[Swan] ECDSA Re: Libreswan 4.6: connection IKEv2 win10 to Linux freezes soon after Android device connects

[Manfred]

Hi Mirasd,

I ran into the issue about ECDSA certs with Windows 10 a while ago, and 
Paul explained to me that there is in fact a problem with exchanging 
ECDSA certs between Libreswan and Windows 10.

Here is what I have found (taken from a 2020 post from me on this list):
> If you use authby=ecdsa libreswan will authenticate according to RFC7427, but for this type of authentication (EC digital signatures) Windows uses RFC4754:
> https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-12
> 
> They are both valid standard proposals, the one used by libreswan (RFC7427) is more recent and is meant to be a common standard that generalizes different authentication methods including ECDSA.
> But apparently RFC7427 is not backwards compatible to RFC4754, so Windows and libreswan can't exchange ECDSA digital signatures.
> RFC4754 is not obsoleted by RFC7427, so it is likely that Windows will keep using it until they have reason not to.

If something has changed in the meantime, I'd love to hear.

As a side note, following this thread, if I am not mistaken you are 
using MODP1024, which is known to be weak.
It is actually possible to use MODP2048 (and maybe higher) with Windows 
10, by using the Powershell function "Set-VpnConnectionIPsecConfiguration".
Windows 10 still defaults to MODP1024, but using that function you can 
configure an IKEv2 VPN connection to use MODP2048 (aka DH Group 14).


On 1/15/22 8:30 PM, Mirsad Goran Todorovac wrote:
> On 1/14/2022 10:01 PM, Paul Wouters wrote:
> 
>> You can look at our python code for generating CAs, certs et all that
>> generates a bunch of different (normal and very weird) things:
>>
>> https://raw.githubusercontent.com/libreswan/libreswan/main/testing/x509/dist_certs.py 
>>
> 
> I have tried it, but I really do not know how to install .pem or .crt 
> and .key into Windows 10 Local Machine key store, let alone how to 
> organize key distribution of keys without a password.
> 
> It would be optimal if my modified script for -k ec -q secp384r1 worked, 
> but alas no luck with that thus far.
> 
> In the end, RSA certs work just fine, I have also tried the strongswan 
> client on Android and it is OK, though slightly slower than the native 
> connection. ECDSA is just the final touch, it would be nice if that 
> worked, but for IKEv2 working I am very grateful and thank the LORD and 
> good Heavens!
> 
> I am really motivated by your policy to support people from all 
> backgrounds and all walks of life. I feel motivated to contribute to the 
> team in a supportive working atmosphere.
> 
> If I could finish this EC certs problem, that would be just fine because 
> I hate to quit. I must be doing *something* wrong because this seems to 
> have been supported in Windows 8.1 already: 
> https://support.microsoft.com/en-us/topic/ikev2-vpn-connection-fails-with-error-13806-when-you-use-an-ecdsa-certificate-in-windows-8-1-or-windows-server-2012-r2-84a9011d-d3f9-98fd-948d-88aa7e84636a 
> 
> 
> So, eventually I will think of something, but right now I feel like I'm 
> out of options.
> I just can't explain why Windows 10 can't see the generated .p12 ECDSA 
> cert in the store.
> 
> Kind regards,
> Mirsad
> 
> -- 
> Mirsad Goran Todorovac
> CARNet sistem inženjer
> Grafički fakultet | Akademija likovnih umjetnosti
> Sveučilište u Zagrebu