Search code examples
ipsec

Is there support of hmac-md5-96 in setkey ipsec tools?


I want to use "hmac-md5-96" algorithm to create Security Associations at client side. I am using setkey ipsec tools. while adding spd entry, It is giving syntax error and unable to identify hmac-md5-96

I have tried keyed-md5 which is also not supported.

setkey -c << EOF
add $pcscf $ue esp $spi_uc -m transport -E aes-cbc $ck -A  hmac-md5-96 "1234567890123456" ;
spdadd $pcscf/32[$port_ps] $ue/32[$port_uc] tcp -P in ipsec esp/transport//require ;
spdadd $pcscf/32[$port_ps] $ue/32[$port_uc] udp -P in ipsec esp/transport//require ;
EOF

Solution

  • Use ip xfrm state add instead of setkey, i.e.:

    ip xfrm state add src $pcscf dst $ue proto esp spi $spi_uc enc "cbc(aes)" $ck auth-trunc "hmac(md5)" "1234567890123456" 96 mode transport

    For some dummy parameters it creates the following SAD entry:

    src 11.22.33.44 dst 22.33.44.55
            proto esp spi 0x00000457 reqid 0 mode transport
            replay-window 0 
            auth-trunc hmac(md5) 0x31323334353637383930313233343536 96
            enc cbc(aes) 0x3131313131313131313131313131313131313131313131313131313131313131
            anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
            sel src 0.0.0.0/0 dst 0.0.0.0/0 
    

    Good luck!