Subject: [Ipsec] twofish ESP testing

From: "Michael Richardson" <[email-masked]>
Date: Sat, 30 Apr 2005 23:30:30 -0400

-----BEGIN PGP SIGNED MESSAGE-----

I wonder if anyone could confirm that the following packet decrypts
properly with twofish, or alternatively, point me at a source of 
twofish/hmac-md5 encrypted ESP packets with keys.

(pcap file is at: http://www.sandelman.ca/tmp/08-sunrise-sunset-twofish.pcap
or: http://anoncvs.openswan.org/cgi-bin/viewcvs.cgi/openswan-2/testing/klips/inputs/08-sunrise-sunset-twofish.pcap?rev=1.1&view=auto
)

If someone needs 3DES (MD5 or SHA1), or AES (128,256)+SHA1 files, they
are also there, and the test cases are there with
testing/klips/{east,west}-icmp-XX.

The keys are:

enckey=0xaaaabbbbccccdddd4043434545464649 
authkey=0x8765876587658765876587658765876587658765

ipsec spi --af inet --edst 192.1.2.45 --spi 0xDED12345 --proto esp --src 192.1.2.23 --esp twofish128-sha1-96 --enckey $enckey --authkey $authkey

10:00:00:64:64:23 > 10:00:00:64:64:45, ethertype IPv4 (0x0800), length 166: IP 192.1.2.23 > 192.1.2.45: ESP(spi=0xded12345,seq=0x1)
        0x0000:  1000 0064 6445 1000 0064 6423 0800 4500  ...ddE...dd#..E.
        0x0010:  0098 b7a9 0000 4032 3e44 c001 0217 c001  ......@2>D......
        0x0020:  022d ded1 2345 0000 0001 4166 e0dd c326  .-..#E....Af...&
        0x0030:  3ffb 9d88 266c 2893 7989 202c 4980 e5e2  ?...&l(.y..,I...
        0x0040:  b89f 360c 4583 a11f 37fc 1738 6626 0422  ..6.E...7..8f&."
        0x0050:  1586 4aa5 533f 2063 038b d362 c91a f4ca  ..J.S?.c...b....
        0x0060:  d4e3 cac0 7bdb b98b f9a6 b5c9 b677 d331  ....{........w.1
        0x0070:  7387 c098 64dd 91c9 0832 e7e1 e682 de52  s...d....2.....R
        0x0080:  6ffa d714 31c9 4fef e9fe 9170 ab44 ef32  o...1.O....p.D.2
        0x0090:  537e 1563 c171 5922 59a5 108c 03f8 b209  S~.c.qY"Y.......
        0x00a0:  f242 9167 d7b2                           .B.g..

Result should be:

10:00:00:ab:cd:ff > 10:00:00:70:72:69, ethertype IPv4 (0x0800), length 98: IP 192.0.2.1 > 192.0.1.1: icmp 64: echo request seq 1280
        0x0000:  1000 0070 7269 1000 00ab cdff 0800 4500  ...pri........E.
        0x0010:  0054 0000 4000 3e01 b9a6 c000 0201 c000  .T..@.>.........
        0x0020:  0101 0800 baf0 6f00 0500 239b c73b f234  ......o...#..;.4
        0x0030:  0100 0809 0a0b 0c0d 0e0f 1011 1213 1415  ................
        0x0040:  1617 1819 1a1b 1c1d 1e1f 2021 2223 2425  ...........!"#$%
        0x0050:  2627 2829 2a2b 2c2d 2e2f 3031 3233 3435  &'()*+,-./012345
        0x0060:  3637                                     67

- -- 
] Michael Richardson          Xelerance Corporation, Ottawa, ON |  firewalls  [
] mcr @ xelerance.com           Now doing IPsec training, see   |net architect[
] http://www.sandelman.ca/mcr/    www.xelerance.com/training/   |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec