Ticket #26: scapysec.2.html

File scapysec.2.html, 46.0 kB (added by frederic.roudaut@free.fr, 2 years ago)

doc update

Line 
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2 <html xmlns="http://www.w3.org/1999/xhtml">
3 <head>
4
5
6  
7   <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
8
9
10
11  
12  
13   <title>Document sans nom</title>
14   <style type="text/css">
15 <!--
16 .Style1 {color: #FF0000}
17 .Style2 {font-family: Arial, Helvetica, sans-serif}
18 .Style3 {
19         color: #000000;
20         font-weight: bold;
21 }
22 .Style4 {font-family: Arial, Helvetica, sans-serif; font-style: italic; }
23 .Style5 {font-family: "Courier New", Courier, monospace}
24 .Style6 {color: #0080FF}
25 .Style7 {font-family: Arial, Helvetica, sans-serif; color: #0080FF; }
26 .Style8 {font-family: Arial, Helvetica, sans-serif; color: #0080FF; font-weight: bold; }
27 -->
28   </style>
29 </head>
30
31
32 <body>
33
34
35
36 <p class="Style2"><span class="Style3">README : Scapysec v1.0 (IPsec
37 for Scapy)</span><br />
38
39
40   </p>
41
42 <hr style="width: 100%; height: 2px;" />
43 <p class="Style4"><font size="-1"> Author: Frederic ROUDAUT <br />
44
45
46   (frederic.roudaut@free.fr)</font></p>
47
48
49 <p class="Style4"><font size="-1"> Date : 2006</font></p>
50
51
52 <hr style="width: 100%; height: 2px;" />
53 <p class="Style2">&nbsp;</p>
54
55
56 <p class="Style8"><small><a href="#chap1">1 - INTRODUCTION : Scapy &amp; Scapysec</a><br />
57
58
59   <a href="#chap2">2 - OVERVIEW</a><br />
60
61
62   <a href="#chap3">3 - NEEDS AND INSTALLATION</a><br />
63
64
65   <a href="#chap4">4 - THE ESP CLASS</a><br />
66
67
68   <a href="#chap5">5 - SECURITY ASSOCIATIONS DATABASE (SAD)</a><br />
69
70
71   <a href="#chap5_1">5.1 - PACKET MATCHING WITH SA</a><br />
72
73
74   <a href="#chap5_2">5.2 - ENCRYPTION ALGORITHMS</a><br />
75
76
77   <a href="#chap5_3">5.3 - AUTHENTICATION ALGORITHM</a><br />
78
79
80   <a href="#chap5_4">5.4 - SETTING THE SAD</a><br />
81
82
83   <a href="#chap5_4_1">5.4.1 - ADDING A SA</a><br />
84
85
86   <a href="#chap5_4_2">5.4.2 - DELETING A SA</a><br />
87
88
89   <a href="#chap5_4_3">5.4.3 - CLEARING THE DATABASE</a><br />
90
91
92   <a href="#chap6">6 - ENCRYPTION ON THE FLIGHT : IPsec Class</a><br />
93
94
95   <a href="#chap7">7 - WHAT'S MORE</a><br />
96
97
98   <a href="#chap8">8 - UPDATE</a><br />
99
100
101   <a href="#chap9">9 - POSSIBLE EXTENSIONS</a><br />
102
103
104   <a href="#chap10">10 - CREDITS AND LICENCE</a><br />
105
106
107   <a href="#chap11">11 - BUGS</a></small></p>
108
109
110 <p class="Style8"><small><a href="#chapA">ANNEX A - IPSEC ALGORITHMS AND KEYS</a><br />
111
112
113   <a href="#chapA.1">A.1 - ESP ALGORITHMS</a><br />
114
115
116   <a href="#chapA.1.1">A.1.1 - REQUIREMENTS</a><br />
117
118
119   <a href="#chapA.1.2">A.1.2 : TripleDES-CBC [RFC2451]</a><br />
120
121
122   <a href="#chapA.1.3">A.1.3 : AES-CBC with 128-bit keys [RFC3602]</a><br />
123
124
125   <a href="#chapA.1.4">A.1.4 : AES-CTR [RFC3686]</a><br />
126
127
128   <a href="#chapA.1.5">A.1.5 : DES-CBC [RFC2405]</a><br />
129
130
131   <a href="#chapA.1.6">A.1.6 : BLOWFISH-CBC [RFC2451]</a><br />
132
133
134   <a href="#chapA.1.7">A.1.7 : HMAC-MD5-96 [RFC2403]</a><br />
135
136
137   <a href="#chapA.1.8">A.1.8 : HMAC-SHA1-96 [RFC2404]</a><br />
138
139
