Re: [Design] Re: [Users] multiple ipsec.secrets entries

Paul Wouters wrote:
> On Fri, 28 Feb 2003, Andreas Steffen wrote:

>>Certificate based connections always find the correct
>>private key in ipsec.secret because a link to the
>>certificate loaded via the leftcert command is maintained in
>>the connection description which allows to match the public
>>key contained in the certificate to the public key in the
>>private key representation.

This cannot be true. If roadwarrior connection definitions exists FreeS/WAN as a responder will first try these before falling back to opportunistic mode. Can you provide a barf?

> 3) opportunistc encryption failed, road warrior doesnt support it

Actually this has nothing to do with the selection of private keys but rather with the simultaneous interaction of opportunistic mode and "normal" roadwarrior connections.

> I might be wrong in the inner workings of Pluto, but the OE connection

Again, please provide a barf.

>

>>- Although not mandatory, the local public key can be defined
>>   in connections based on raw RSA keys by using the leftrsasigkey
>>   parameter. Since X.509-1.1.6 for freeswan-2.00 alread supports
>>   both X.509 and OpenPGP certificates, as a thirk class, a link to
>>   the raw public key could be created in the connection description
>>   which would allow the private key to be found in ipsec.secrets
>>   irrespective of its position in the list.

>>This would also introduce
>>   support of multiple RSA private keys in roadwarrior connections based
>>   on raw RSA public keys. I could implement this feature within
>>   the next month but for freeswan-2.00, only.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

Regards

Andreas

Andreas Steffen                   e-mail: andreas.steffen@strongsec.com
strongSec GmbH                    home:   
http://www.strongsec.com
Alter Zürichweg 20                phone:  +41 1 730 80 64

==========================================[strong internet security]===

Content Security by MailMarshal