[strongSwan] charon says "DH group MODP_1024 inacceptable, requesting MODP_1536"

[Harald Dunkel]

Hi folks,

I am trying to connect an ios 9.1 device to strongswan 5.3.3,
using IKEv2. Problem: It doesn't.

Here is the log file:

Oct 27 09:33:25 srvl047 charon: 02[NET] received packet: from 2001:db8:30:fff0:4ff:fc45:f6a4:3860[500] to 2001:db8:13b0:ffff::63[500]
Oct 27 09:33:25 srvl047 charon: 02[NET] waiting for data on sockets
Oct 27 09:33:25 srvl047 charon: 15[MGR] checkout IKE_SA by message
Oct 27 09:33:25 srvl047 charon: 15[MGR] created IKE_SA (unnamed)[5]
Oct 27 09:33:25 srvl047 charon: 15[NET] received packet: from 2001:db8:30:fff0:4ff:fc45:f6a4:3860[500] to 2001:db8:13b0:ffff::63[500] (388 bytes)
Oct 27 09:33:25 srvl047 charon: 15[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
Oct 27 09:33:25 srvl047 charon: 15[CFG] looking for an ike config for 2001:db8:13b0:ffff::63...2001:db8:30:fff0:4ff:fc45:f6a4:3860
Oct 27 09:33:25 srvl047 charon: 15[CFG] candidate: gate.example.com...%any, prio 1052
Oct 27 09:33:25 srvl047 charon: 15[CFG] candidate: gate.example.com...%any, prio 1052
Oct 27 09:33:25 srvl047 charon: 15[CFG] found matching ike config: gate.example.com...%any with prio 1052
Oct 27 09:33:25 srvl047 charon: 15[IKE] 2001:db8:30:fff0:4ff:fc45:f6a4:3860 is initiating an IKE_SA
Oct 27 09:33:25 srvl047 charon: 15[IKE] IKE_SA (unnamed)[5] state change: CREATED => CONNECTING
Oct 27 09:33:25 srvl047 charon: 15[CFG] selecting proposal:
Oct 27 09:33:25 srvl047 charon: 15[CFG] no acceptable ENCRYPTION_ALGORITHM found
Oct 27 09:33:25 srvl047 charon: 15[CFG] selecting proposal:
Oct 27 09:33:25 srvl047 charon: 15[CFG] no acceptable DIFFIE_HELLMAN_GROUP found
Oct 27 09:33:25 srvl047 charon: 15[CFG] selecting proposal:
Oct 27 09:33:25 srvl047 charon: 15[CFG] no acceptable ENCRYPTION_ALGORITHM found
Oct 27 09:33:25 srvl047 charon: 15[CFG] selecting proposal:
Oct 27 09:33:25 srvl047 charon: 15[CFG] no acceptable ENCRYPTION_ALGORITHM found
Oct 27 09:33:25 srvl047 charon: 15[CFG] selecting proposal:
Oct 27 09:33:25 srvl047 charon: 15[CFG] proposal matches
Oct 27 09:33:25 srvl047 charon: 15[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Oct 27 09:33:25 srvl047 charon: 15[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Oct 27 09:33:25 srvl047 charon: 15[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536
Oct 27 09:33:25 srvl047 charon: 15[IKE] sending strongSwan vendor ID
Oct 27 09:33:25 srvl047 charon: 15[IKE] DH group MODP_1024 inacceptable, requesting MODP_1536
Oct 27 09:33:25 srvl047 charon: 15[ENC] generating IKE_SA_INIT response 0 [ N(INVAL_KE) V ]
Oct 27 09:33:25 srvl047 charon: 15[NET] sending packet: from 2001:db8:13b0:ffff::63[500] to 2001:db8:30:fff0:4ff:fc45:f6a4:3860[500] (58 bytes)
Oct 27 09:33:25 srvl047 charon: 15[MGR] checkin and destroy IKE_SA (unnamed)[5]
Oct 27 09:33:25 srvl047 charon: 03[NET] sending packet: from 2001:db8:13b0:ffff::63[500] to 2001:db8:30:fff0:4ff:fc45:f6a4:3860[500]
Oct 27 09:33:25 srvl047 charon: 15[IKE] IKE_SA (unnamed)[5] state change: CONNECTING => DESTROYING
Oct 27 09:33:25 srvl047 charon: 15[MGR] check-in and destroy of IKE_SA successful


Please note that both peers agreed upon a proposal including DH group 5,
but then there is a message "DH group MODP_1024 inacceptable, requesting
MODP_1536". The selected proposal wasn't DH2, so I wonder WTH?


Every helpful comment would be highly appreciated
Regards

Harri

[Tobias Brunner]

Hi Harald,

Post by Harald Dunkel
Please note that both peers agreed upon a proposal including DH group 5,
but then there is a message "DH group MODP_1024 inacceptable, requesting
MODP_1536". The selected proposal wasn't DH2, so I wonder WTH?

Since the initiator has to send its public DH value in the KE payload in
the first IKE_SA_INIT message it has to guess the DH group of the
proposal the peer will select, in this case it guessed MODP_1024.
However, because the selected proposal is with MODP_1536 the public DH
value in the KE payload can't be used so the responder sends back an
INVALID_KE_PAYLOAD notify with the DH group from the selected proposal.
But as is documented at [1] iOS apparently does not support this
particular DH group so this fails.

Regards,
Tobias

[1] https://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)

[Harald Dunkel]

Hi Tobias,

Post by Tobias Brunner
Hi Harald,

Post by Harald Dunkel
Please note that both peers agreed upon a proposal including DH group 5,
but then there is a message "DH group MODP_1024 inacceptable, requesting
MODP_1536". The selected proposal wasn't DH2, so I wonder WTH?

Since the initiator has to send its public DH value in the KE payload in
the first IKE_SA_INIT message it has to guess the DH group of the
proposal the peer will select, in this case it guessed MODP_1024.
However, because the selected proposal is with MODP_1536 the public DH
value in the KE payload can't be used so the responder sends back an
INVALID_KE_PAYLOAD notify with the DH group from the selected proposal.
But as is documented at [1] iOS apparently does not support this
particular DH group so this fails.
Regards,
Tobias
[1] https://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)

Thanx for the pointer. Seems I have missed the update to this wiki page.

If I got you correctly I would have to move back to DH2, just to make
the iphone users happy. Do you know of any commitments from Apple to fix
this?


Regards
Harri

[Tobias Brunner]

Hi Harald,

Post by Harald Dunkel
If I got you correctly I would have to move back to DH2, just to make
the iphone users happy.

Correct, or you use a configuration profile with DiffieHellmanGroup set
to one of the other groups Apple claims to support (I don't know which
of them actually work, though): 2 (Default), 5, 14, 15, 16, 17, or 18.

Post by Harald Dunkel
Do you know of any commitments from Apple to fix this?

No idea. I wasn't the one adding that information to the wiki. But you
could report the bug to Apple to get a rough idea when it is fixed. In
this case they will close your bug report and mark it as duplicate and
you won't get any direct status updates etc. but you can see whether the
original ticket is still open or not.

Regards,
Tobias

[Rayson Zhu]

I met this issue too. I have to change my cipher suite to
aes128-sha-1-modp1024 to connect IOS devices.

Post by Tobias Brunner
Hi Harald,

Post by Harald Dunkel
If I got you correctly I would have to move back to DH2, just to make
the iphone users happy.

Correct, or you use a configuration profile with DiffieHellmanGroup set
to one of the other groups Apple claims to support (I don't know which
of them actually work, though): 2 (Default), 5, 14, 15, 16, 17, or 18.

Post by Harald Dunkel
Do you know of any commitments from Apple to fix this?

No idea. I wasn't the one adding that information to the wiki. But you
could report the bug to Apple to get a rough idea when it is fixed. In
this case they will close your bug report and mark it as duplicate and
you won't get any direct status updates etc. but you can see whether the
original ticket is still open or not.
Regards,
Tobias
_______________________________________________
Users mailing list
https://lists.strongswan.org/mailman/listinfo/users

[Roger Skjetlein]

I found out that this combination works with of the devices out there:
ike = 3des-sha1-modp1024
esp = aes256-sha1,aes192-sha1,aes128-sha1

windows 7 to 10, os x 10.11, ios 8 and 9, android...