140   <a href="#chapA.1.9">A.1.9 : HMAC-SHA256</a></small></p>
141
142
143 <p class="Style7">&nbsp;</p>
144
145
146 <span style="font-family: Arial,Helvetica,sans-serif;"></span>
147 <hr style="width: 100%; height: 2px;" /><span style="font-family: Arial,Helvetica,sans-serif;"></span>
148 <h2 class="Style2"><small><span class="Style6">1 - INTRODUCTION : Scapy &amp; Scapysec</span><a name="chap1" id="chap1"></a></small><br />
149
150
151 </h2>
152
153
154 <p class="Style2"><small>"Scapy (<a href="http://www.secdev.org/projects/scapy/">http://www.secdev.org/projects/scapy/</a>)
155 is a powerful interactive packet manipulation program. It is able to
156 forge or decode packets of a wide number of protocols, send them on the
157 wire, capture them, match requests and replies, and much more. It can
158 easily handle most classical tasks like scanning, tracerouting,
159 probing, unit tests, attacks or network discovery (it can replace
160 hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f,
161 etc.). It also performs very well at a lot of other specific tasks that
162 most other tools can't handle, like sending invalid frames, injecting
163 your own 802.11 frames, combining technics (VLAN hopping+ARP cache
164 poisoning, VOIP decoding on WEP encrypted channel, ...), etc"</small></p>
165
166
167
168 <p><small> Scapy6 (<a href="http://namabiiru.hongo.wide.ad.jp/scapy6/">http://namabiiru.hongo.wide.ad.jp/scapy6/</a>)
169 is an extension to handle IPv6 Packets.   
170 </small></p>
171
172
173
174 <p class="Style2"><small>Scapysec aims is to extend Scapy to handle
175 IPsec packets with IPv4 or IPv6. Ie to encode/decode IPsec packets,
176 generate any valid/invalid IPsec Packet using different encryption and
177 authentication algorithms. <br />
178
179 On this basis, some more complex applications could be build up.&nbsp;</small></p>
180
181 <p class="Style2"><small>Currently, Scapysec supports ESP with :</small></p>
182
183
184 <p class="Style2"><small><strong>&nbsp;&nbsp;&nbsp; Encryption Algorithm</strong> (Key Lengths in bits) &lt;block length in bytes&gt;<br />
185
186
187   </small></p>
188
189 <ul>
190
191  
192   <ul>
193
194     <li><small><small><big><strong>NULL</strong> : (Any)</big><strong></strong></small></small></li>
195
196     <li><small><strong>TripleDES-CBC</strong> [RFC2451] : (192) &lt;8&gt;<strong></strong></small></li>
197
198     <li><small><strong>AES-CBC</strong> [RFC3602] : (128/192/256) &lt;16&gt;<strong></strong></small></li>
199
200     <li><small><strong>AES-CTR </strong>[RFC3686] : (160/224/288) The remaining 32 bits will be used as nonce. &lt;16&gt;<strong></strong></small></li>
201
202     <li><small><strong>DES-CBC</strong> [RFC2405] : (64) &lt;8&gt;<strong></strong></small></li>
203
204     <li><small><strong>BLOWFISH-CBC</strong> : (128) &lt;8&gt;<small><strong></strong></small></small></li>
205
206     <li><small><strong>CAST-CBC</strong> : (Any) &lt;8&gt;</small></li>
207
208  
209   </ul>
210
211 </ul>
212
213
214 <p class="Style2"><small><strong>&nbsp;&nbsp;&nbsp; Authentication Algorithm</strong> (Key Lengths in bits)<br />
215
216
217   </small></p>
218
219 <ul>
220
221  
222   <ul>
223
224     <li><small><small><big><strong>NULL</strong></big><strong><span style="font-family: Arial,Helvetica,sans-serif;"></span></strong></small></small></li>
