netdev - Re: [PATCH] Fix ESP SA loading (by default)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081101050458.GA17807@gondor.apana.org.au>
Date:	Sat, 1 Nov 2008 13:04:58 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Alexey Dobriyan <adobriyan@...il.com>
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH] Fix ESP SA loading (by default)

On Sat, Nov 01, 2008 at 07:37:37AM +0300, Alexey Dobriyan wrote:
> digest_null algorithm is now mandatory for ESP.
> 
> Steps to reproduce:
> 
> 	kernel with CONFIG_CRYPTO_NULL=n
> 
> 	#!/usr/sbin/setkey -f
> 	flush;
> 	spdflush;
> 	add 192.168.0.1 192.168.0.42 esp 15701 -E 3des-cbc "123456789012123456789012";

You do realise that this is totally insecure against man-in-the-
middle attacks, right?

We don't make ESP depend on every single algorithm out there.
It is the user's responsibility to turn on esoteric choices.
IMHO the use of encryption without authentication is definitely
non-standard.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html