongswan/plugins/gmp/gmp_plugin.c
index d93aa14a1bf94f543475d8a5f4247150b8dffbab..ea75896a10b98d7b9775d8ea85d7a93255f890a1 100644 (file)
--- a/src/libstrongswan/plugins/gmp/gmp_plugin.c
+++ b/src/libstrongswan/plugins/gmp/gmp_plugin.c
@@ -45,14 +45,6 @@ METHOD(plugin_t, get_features, int,
        static plugin_feature_t f[] = {
                /* DH groups */
                PLUGIN_REGISTER(DH, gmp_diffie_hellman_create),
-                       PLUGIN_PROVIDE(DH, MODP_2048_BIT),
-                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
-                       PLUGIN_PROVIDE(DH, MODP_2048_224),
-                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
-                       PLUGIN_PROVIDE(DH, MODP_2048_256),
-                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
-                       PLUGIN_PROVIDE(DH, MODP_1536_BIT),
-                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
                        PLUGIN_PROVIDE(DH, MODP_3072_BIT),
                                PLUGIN_DEPENDS(RNG, RNG_STRONG),
                        PLUGIN_PROVIDE(DH, MODP_4096_BIT),
@@ -61,6 +53,14 @@ METHOD(plugin_t, get_features, int,
                                PLUGIN_DEPENDS(RNG, RNG_STRONG),
                        PLUGIN_PROVIDE(DH, MODP_8192_BIT),
                                PLUGIN_DEPENDS(RNG, RNG_STRONG),
+                       PLUGIN_PROVIDE(DH, MODP_2048_BIT),
+                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
+                       PLUGIN_PROVIDE(DH, MODP_2048_224),
+                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
+                       PLUGIN_PROVIDE(DH, MODP_2048_256),
+                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
+                       PLUGIN_PROVIDE(DH, MODP_1536_BIT),
+                               PLUGIN_DEPENDS(RNG, RNG_STRONG),
                        PLUGIN_PROVIDE(DH, MODP_1024_BIT),
                                PLUGIN_DEPENDS(RNG, RNG_STRONG),
                        PLUGIN_PROVIDE(DH, MODP_1024_160),

diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c
index e48efe3e9ac59896aa666a3499479c1f9c62b612..2b05adbdf0d8bac9e9206d6d1124d25ef3ce9916 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_plugin.c
+++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c
@@ -379,14 +379,14 @@ METHOD(plugin_t, get_features, int,
 #ifndef OPENSSL_NO_DH
                /* MODP DH groups */
                PLUGIN_REGISTER(DH, openssl_diffie_hellman_create),
-                       PLUGIN_PROVIDE(DH, MODP_2048_BIT),
-                       PLUGIN_PROVIDE(DH, MODP_2048_224),
-                       PLUGIN_PROVIDE(DH, MODP_2048_256),
-                       PLUGIN_PROVIDE(DH, MODP_1536_BIT),
                        PLUGIN_PROVIDE(DH, MODP_3072_BIT),
                        PLUGIN_PROVIDE(DH, MODP_4096_BIT),
                        PLUGIN_PROVIDE(DH, MODP_6144_BIT),
                        PLUGIN_PROVIDE(DH, MODP_8192_BIT),
+                       PLUGIN_PROVIDE(DH, MODP_2048_BIT),
+                       PLUGIN_PROVIDE(DH, MODP_2048_224),
+                       PLUGIN_PROVIDE(DH, MODP_2048_256),
+                       PLUGIN_PROVIDE(DH, MODP_1536_BIT),
                        PLUGIN_PROVIDE(DH, MODP_1024_BIT),
                        PLUGIN_PROVIDE(DH, MODP_1024_160),
                        PLUGIN_PROVIDE(DH, MODP_768_BIT),

diff --git a/src/starter/confread.c b/src/starter/confread.c
index c3a0ac07fd14be94fb8afca67b62afe79d9e75c4..897aa423e341cbbd17b2aedfec70f87825f22424 100644 (file)
--- a/src/starter/confread.c
+++ b/src/starter/confread.c
@@ -40,8 +40,8 @@
 #define SA_REPLACEMENT_RETRIES_DEFAULT   3
 #define SA_REPLAY_WINDOW_DEFAULT        -1 /* use charon.replay_window */
 