225
226     <li><small><strong><span style="font-family: Arial,Helvetica,sans-serif;"></span>HMAC-SHA1-96</strong> [RFC2404] : (Any)<strong><span style="font-family: Arial,Helvetica,sans-serif;"></span></strong></small></li>
227
228     <li><small><strong><span style="font-family: Arial,Helvetica,sans-serif;"></span>HMAC-MD5-96</strong> [RFC2403] : (Any)<small><strong><span style="font-family: Arial,Helvetica,sans-serif;"></span></strong></small></small></li>
229
230     <li><small><small><strong><span style="font-family: Arial,Helvetica,sans-serif;"></span><big>HMAC-SHA256</big></strong><big> : (Any)</big></small></small></li>
231
232  
233   </ul>
234
235 </ul>
236
237
238 <p>&nbsp;</p>
239
240 <hr style="width: 100%; height: 2px;" />
241 <h2 class="Style2"><small><span class="Style6">2 - OVERVIEW</span><a name="chap2" id="chap2"></a><br />
242
243
244 </small></h2>
245
246
247 <p class="Style2"><small>The example will be explained later but shows how it is simple to generate encrypted IPsec packets. </small></p>
248
249
250 <p><small><span class="Style1">&gt;&gt;&gt;</span> q = IP(dst="192.168.0.6")/ESP(spi=5)/TCP()<br />
251
252
253   <span class="Style1">&gt;&gt;&gt;</span> q.show2()</small></p>
254
255
256 <p><small>== IPv4 IPsec SA Used for: &lt;Src: 192.168.0.2&gt; &lt;Dst: 192.168.0.6&gt; &lt;Spi: 5&gt; ==<br />
257
258
259   &lt;Src: *&gt; &lt;Dst: 192.168.0.6&gt; &lt;Spi: *&gt;<br />
260
261
262   Crypt Algo: AES-CTR<br />
263
264
265   Crypt Key: 00001234abc12ffffbc1<br />
266
267
268   Auth Algo: HMAC-MD5<br />
269
270
271   Auth Key: 5632abc1azefvc</small></p>
272
273
274 <p><small><span class="Style1">###[ IP ]###</span><br />
275
276
277   version= 4L<br />
278
279
280   ihl= 5L<br />
281
282
283   tos= 0x0<br />
284
285
286   len= 80<br />
287
288
289   id= 1<br />
290
291
292   flags=<br />
293
294
295   frag= 0L<br />
296
297
298   ttl= 64<br />
299
300
301   proto= IPv6-Crypt<br />
302
303
304   chksum= 0xf922<br />
305
306
307   src= 192.168.0.2<br />
308
309
310   dst= 192.168.0.6<br />
311
312
313   options= ''<br />
314
315
316   <span class="Style1">###[ ESP ]###</span><br />
317
318
319   spi= 0x5L<br />
320
321
322   seq= 0L<br />
323
324
325   data= 0<br />
326
327
328   iv= '\xc7\xaem\xba&lt;\x08i\x93'<br />
329
330
331   pad= 'XyYkQx8RDl'<br />
332
333
334   padlen= 10<br />
335
336
337   nh= TCP<br />
338
339
340   authentication= '\n\xf8[\x1a\xe0\xaf\xc1\xab4f\x0f\xda'<br />
341
342
343   <span class="Style1">###[ TCP ]###</span><br />
344
345
346   sport= ftp-data<br />
347
348
349   dport= http<br />
350
351
352   seq= 0L<br />
353
354
355   ack= 0L<br />
356
357
358   dataofs= 5L<br />
359
360
361   reserved= 0L<br />
362
363
364   flags= S<br />
365
366
367   window= 8192<br />
368
369
370   chksum= 0xe26<br />
371
372
373   urgptr= 0<br />
374
375
376   options= {}<br />
377
378
379   <span class="Style1">&gt;&gt;&gt;</span> q.show2()</small></p>
380
381
382 <p><small><span class="Style2">In this example we have several things. Indeed the packet matchs what we will call a Security Association:</span><br />
383
384
385   &lt;Src: *&gt; &lt;Dst: 192.168.0.6&gt; &lt;Spi: *&gt;<br />
386
387
388   <span class="Style2">Then the packet is created. All the fields are
389 filled, the packet is encrypted and the authentication is computed and
