Bastiaans IPSec page

On this page I'll publish all my IPSec related work. Currently this consists of a small patch to FreeS/WAN a free implementation of IPSec for Linux. It is part of a project for addding tamper resistant authentication to FreeS/WAN I perform together with Ruediger Weis and Stefan Lucks. The results have been presented at the SANE 2000 conference, held May 22-25, Maastricht, the Netherlands. The paper submitted to the conference is available: BakkerWeisLucksIPSecSANE2000.ps.

The patch allows shared secrets to be stored in a more secure place than the file system, for example a smartcard. The patch checks whether a shared secret in /etc/ipsec.secrets starts with the string 'exec '. If so, the rest of the secret will be assumed to represent a command plus arguments and executed when the real value of the secret is needed. The
command returns either the shared secret itself or the calculated skeyid.

Communication between Pluto and the command is handled via environment variables and standard output: Pluto sets the following variables:

NONCE_I = the initiator nonce in hex format
NONCE_R = the responder nonce in hex format
HASHTYPE = the hash type, either 'OAKLEY_SHA', 'OAKLEY_MD5' or 'OAKLEY_TIGER'

THIS_ADDR = the IP address of the local end
THAT_ADDR = the IP address of the remote end
CONN_NAME = the name of the connection

The command returns its result via stdout in a single line in the format <resulttype>=<value>, where <resulttype> is one of 'SKEYID',
'SHARED_SECRET' or 'ERROR'.
In case of 'SKEYID' Pluto will try to decode <value> using atobytes() and use the result as skeyid.
In case of 'SHARED_SECRET' <value> may be also be encoded as quoted ASCII string. Pluto will use the result to calculate the skeyid itself, just like with a 'normal' shared secret stored in /etc/ipsec.conf
With 'ERROR' the command indicates that some error occured. <value> contains the error message.

Software

The patch to FreeS/WAN 1.3: freeswan.exec.patch.
A small example Perl script for skeyid calculation: calcHMAC.pl.
iButton based authentication for FreeS/WAN: freeswanibutton.tgz

If you have sugestions or questions, please mail at bastiaan.bakker@lifeline.nl