-static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
-static const char esp_defaults[] = "aes128-sha1,3des-sha1";
+static const char ike_defaults[] = "aes128-sha256-modp3072";
+static const char esp_defaults[] = "aes128-sha256";
 
 static const char firewall_defaults[] = IPSEC_SCRIPT " _updown iptables";
 

diff --git a/testing/tests/af-alg/alg-camellia/evaltest.dat b/testing/tests/af-alg/alg-camellia/evaltest.dat
index 2096cb99456c774e5c9de35e0c0b4e4da9a11b37..f87c8f7f5f4e2d4d5ee76d1f50d5d9afdbbff8c6 100644 (file)
--- a/testing/tests/af-alg/alg-camellia/evaltest.dat
+++ b/testing/tests/af-alg/alg-camellia/evaltest.dat
@@ -1,7 +1,7 @@
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
 moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@strongswan.org::YES
-moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
 carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES

diff --git a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/ipsec.conf b/testing/tests/af-alg/alg-camellia/hosts/carol/etc/ipsec.conf
index 11dece402491e81f7bb3cf32724904e8a0f7590e..f0bbfc10ffa5ea60be1e70046f9b6ddb7fbbf8ad 100644 (file)
--- a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/af-alg/alg-camellia/hosts/carol/etc/ipsec.conf
@@ -8,7 +8,7 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=camellia256-sha512-modp2048!
+       ike=camellia256-sha512-modp3072!
        esp=camellia192-sha384!
 
 conn home

diff --git a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/ipsec.conf b/testing/tests/af-alg/alg-camellia/hosts/moon/etc/ipsec.conf
index ecbb94dca4459fe5dd431f8964b572e5163dba60..8481f8974d32a9de5494ec0ca7d2751bae4cd456 100644 (file)
--- a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/af-alg/alg-camellia/hosts/moon/etc/ipsec.conf
@@ -8,7 +8,7 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=camellia256-sha512-modp2048!
+       ike=camellia256-sha512-modp3072!
        esp=camellia192-sha384!
 
 conn rw

diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat
index 5f0bb3cdc2398cba2f2000509cd1f8798d18dd29..236647b568fa78f95bb22e237af0def0f671b966 100644 (file)
--- a/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat
@@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
 carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES

diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf b/testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf
index 11dece402491e81f7bb3cf32724904e8a0f7590e..f0bbfc10ffa5ea60be1e70046f9b6ddb7fbbf8ad 100644 (file)
--- a/testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf
@@ -8,7 +8,7 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=camellia256-sha512-modp2048!
+       ike=camellia256-sha512-modp3072!
        esp=camellia192-sha384!
 
 conn home

diff --git a/testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf b/testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf
index ecbb94dca4459fe5dd431f8964b572e5163dba60..8481f8974d32a9de5494ec0ca7d2751bae4cd456 100644 (file)
--- a/testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf
@@ -8,7 +8,7 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=camellia256-sha512-modp2048!
+       ike=camellia256-sha512-modp3072!
        esp=camellia192-sha384!
 
 conn rw

diff --git a/testing/tests/ikev1/alg-sha256/evaltest.dat b/testing/tests/ikev1/alg-sha256/evaltest.dat
index eba856742e06ad8b116070505f598ee23a8b9370..c826c3f60390f1980a7d978455b71765e55a70cb 100644 (file)
--- a/testing/tests/ikev1/alg-sha256/evaltest.dat
+++ b/testing/tests/ikev1/alg-sha256/evaltest.dat
@@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES
 carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES

diff --git a/testing/tests/ikev1/alg-sha256/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha256/hosts/carol/etc/ipsec.conf
index 73e25710bb8d1602668e10f4b102f92f7bc8d2ec..1c227978e3e9dfa2c42307bc77a910752c71bea8 100644 (file)
--- a/testing/tests/ikev1/alg-sha256/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-sha256/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev1
-       ike=aes128-sha256-modp2048!
-       esp=aes128-sha256-modp2048!
+       ike=aes128-sha256-modp3072!
+       esp=aes128-sha256-modp3072!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/ikev1/alg-sha256/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha256/hosts/moon/etc/ipsec.conf
index 0a6f48e6910ad4f9d38553b68c2dcbe246929a0b..177aebf5298223ef9275b6185584ec955c6d92f4 100644 (file)
--- a/testing/tests/ikev1/alg-sha256/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-sha256/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev1
-       ike=aes128-sha256-modp2048!
-       esp=aes128-sha256-modp2048!
+       ike=aes128-sha256-modp3072!
+       esp=aes128-sha256-modp3072!
 
 conn rw
        left=PH_IP_MOON

diff --git a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
index f11018347ca0cba8be6f4ce6be6c7c81149f7c79..c896b5f67aab235f86e06cc2a72abc113347c787 100644 (file)
--- a/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
+++ b/testing/tests/ikev2/alg-aes-xcbc/evaltest.dat
@@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES
 carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES

diff --git a/testing/tests/ikev2/alg-aes-xcbc/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
index 74668e7fbb400228aefc6cd60f64743d7b4e27da..c9e9e92e5679df7bb66736f1738063b01f3ff306 100644 (file)
--- a/testing/tests/ikev2/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-aesxcbc-modp2048!
-       esp=aes128-aesxcbc-modp2048!
+       ike=aes128-aesxcbc-modp3072!
+       esp=aes128-aesxcbc-modp3072!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/ikev2/alg-aes-xcbc/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
index 3cda7293577375bac8093a003f027f60284779b0..4e4a9324ff434f488493604a4b38dbede1341867 100644 (file)
--- a/testing/tests/ikev2/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev2/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-aesxcbc-modp2048!
-       esp=aes128-aesxcbc-modp2048!
+       ike=aes128-aesxcbc-modp3072!
+       esp=aes128-aesxcbc-modp3072!
 
 conn rw
        left=PH_IP_MOON

diff --git a/testing/tests/ikev2/alg-sha256-96/evaltest.dat b/testing/tests/ikev2/alg-sha256-96/evaltest.dat
index 6c4e23710667c7124aa13b0c8518fac9c64f15a1..8ad0fb2b2f45256793c2b7f1e3ac274af190f761 100644 (file)
--- a/testing/tests/ikev2/alg-sha256-96/evaltest.dat
+++ b/testing/tests/ikev2/alg-sha256-96/evaltest.dat
@@ -4,8 +4,8 @@ moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
 moon:: cat /var/log/daemon.log::received strongSwan vendor ID::YES
 carol::cat /var/log/daemon.log::received strongSwan vendor ID::YES
-moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_96,::YES
 carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_96,::YES

diff --git a/testing/tests/ikev2/alg-sha256-96/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/alg-sha256-96/hosts/carol/etc/ipsec.conf
index 0d3b9fd45c1e66b262653265ab873e1eee1b7de8..90a143678a383a2cb4fbd9a9ac0ba8e35c3984bf 100644 (file)
--- a/testing/tests/ikev2/alg-sha256-96/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/alg-sha256-96/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-sha256-modp2048!
-       esp=aes128-sha256_96-modp2048!
+       ike=aes128-sha256-modp3072!
+       esp=aes128-sha256_96-modp3072!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/ikev2/alg-sha256-96/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/alg-sha256-96/hosts/moon/etc/ipsec.conf
index b0a5c46160158a7c366bbeeeb3077d0577c23f0b..e0b2625c06701f92c92b30f0bcb7a8240fc3bcf5 100644 (file)
--- a/testing/tests/ikev2/alg-sha256-96/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev2/alg-sha256-96/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-sha256-modp2048!
-       esp=aes128-sha256_96-modp2048!
+       ike=aes128-sha256-modp3072!
+       esp=aes128-sha256_96-modp3072!
 
 conn rw
        left=PH_IP_MOON

diff --git a/testing/tests/ikev2/alg-sha256/evaltest.dat b/testing/tests/ikev2/alg-sha256/evaltest.dat
index eba856742e06ad8b116070505f598ee23a8b9370..c826c3f60390f1980a7d978455b71765e55a70cb 100644 (file)
--- a/testing/tests/ikev2/alg-sha256/evaltest.dat
+++ b/testing/tests/ikev2/alg-sha256/evaltest.dat
@@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/HMAC_SHA2_256_128,::YES
 carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/HMAC_SHA2_256_128,::YES

diff --git a/testing/tests/ikev2/alg-sha256/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/alg-sha256/hosts/carol/etc/ipsec.conf
index 22d2cd38a6287525d219edc30b81b102f4f19a61..6890ea4580675967228cfaf26778b9dcffc5a008 100644 (file)
--- a/testing/tests/ikev2/alg-sha256/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/alg-sha256/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-sha256-modp2048!
-       esp=aes128-sha256-modp2048!
+       ike=aes128-sha256-modp3072!
+       esp=aes128-sha256-modp3072!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/ikev2/alg-sha256/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/alg-sha256/hosts/moon/etc/ipsec.conf
index 543374d76b218ebc5197a8f87a3f0b0c4d097902..5831118931cab3cd22fb85a1aa70c1ec6805ee81 100644 (file)
--- a/testing/tests/ikev2/alg-sha256/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev2/alg-sha256/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-sha256-modp2048!
-       esp=aes128-sha256-modp2048!
+       ike=aes128-sha256-modp3072!
+       esp=aes128-sha256-modp3072!
 
 conn rw
        left=PH_IP_MOON

diff --git a/testing/tests/libipsec/net2net-null/evaltest.dat b/testing/tests/libipsec/net2net-null/evaltest.dat
index e455a3650e4246368a27f836b7b295c8932390c7..0cafb4faff35c7efa2fdaab5b1de04a327a230ce 100644 (file)
--- a/testing/tests/libipsec/net2net-null/evaltest.dat
+++ b/testing/tests/libipsec/net2net-null/evaltest.dat
@@ -2,8 +2,8 @@ moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.
 sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
 moon::ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
 sun:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
-moon::ipsec statusall 2> /dev/null::net-net\[1].*NULL/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
-sun:: ipsec statusall 2> /dev/null::net-net\[1].*NULL/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048::YES
+moon::ipsec statusall 2> /dev/null::net-net\[1].*NULL/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
+sun:: ipsec statusall 2> /dev/null::net-net\[1].*NULL/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072::YES
 alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_req=1::YES
 moon::ipsec statusall 2> /dev/null::net-net[{]1}.*NULL/HMAC_SHA2_256::YES
 sun:: ipsec statusall 2> /dev/null::net-net[{]1}.*NULL/HMAC_SHA2_256::YES

diff --git a/testing/tests/libipsec/net2net-null/hosts/moon/etc/ipsec.conf b/testing/tests/libipsec/net2net-null/hosts/moon/etc/ipsec.conf
index 4ecfb0e92ee37d99aab628a90ddb5c2b37d2291d..f206a16fbd264a4bba49ee9f72f7b49aff1cbae6 100644 (file)
--- a/testing/tests/libipsec/net2net-null/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/libipsec/net2net-null/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=null-sha256-modp2048!
-       esp=null-sha256-modp2048!
+       ike=null-sha256-modp3072!
+       esp=null-sha256-modp3072!
        mobike=no
 
 conn net-net

diff --git a/testing/tests/libipsec/net2net-null/hosts/sun/etc/ipsec.conf b/testing/tests/libipsec/net2net-null/hosts/sun/etc/ipsec.conf
index 95ea20d3c80872d5f4978f2608820a94c64ea97e..21b116595efaaa60ca69e432f86f776370eb7ca2 100644 (file)
--- a/testing/tests/libipsec/net2net-null/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/libipsec/net2net-null/hosts/sun/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=null-sha256-modp2048!
-       esp=null-sha256-modp2048!
+       ike=null-sha256-modp3072!
+       esp=null-sha256-modp3072!
        mobike=no
 
 conn net-net

diff --git a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat
index 4d614bf7e309ea25435670e698638efbdc0e02dd..3b6770389beb08c8921a26488fe429316af0de61 100644 (file)
--- a/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat
+++ b/testing/tests/openssl-ikev1/alg-camellia/evaltest.dat
@@ -1,11 +1,11 @@
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
-moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
-carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
+moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
+carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
 moon:: ip xfrm state::enc cbc(camellia)::YES
 carol::ip xfrm state::enc cbc(camellia)::YES
-moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
-moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES

diff --git a/testing/tests/openssl-ikev1/alg-camellia/hosts/carol/etc/ipsec.conf b/testing/tests/openssl-ikev1/alg-camellia/hosts/carol/etc/ipsec.conf
index 7a276806ee24a60046488d45f96cb8284a42c7a3..4628311d41b1321829141f9076a8905d70f547ff 100644 (file)
--- a/testing/tests/openssl-ikev1/alg-camellia/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/openssl-ikev1/alg-camellia/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev1
-       ike=camellia256-sha512-modp2048!
-       esp=camellia192-sha1!
+       ike=camellia256-sha512-modp3072!
+       esp=camellia192-sha384!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/openssl-ikev1/alg-camellia/hosts/moon/etc/ipsec.conf b/testing/tests/openssl-ikev1/alg-camellia/hosts/moon/etc/ipsec.conf
index fb892a04176d109de50c13e339acc80b79e1b6f7..da1fbf06b6a159a9ed78c08d44e17ab5eccdeb0d 100644 (file)
--- a/testing/tests/openssl-ikev1/alg-camellia/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/openssl-ikev1/alg-camellia/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev1
-       ike=camellia256-sha512-modp2048!
-       esp=camellia192-sha1!
+       ike=camellia256-sha512-modp3072!
+       esp=camellia192-sha384!
 
 conn rw
        left=PH_IP_MOON

diff --git a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat
index 4d614bf7e309ea25435670e698638efbdc0e02dd..3b6770389beb08c8921a26488fe429316af0de61 100644 (file)
--- a/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat
+++ b/testing/tests/openssl-ikev2/alg-camellia/evaltest.dat
@@ -1,11 +1,11 @@
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
-moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
-carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA1_96::YES
+moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
+carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
 moon:: ip xfrm state::enc cbc(camellia)::YES
 carol::ip xfrm state::enc cbc(camellia)::YES
-moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 196::YES
-moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 196::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES

diff --git a/testing/tests/openssl-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf b/testing/tests/openssl-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf
index 00429543777d1f728a4c389ea4e8f33c2959a670..f0bbfc10ffa5ea60be1e70046f9b6ddb7fbbf8ad 100644 (file)
--- a/testing/tests/openssl-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/openssl-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=camellia256-sha512-modp2048!
-       esp=camellia192-sha1!
+       ike=camellia256-sha512-modp3072!
+       esp=camellia192-sha384!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/openssl-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf b/testing/tests/openssl-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf
index 0f6a4f5690673be8098dc9bd2c948f8a4a4a34d6..8481f8974d32a9de5494ec0ca7d2751bae4cd456 100644 (file)
--- a/testing/tests/openssl-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/openssl-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=camellia256-sha512-modp2048!
-       esp=camellia192-sha1!
+       ike=camellia256-sha512-modp3072!
+       esp=camellia192-sha384!
 
 conn rw
        left=PH_IP_MOON

diff --git a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat
index 590b7fe9c960fde498b1774b5f60e0451af36f25..9c6b73ba065efcb53b136fd5fda94cd40521eaf2 100644 (file)
--- a/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat
+++ b/testing/tests/pfkey/alg-aes-xcbc/evaltest.dat
@@ -2,8 +2,8 @@ moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*carol@st
 carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*carol@strongswan.org.*moon.strongswan.org::YES
 moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
 carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
-carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_2048::YES
+moon:: ipsec statusall 2> /dev/null::rw.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_3072::YES
+carol::ipsec statusall 2> /dev/null::home.*IKE proposal.*AES_CBC_128/AES_XCBC_96/PRF_AES128_XCBC/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_req=1::YES
 moon:: ipsec statusall 2> /dev/null::rw.*AES_CBC_128/AES_XCBC_96,::YES
 carol::ipsec statusall 2> /dev/null::home.*AES_CBC_128/AES_XCBC_96,::YES

diff --git a/testing/tests/pfkey/alg-aes-xcbc/hosts/carol/etc/ipsec.conf b/testing/tests/pfkey/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
index 74668e7fbb400228aefc6cd60f64743d7b4e27da..c9e9e92e5679df7bb66736f1738063b01f3ff306 100644 (file)
--- a/testing/tests/pfkey/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/pfkey/alg-aes-xcbc/hosts/carol/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-aesxcbc-modp2048!
-       esp=aes128-aesxcbc-modp2048!
+       ike=aes128-aesxcbc-modp3072!
+       esp=aes128-aesxcbc-modp3072!
 
 conn home
        left=PH_IP_CAROL

diff --git a/testing/tests/pfkey/alg-aes-xcbc/hosts/moon/etc/ipsec.conf b/testing/tests/pfkey/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
index 3cda7293577375bac8093a003f027f60284779b0..4e4a9324ff434f488493604a4b38dbede1341867 100644 (file)
--- a/testing/tests/pfkey/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/pfkey/alg-aes-xcbc/hosts/moon/etc/ipsec.conf
@@ -8,8 +8,8 @@ conn %default
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
-       ike=aes128-aesxcbc-modp2048!
-       esp=aes128-aesxcbc-modp2048!
+       ike=aes128-aesxcbc-modp3072!
+       esp=aes128-aesxcbc-modp3072!
 
 conn rw
        left=PH_IP_MOON