390 appended according to the Algorithm specified in the Security
391 Association</span></small></p>
392
393
394 <p class="Style2"><small>When q.show2() is called, the reverse is done.
395 The security Association matching the packet is found and the packet is
396 decrypted before the printing as it has been sent by another host on the network.</small></p>
397
398
399 <p><small>&nbsp;</small></p>
400
401 <hr style="width: 100%; height: 2px;" />
402 <h2 class="Style2"><small><span class="Style6">3 - NEEDS AND INSTALLATION</span><a name="chap3" id="chap3"></a><br />
403
404
405 </small></h2>
406
407
408 <p class="Style2"><small>Scapysec uses the Python language 2.3 or
409 upcomming versions. There is no paticular need. You just need to have
410 scapy.py and scapy6.py if you want to be able to generate IPsec packets
411 with IPv6. You also need pycrypto since all the encryption/decryption
412 is done using this library.</small></p>
413
414
415 <p><small><span class="Style2">just do : </span>python ./scapysec.py</small></p>
416
417
418 <p class="Style2"><small>Oups, you also need a few adaptions to Scapy. <br />
419
420
421   Normaly it should be included with this file. If not you may
422   download it to :<br />
423
424 <a href="http://roudaut.frederic.free.fr/data/scapysec/scapy.py">http://roudaut.frederic.free.fr/data/scapysec/scapy.py</a>.
425  </small></p>
426
427
428 <p class="Style2"><small>
429   Scapy6 may be downloaded to <a href="http://namabiiru.hongo.wide.ad.jp/scapy6/"> http://namabiiru.hongo.wide.ad.jp/scapy6/  </a>.
430  </small></p>
431
432
433
434  
435  
436 <p><small>&nbsp;</small></p>
437
438 <hr style="width: 100%; height: 2px;" />
439 <h2 class="Style2"><small><span class="Style6">4 - The ESP CLASS</span><a name="chap4" id="chap4"></a><br />
440
441
442 </small></h2>
443
444
445 <p class="Style2"><small>The different fields of the ESP layer may be seen using ls()<br />
446
447
448   If you do not know about Scapy, this command gives the field name, the type, the value and the default value for this field</small></p>
449
450
451 <p><small><span class="Style1">&gt;&gt;&gt;</span> ls(ESP())<br />
452
453
454   spi        : XIntField            = 0               (0)<br />
455
456
457   seq        : IntField             = 0               (0)<br />
458
459
460   data       : StrField             = None            (None)<br />
461
462
463   iv         : StrField             = None            (None)<br />
464
465
466   pad        : StrField             = None            (None)<br />
467
468
469   padlen     : ByteField            = None            (None)<br />
470
471
472   nh         : ByteEnumField        = None            (None)<br />
473
474
475   authentication : StrField             = None            (None)<br />
476
477
478 </small></p>
479
480
481 <p><small>The fields are the following : <br />
482
483
484   - spi : Security Parameters Index<br />
485
486
487   - seq : Sequence Number<br />
488
489
490   - data : data field is used to give directly encrypted data for iv + pad + padlen + nh<br />
491
492
493   - iv : Initialization Vector. Computed if not set. The size is<br />
494
495
496   precised by the Encryption Algorithm<br />
497
498
499   - pad : Filled if not set and depending from the Encryption Algorithm<br />
500
501
502   - padlen : Pad length. Computed if not set<br />
