Subject: RE: [Ipsec] Integrity key size

From: [email-masked]
Date: Fri, 29 Jul 2005 11:08:15 +0300

Alejandro Pérez Méndez wrote:
>
> Another thing: Linux IPsec stack has SHA1 and MD5 integrity 
> algorithms, but they use all bytes, not only the first 96 bits 
> as SHA1_96 and MD5_96 do. What is the Transform id that must be 
> included in the PAYLOAD_SA on the CREATE_CHILD_SA exchange to 
> negociate them?

As far as I know, Linux IPsec stack does not support HMAC_SHA1_160 
or HMAC_MD5_128, only the *_96 versions. (Supporting them would 
be easy, but there's no real security advantage over the *_96
versions, only more per-packet overhead.)

But if it does, there's currently no standard way to negotiate them 
using IKEv2, because they don't have assigned transform IDs.

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec