Quantcast
Channel: All ScreenOS Firewalls (NOT SRX) posts
Viewing all articles
Browse latest Browse all 2577

HMAC-SHA256 backward compatibility to 128 bits

$
0
0

Hello Team,

 

Hope you are doing well.

I just want an advise from you. Indeed, I am using ScreenOS :

 

Software Version: 6.3.0r13.0, Type: Firewall+VPN

 

I am configuring a VPN and my partener is requiring HMAC-SHA256 to be set at 128 bit for IKEv1 phase 2 negociation.

This is based on what we got from logs :

 

chip info: DMA. Tunnel id 000000c0
(vn2)  doing ESP encryption and size =96
ipsec encrypt prepare engine done
ipsec encrypt set engine done
ipsec encrypt engine released
ipsec encrypt done

 

I have checked some website contents (juniper, etc.) and come to find the below item :

 

http://kb.juniper.net/InfoCenter/index?page=content&id=KB22197&actp=search&viewlocale=en_US&searchid=1296419897921&smlogin=true

 

 

Summary:

As of ScreenOS version 6.3r5, the truncation lengths of HMAC-SHA-256 in IPsec have been changed to 128 bits to comply with RFC4868. To allow interoperability with earlier ScreenOS versions, "set envar hmac-sha256-96=yes" is introduced.

 

Problem or Goal:

For IKE Phase 2 negotiations, the early ScreenOS implemented authentication algorithm HMAC-SHA2-256 with the truncation lengths of 96 bits.  This truncation length does not comply with RFC4868. To comply with RFC4868, the truncation lengths have been changed to 128 bits after ScreenOS version 6.3r5.  The change in truncation lengths after ScreenOS version 6.3r5 causes it not to interoperate with earlier ScreenOS versions which use HMAC-SHA-256 with 96-bit truncation lengths.  The change affects both IKEv1 and IKEv2.

This will allow Phase 2 negotiation to complete between an HMAC-SHA-256-128 negotiator and non-standard HMAC-SHA-256-96 negotiator, but receiving ESP packets will be dropped due to invalid ESP payload lengths.

 

---------------------

----------------------

 

Based on this, I understood that since ScreenOS version 6.3r5, the truncation lengths of HMAC-SHA-256 in IPsec have been changed to 128 bits. Is that default value ?

 

1. Do we have any way for checking the current configured bits ?

2. Is there a possibiltiy to change this value in case 96 bits is configured at this moment ?

3. I was looking the command to change this value and I found "set envar hmac-sha256-96=yes". Should I change 96 to 128. If so, shall I need to restart the box after ?

 

Any other advises is welcome,

 

Thanks

 

 

 


Viewing all articles
Browse latest Browse all 2577

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>