<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:Calibri;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Is there any situation in the Libreswan IKE implementation in which the third packet of an Aggressive Exchange is allowed to *<b>not</b>* be encrypted? RFC 2408 (https://tools.ietf.org/html/rfc2408#section-4.7)
seems to say no:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">“In the third (3) message, the initiator transmits the results of the<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> agreed upon authentication function. This information is transmitted<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> under the protection of the common shared secret. Local security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> policy dictates the action if an error occurs during these messages.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> One possible action is the transmission of a Notify payload as part<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> of an Informational Exchange.”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I’m comparing IKE packet dumps from two similar IPsec peer configurations: a proprietary embedded device and Libreswan, and the same device with a Cisco IOS device. NAT traversal is in use in both situations
(Libreswan and the Cisco are behind NAT), and the embedded device is always the session initiator. The third packet contains two NAT-D payloads and a Hash payload. With the Cisco, the IKE SA and tunnel establishes, even though the third Aggressive Exchange
packet from the embedded device to the Cisco is *<b>not</b>* encrypted. Libreswan terminates the Aggressive Exchange with an Informational message with INVALID-FLAGS notification and a log message indicating it expected an encrypted response, which seems correct
according to the RFC and because the Flags field of the third packet is set to 0x00.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So even though an IPsec tunnel “works” between the device and the Cisco, and not with Libreswan, it appears like it might be buggy behavior from both: the device should encrypt the third packet, and the Cisco
should reject it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Can anybody on the development team confirm that the third packet in Aggressive mode must always be encrypted?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>