503
504
505   - nh : Next Header. Set if not set<br />
506
507
508   - authentication : Computed if available<br />
509
510
511 </small></p>
512
513
514 <p class="Style2"><small>pad, padlen and iv lengths are depending from
515 the Encryption Algorithms. As you may create packets that will fail
516 with Encryption, they will be corrected if inadequate.</small></p>
517
518
519 <p class="Style2"><small>The data field will be used to directly give encrypted data for iv + pad + padlen + nh</small></p>
520
521
522 <p class="Style2"><small>As you may see, you now have to find a way to indicate:<br />
523
524 </small></p>
525
526 <ul>
527
528   <li><small>
529   the Encryption Algorithm</small><span style="font-family: Arial,Helvetica,sans-serif;"></span></li>
530
531   <li><span style="font-family: Arial,Helvetica,sans-serif;"></span><font size="-1">the Encryption Key<span style="font-family: Arial,Helvetica,sans-serif;"></span></font></li>
532
533   <li><font size="-1"><span style="font-family: Arial,Helvetica,sans-serif;"></span>the Authentication Algorithm<span style="font-family: Arial,Helvetica,sans-serif;"></span></font></li>
534
535   <li><small><font size="-1"><span style="font-family: Arial,Helvetica,sans-serif;"></span></font>the Authentication Key</small></li>
536
537 </ul>
538
539
540 <p class="Style2"><small>These elements will be indicated in the Security Associations Database</small></p>
541
542
543 <p class="Style2"><small>&nbsp;</small></p>
544
545 <hr style="width: 100%; height: 2px;" />
546 <h2 class="Style2"><small><span class="Style6">5 - SECURITY ASSOCIATIONS DATABASE (SAD)</span><a name="chap5" id="chap5"></a><br />
547
548
549 </small></h2>
550
551
552 <p class="Style2"><small>Here is an example of the SAD<br />
553
554
555 </small></p>
556
557
558 <p><small>ipsec_sad_example = {'IPV4' :
559 [['192.168.0.2','192.168.0.1','5','ESP','BLOWFISH-CBC','azdregrnytnytftg','HMAC-SHA1','ecuheznbevnbevabgj'],\<br />
560
561
562   ['192.168.*.2','192.168.0.5','5','ESP','DES-CBC','5632abc1','HMAC-SHA1','5632abc1azefvc'],\<br />
563
564
565   ['192.168.0.2','192.168.0.3','0x0**0**05','ESP','AES-CBC','1234abc12ffffbc1','HMAC-SHA1','5632abc1azefvc'],\<br />
566
567
568   ['192.168.0.2','192.168.0.7','*','ESP','AES-CBC','1234abc12ffffbc1','HMAC-SHA256','5llll632abc1azefvc'],\<br />
569
570
571   ['*','192.168.0.6','*','ESP','AES-CTR','1234abc12ffffbc1','HMAC-MD5','5632abc1azefvc'],\<br />
572
573
574   ['192.168.*.2','192.168.0.8','*','ESP','DES-CBC','5632abcuyfyuf1','HMAC-SHA1','5632abc1azefvc'],\<br />
575
576
577   ['192.168.*.2','192.168.0.12','*','ESP','DES-CBC','5632abcuyfyuf1','HMAC-MD5','5632abc1azefvc'],\<br />
578
579
580   ['192.168.0.2','192.*.0.4','*','ESP','NULL','','NULL','']],\<br />
581
582
583   'IPV6' : [['*','fe80::240:96ff:fea7:c5d1','5','ESP','DES-CBC','5632abc1','HMAC-SHA1','5632abc1azefvc'],\<br />
584
585
586   ['*','3ffe::3','0x0**0**05','ESP','AES-CBC','1234abc12ffffbc1','HMAC-SHA1','5632abc1azefvc'],\<br />
587
588
589   ['','3f*e::4','*','ESP','AES-CBC','1234abc12ffffbc1','HMAC-SHA256','5llll632abc1azefvc']]}<br />
590
591
592 </small></p>
593
594
595 <p class="Style2"><small>The SAD is a dictionnary {'IPV4':[],'IPV6':[]}<br />
596
597
598   One entry is for IPv4, the other one is for IPv6. <br />
599
600
