Subject: [ipsec] maually keyed sa and anti-replay enabled

From: "Younès MELLAL" <[email-masked]>
Date: Tue, 31 Oct 2006 16:04:08 +0100

Hello everyone,
is it possible to enable anti-replay checking  with SAs keyed manually? I
know that it's useless but I wanna do this just fort test purposes. I've
tried this SA :
add fe80::acac:acff:feaa:aa11 fe80::209:5bff:fe0a:b30 esp 0x200 -r 6400 -m
tunnel  -E des-cbc "integrit" -A hmac-md5 "authentication!!";  but it's not
working.
thank you in advance.
Younes
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 31 Oct 2006 11:32:35 -0500

> tunnel  -E des-cbc "integrit" -A hmac-md5 "authentication!!";  but it's not

Define "possible".  Some implementations may permit it, but it's in clear
violation of the spec.  (Using DES instead of AES or 3DES isn't a good
idea, either.)

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb