Chapter 4

Unsupported Ciphers and Algorithms

1DES (single DES) is not supported by default on Openswan, since this cipher is too weak to use in today's (or even yesterday's) world. Support for 1DES in Pluto needs to be enabled manually before compiling by enabling the -D 1DES option in programs/pluto/Makefile. You will need to change the USE_WEAKSTUFF= option to true in the file Makefile.inc. This will also enable support for the insecure Diffie Hellman dhgroup=1 (modp768). If you try to use a weak cipher or DH group without enabling USE_WEAKSTUFF, you will see an error similar to:

034 esp string error: found modp group id, but not supported, enc_alg="des", auth_alg="sha1", modp="modp768"

1DES and DH group 1 (modp768) are too weak for today's processing power. 1DES can be broken in a matter of hours using special, but dirt cheap, hardware. 768 bit DH keys are also considered extremely insecure.

Sadly, there are still too many old Cisco routers out there that only allow for 1DES encryption, unless you buy some additional license. Those devices should really be replaced or upgraded. 1DES is simply not safe, and Openswan might remove 1DES support altogether in the near future. This is really an issue where you should insist very strongly to the remote party requesting 1DES that their solution is just unacceptable.

Aggressive Mode

Aggressive mode support, which was always part of Openswan 1, has now also been added to Openswan 2. However, the code is entirely different. One of the problems of aggressive mode is that to save that extra round of negotiation from Main Mode, you need to do a lot of expensive Diffie Hellman computing upon sending and receiving the first packet. However, that opens up the possibility of a trivial denial of service attack, by simply sending bogus aggressive mode packets.

Another side effect of aggressive mode is that you must get the IKE and ESP parameters right in your first proposal, since there is no additional room to negotiate. It has to be precisely right after the first packet exchange. The handling of the CPU-intensive tasks has been split off into a separate process called crypto_helper. Pluto can be told how many helper processes to start using the --nhelpers argument. You can also specify nhelpers= in the config setup section of the ipsec.conf file. A value of -1 disables the cryptographic helpers. If this option is not used, Pluto starts two helper processes per CPU. These helper processes get a lower priority than Pluto itself, so the effects of someone trying to flood the system with aggressive mode packets should be minimal. Yet there is another risk: aggressive mode is vulnerable to a brute force attack. Software such as ikecrack has implemented this attack.

Avoid aggressive mode if at all possible.

You can enable aggressive mode per connection with the following option:

aggrmode=yes

103