601   Each one contains a list of Security Associations (SAs).<br />
602
603
604   The SA described hereafter gives:<br />
605
606 </small></p>
607
608 <ul>
609
610   <li><small>
611   the source address filter: '192.168.0.2'<span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
612
613   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the destination address filter: '192.168.0.1'<span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
614
615   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the SPI filter: '5'<span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
616
617   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the protocol: 'AH' or 'ESP' :&nbsp;<span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
618
619   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the Encryption Algorithm : 'BLOWFISH-CBC'<span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
620
621   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the Encryption Key : 'azdregrnytnytftg'<span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
622
623   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the Authentication Algorithm : 'HMAC-SHA1'</small><small><span style="font-family: Arial,Helvetica,sans-serif;"></span></small></li>
624
625   <li><small><span style="font-family: Arial,Helvetica,sans-serif;"></span>the Authentication Key : 'ecuheznbevnbevabgj'</small></li>
626
627 </ul>
628
629
630 <p><small>['192.168.0.2','192.168.0.1','5','ESP','BLOWFISH-CBC','azdregrnytnytftg','HMAC-SHA1','ecuheznbevnbevabgj']<br />
631
632
633 </small></p>
634
635
636 <p class="Style2"><small>When an IPsec Packet is sent or received, the
637 corresponding SAD entry (IPv4 or IPv6) is checked. If the packet is
638 catched by one security association, it will be encrypted or decrypted
639 using the associated algorithms and keys. </small></p>
640
641
642 <p><small>&nbsp;</small></p>
643
644 <hr style="width: 100%; height: 2px;" />
645 <h2 class="Style2"><small><span class="Style6">5.1 - PACKET MATCHING WITH SA</span><a name="chap5_1" id="chap5_1"></a><br />
646
647
648 </small></h2>
649
650
651 <p class="Style2"><small>An IPsec packet is catched by a security
652 association if its source, destination address and SPI match a
653 corresponding entry in the SAD. The matching uses the wildcard '*'.</small></p>
654
655
656 <p><small><span class="Style2">Address are string. It may be IPv4 (</span>'192.168.0.2'<span class="Style2">) or any IPv6 address</span><span style="font-family: Arial,Helvetica,sans-serif;"> </span>('3FFE::1'<span class="Style2"> or </span>'fe80::240:96ff:fea7:c5d0'<span class="Style2">) </span><span class="Style2">You may use</span> '*'<span class="Style2"> to indicate any address or</span> '*' <span class="Style2">in the address string.<br />
657
658
659   For IPv4, we then may have </span>'192.168.*.2'<span class="Style2">. Each</span> '*' <span class="Style2">means 1 byte. <br />
660
661
662   For IPv6, each</span> '*' <span class="Style2">means 4 bits. (</span>'3FF*::1', 'fe80::240:96ff:fea7:c5d0'<span class="Style2">)</span></small></p>
663
664
665 <p><small><span class="Style2">The SPI is a string but it may represent an integer value (</span>'8') <span class="Style2">or an hexadecimal value (</span>'0x23'<span class="Style2">).</span> <br />
666
667
