<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false">Hi all:</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I am using libreswan to connect to a Cisco 4431 IOS based router.</div><div dir="ltr" data-setdir="false">I am getting this error when using a 12 byte PSK:</div><div dir="ltr" data-setdir="false"><span>Jun 23 16:52:19 [pluto] "XXXX" #2: WARNING: connection XXXX PSK length of 8 bytes is too short for sha PRF in FIPS mode (10 bytes required)</span><br></div><div dir="ltr" data-setdir="false"><span><br></span></div><div dir="ltr" data-setdir="false"><span>Here is the entry in the ipsec.secrets file:</span></div><div dir="ltr" data-setdir="false"><span><span>A.B.C.D : PSK "abcdefrghast"</span><br></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span>The PSK is 12 bytes.</span></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span>What am I missing here?</span></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span>I need to keep the PSK at 12 bytes as some industrial based routers we use in the field has a max of 12 bytes.</span></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span>Is there any work around for this on libreswan?</span></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span>Cheers,</span></span></div><div dir="ltr" data-setdir="false"><span><span>john</span></span></div><div dir="ltr" data-setdir="false"><span><span><br></span></span></div><div dir="ltr" data-setdir="false"><span><span>Cisco details:</span></span></div><div dir="ltr" data-setdir="false"><div><div>CCrouter#sh crypto isakmp policy</div><div><br></div><div>Global IKE policy</div><div>Protection suite of priority 100</div><div><span style="white-space: pre-wrap;"> </span>encryption algorithm:<span style="white-space: pre-wrap;"> </span>AES - Advanced Encryption Standard (256 bit keys).</div><div><span style="white-space: pre-wrap;"> </span>hash algorithm:<span style="white-space: pre-wrap;"> </span>Secure Hash Standard</div><div><span style="white-space: pre-wrap;"> </span>authentication method:<span style="white-space: pre-wrap;"> </span>Pre-Shared Key</div><div><span style="white-space: pre-wrap;"> </span>Diffie-Hellman group:<span style="white-space: pre-wrap;"> </span>#14 (2048 bit)</div><div><span style="white-space: pre-wrap;"> </span>lifetime:<span style="white-space: pre-wrap;"> </span>86400 seconds, no volume limit</div><div><br></div><div dir="ltr" data-setdir="false"><div><div>Transform set mainset: { esp-256-aes esp-sha-hmac } </div><div> will negotiate = { Tunnel, }, </div><div><br></div></div><br></div><div><br></div></div><div><br></div></div></div></body></html>