<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi Vukasin,</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thank you for the information. We went through the ipsec.conf man file up and down and found a few hints that it might have been possible. We must have overlooked the entry in the ipsec.secrets man page.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Stay safe and have a great weekend.<br>
</div>
<div>
<div id="Signature">
<div></div>
<div></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin:0cm 0cm 0.0001pt; font-size:12pt; font-family:Calibri,sans-serif">
<a style=""><b><span style="font-size: 10pt; font-family: "Source Sans Pro"; color: rgb(11, 171, 198);">Rene Neumann</span></b></a><span style=""><span style="font-size: 10pt; font-family: "Source Sans Pro"; color: rgb(96, 109, 117);"><br>
</span></span></p>
<a href="https://www.zpesystems.com/demo/" style=""><span style=""><b><span style="font-size: 10pt; font-family: "Source Sans Pro"; color: rgb(96, 109, 117);"></span></b></span><span style=""></span></a><span style=""><span style="color: black;"></span></span><br>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Vukasin Karadzic <vukasin.karadzic@gmail.com><br>
<b>Sent:</b> Thursday 2 April 2020 21:54<br>
<b>To:</b> Rene Neumann <rene.neumann@zpesystems.com><br>
<b>Cc:</b> swan@lists.libreswan.org <swan@lists.libreswan.org><br>
<b>Subject:</b> Re: [Swan] PSK with asymmetric keys</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">A correction: ipsec.secrets is the name of man page, not ipsec.secret<br>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">÷åò, 2. àïð 2020. ó 22:50 Vukasin Karadzic <<a href="mailto:vukasin.karadzic@gmail.com">vukasin.karadzic@gmail.com</a>> ¼å íàïèñàî/ëà:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div>Dear Rene,</div>
<div><br>
</div>
<div>libreswan does not currently support asymmetric PSK authentication. The ipsec.secret manual page documents that:</div>
<div>"Authentication by preshared secret requires that both systems find the identical secret".</div>
<div><br>
</div>
<div>Regards,</div>
<div>Vukasin<br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">óòî, 31. ìàð 2020. ó 13:17 Rene Neumann <<a href="mailto:rene.neumann@zpesystems.com" target="_blank">rene.neumann@zpesystems.com</a>> ¼å íàïèñàî/ëà:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Hello,</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<p><span lang="EN-US">We’re trying to configure Libreswan 3.27 with asymmetric PSK auth support for IKEv2 tunnels and it would appear that Libreswan is always using authby (symmetric) PSK.</span></p>
<p><span lang="EN-US"> </span></p>
<p><span lang="EN-US">This is what we have in the conf file:</span></p>
<p><span lang="EN-US"> </span></p>
<p><span lang="EN-US" style="font-size:8pt">conn XXX </span></p>
<p><span lang="EN-US" style="font-size:8pt"> </span></p>
<p><span lang="EN-US" style="font-size:8pt"> #GLOBAL Configuration</span></p>
<p><span lang="EN-US" style="font-size:8pt"> #connaddrfamily=ipv4</span></p>
<p><span lang="EN-US" style="font-size:8pt"> auto=add</span></p>
<p><span lang="EN-US" style="font-size:8pt"> type=tunnel</span></p>
<p><span lang="EN-US" style="font-size:8pt"> mtu=1460</span></p>
<p><span lang="EN-US" style="font-size:8pt"> </span></p>
<p><span lang="EN-US" style="font-size:8pt"> #IKE Configuration</span></p>
<p><span lang="EN-US" style="font-size:8pt"> leftauth=secret</span></p>
<p><span lang="EN-US" style="font-size:8pt"> rightauth=secret</span></p>
<p><span lang="EN-US" style="font-size:8pt"> initial_contact=yes</span></p>
<p><span lang="EN-US" style="font-size:8pt"> keyingtries=%forever</span></p>
<p><span lang="EN-US" style="font-size:8pt"> keyexchange=ike</span></p>
<p><span lang="EN-US" style="font-size:8pt"> nat_keepalive=yes</span></p>
<p><span lang="EN-US" style="font-size:8pt"> ike=aes256-sha256;modp1536</span></p>
<p><span lang="EN-US" style="font-size:8pt"> ikev2=insist</span></p>
<p><span lang="EN-US" style="font-size:8pt"> ikelifetime=60m</span></p>
<p><span lang="EN-US" style="font-size:8pt"> remote_peer_type=cisco</span></p>
<p><span lang="EN-US" style="font-size:8pt"> fragmentation=yes</span></p>
<p><span lang="EN-US" style="font-size:8pt"> dpdaction=hold</span></p>
<p><span lang="EN-US" style="font-size:8pt"> dpdtimeout=5m</span></p>
<p><span lang="EN-US" style="font-size:8pt"> dpddelay=1</span></p>
<p><span lang="EN-US" style="font-size:8pt"> #aggressive=no</span></p>
<p><span lang="EN-US" style="font-size:8pt"> </span></p>
<p><span lang="EN-US" style="font-size:8pt"> #Phase 2 configuration</span></p>
<p><span lang="EN-US" style="font-size:8pt"> pfs=yes</span></p>
<p><span lang="EN-US" style="font-size:8pt"> phase2=esp</span></p>
<p><span lang="EN-US" style="font-size:8pt"> phase2alg=3des-sha256;modp1536</span></p>
<p><span lang="EN-US" style="font-size:8pt"> salifetime=86400s</span></p>
<p><span lang="EN-US" style="font-size:8pt"> </span></p>
<p><span lang="EN-US" style="font-size:8pt"> #Left configuration</span></p>
<p><span lang="EN-US" style="font-size:8pt"> leftid=192.168.100.108</span></p>
<p><span lang="EN-US" style="font-size:8pt"> left=192.168.100.108</span></p>
<p><span lang="EN-US" style="font-size:8pt"> leftsubnet=<a href="http://192.168.101.0/24" target="_blank">192.168.101.0/24</a></span></p>
<p><span lang="EN-US" style="font-size:8pt"> </span></p>
<p><span lang="EN-US" style="font-size:8pt"> #Right configuration</span></p>
<p><span lang="EN-US" style="font-size:8pt"> rightid=192.168.200.165</span></p>
<p><span lang="EN-US" style="font-size:8pt"> right=192.168.200.165</span></p>
<p><span lang="EN-US" style="font-size:8pt"> rightsubnet=<a href="http://192.168.204.0/24" target="_blank">192.168.204.0/24</a></span></p>
<p><span lang="EN-US"> </span></p>
<p><span lang="EN-US">And for the .secrets file:</span></p>
<p><span lang="EN-US"> </span></p>
<p><span lang="EN-US" style="font-size:8pt">192.168.100.108 : PSK "Spoke_Key"</span></p>
<p><span lang="EN-US" style="font-size:8pt">192.168.200.165 : PSK "Collector_Key"</span></p>
<p><span lang="EN-US"> </span></p>
<p><span lang="EN-US">We have gone through a lot of permutations and combinations in the secrets file.</span></p>
<p><span lang="EN-US"> </span></p>
<p><span lang="EN-US">Some advice would be much appreciated.</span></p>
<br>
</div>
<div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_gmail-m_-755551009368804397gmail-m_-2296168461250925497Signature">
<div></div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin:0cm 0cm 0.0001pt; font-size:12pt; font-family:Calibri,sans-serif">
<a><b><span style="font-size:10pt; font-family:"Source Sans Pro"; color:rgb(11,171,198)">Rene Neumann</span></b></a><span><span style="font-size:10pt; font-family:"Source Sans Pro"; color:rgb(96,109,117)"><br>
</span></span></p>
<br>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Swan mailing list<br>
<a href="mailto:Swan@lists.libreswan.org" target="_blank">Swan@lists.libreswan.org</a><br>
<a href="https://lists.libreswan.org/mailman/listinfo/swan" rel="noreferrer" target="_blank">https://lists.libreswan.org/mailman/listinfo/swan</a><br>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>