668   <span class="Style2">You also may use</span> '*'<span class="Style2"> to indicate any SPI or even</span> '*' <span class="Style2">in the hexadecimal SPI string as</span> '0x34*6'.<span class="Style2"> In this case we do not mind about the hexadecimal value between the</span> '4' <span class="Style2">and the </span>'6'.</small></p>
669
670 <p><small> </small></p>
671
672
673 <hr style="width: 100%; height: 2px;" />
674 <h2 class="Style2"><small><span class="Style6">5.2 - ENCRYPTION ALGORITHMS</span><a name="chap5_2" id="chap5_2"></a><br />
675
676
677 </small></h2>
678
679
680 <p class="Style2"><small>The Encryption Algorithms available are the following:<br />
681
682
683   Between () we give the key length available in bits.<br />
684
685
686   Between &lt;&gt; we indicate the block size in bytes</small></p>
687
688
689 <ul>
690
691   <li><small>NULL               : (Any)</small></li>
692
693   <li><small>3DES-CBC [RFC2451] : (192) &lt;8&gt;</small></li>
694
695   <li><small>AES-CBC            : (128/192/256) &lt;16&gt;</small></li>
696
697   <li><small>AES-CTR            : (160/224/288) The remaining 32 bits will be used as nonce. &lt;16&gt;</small></li>
698
699   <li><small>DES-CBC [RFC2405]  : (64) &lt;8&gt;</small></li>
700
701   <li><small>BLOWFISH-CBC       : (128) &lt;8&gt;</small></li>
702
703   <li><small>CAST-CBC           : (Any) &lt;8&gt;<br />
704
705
706     </small></li>
707
708 </ul>
709
710
711 <p class="Style2"><small>A key with an incorrect length will not be used. Instead it may be truncated or enhanced.</small></p>
712
713 <br />
714
715 <hr style="width: 100%; height: 2px;" />
716 <h2 class="Style2"><small><span class="Style6">5.3 - AUTHENTICATION ALGORITHM</span><a name="chap5_3" id="chap5_3"></a><br />
717
718
719 </small></h2>
720
721
722 <p class="Style2"><small>The Authentication Algorithms available are the following:<br />
723
724
725   Between () we give the key length available.</small></p>
726
727
728 <ul>
729
730   <li><small>NULL                   : (Any)</small></li>
731
732   <li><small>HMAC-SHA1-96 [RFC2404] : (Any)</small></li>
733
734   <li><small>HMAC-MD5-96 [RFC2403]  : (Any)</small></li>
735
736   <li><small>HMAC-SHA256            : (Any)<br />
737
738
739     </small></li>
740
741 </ul>
742
743
744 <p class="Style2"><small>A key with an incorrect length will not be used. Instead it may be truncated or enhanced.</small></p>
745
746
747 <p><small>&nbsp;</small></p>
748
749
750 <hr style="width: 100%; height: 2px;" />
751 <h2 class="Style2"><small><span class="Style6">5.4 - SETTING THE SAD</span><a name="chap5_4" id="chap5_4"></a><br />
752
753
754 </small></h2>
755
756
757 <p><small><span class="Style2">The conf Instance has been enhanced with a setkey variable that uses the</span> _IPSEC_SAD <span class="Style2">Python Class.</span></small></p>
758
759
760 <p class="Style2"><small>Then if you do conf.setkey you get the current SAD</small></p>
761
762
763 <p><small><span class="Style1">&gt;&gt;&gt;</span> conf.setkey<br />
764
765
766   == IPv4 Security Associations ==<br />
767
768
769   &lt;Src : 192.168.0.2&gt;   &lt;Dst : 192.168.0.1&gt;   &lt;SPI : 5&gt;<br />
770
771
772   Mode ESP<br />
773
774
775   Crypt Algo : BLOWFISH-CBC   Crypt Key : azdregrnytnytftg<br />
776
777
778   Auth Algo  : HMAC-SHA1   Auth Key : ecuheznbevnbevabgj</small></p>
779
780
781 <p><small&