Post by Rayson Zhu
I met this issue too. I have to change my cipher suite to
aes128-sha-1-modp1024 to connect IOS devices.

Post by Tobias Brunner
Hi Harald,

Post by Harald Dunkel
If I got you correctly I would have to move back to DH2, just to make
the iphone users happy.

Correct, or you use a configuration profile with DiffieHellmanGroup set
to one of the other groups Apple claims to support (I don't know which
of them actually work, though): 2 (Default), 5, 14, 15, 16, 17, or 18.

Post by Harald Dunkel
Do you know of any commitments from Apple to fix this?

No idea. I wasn't the one adding that information to the wiki. But you
could report the bug to Apple to get a rough idea when it is fixed. In
this case they will close your bug report and mark it as duplicate and
you won't get any direct status updates etc. but you can see whether the
original ticket is still open or not.
Regards,
Tobias
_______________________________________________
Users mailing list
https://lists.strongswan.org/mailman/listinfo/users

_______________________________________________
Users mailing list
https://lists.strongswan.org/mailman/listinfo/users

[Rayson Zhu]

yes, but only if you don't use high encryption.
so sad.

Post by Roger Skjetlein
ike = 3des-sha1-modp1024
esp = aes256-sha1,aes192-sha1,aes128-sha1
windows 7 to 10, os x 10.11, ios 8 and 9, android...

Post by Rayson Zhu
I met this issue too. I have to change my cipher suite to
aes128-sha-1-modp1024 to connect IOS devices.

Post by Tobias Brunner
Hi Harald,

Post by Harald Dunkel
If I got you correctly I would have to move back to DH2, just to make
the iphone users happy.

Correct, or you use a configuration profile with DiffieHellmanGroup set
to one of the other groups Apple claims to support (I don't know which
of them actually work, though): 2 (Default), 5, 14, 15, 16, 17, or 18.

Post by Harald Dunkel
Do you know of any commitments from Apple to fix this?

No idea. I wasn't the one adding that information to the wiki. But you
could report the bug to Apple to get a rough idea when it is fixed. In
this case they will close your bug report and mark it as duplicate and
you won't get any direct status updates etc. but you can see whether the
original ticket is still open or not.
Regards,
Tobias
_______________________________________________
Users mailing list
https://lists.strongswan.org/mailman/listinfo/users

_______________________________________________
Users mailing list
https://lists.strongswan.org/mailman/listinfo/users

--
"Over vidden flyger renen;
efter den i vind og vÊde! -
Bedre det, end bryde stenen
op af fattig jord dernede!"

[Dirk Hartmann]

--On Wednesday, October 28, 2015 05:18:28 PM +0800 Rayson Zhu

Post by Rayson Zhu
yes, but only if you don't use high encryption.
so sad.
On Wed, Oct 28, 2015 at 4:56 PM, Roger Skjetlein

Post by Roger Skjetlein
I found out that this combination works with of the devices out
there: ike = 3des-sha1-modp1024
esp = aes256-sha1,aes192-sha1,aes128-sha1

ike=aes256-sha2_512-modp2048,aes256-sha1-modp1024
esp=aes256-sha2_512,aes256-sha1,aes128-sha1

should work too but you still would have the dangerous modp1024 for
Win7 etc.

Post by Rayson Zhu

Post by Roger Skjetlein
windows 7 to 10, os x 10.11, ios 8 and 9, android...

Post by Rayson Zhu
I met this issue too. I have to change my cipher suite to
aes128-sha-1-modp1024 to connect IOS devices.

Post by Tobias Brunner
Hi Harald,

Post by Harald Dunkel
If I got you correctly I would have to move back to DH2, just to
make the iphone users happy.

Correct, or you use a configuration profile with
DiffieHellmanGroup set to one of the other groups Apple claims to
support (I don't know which of them actually work, though): 2
(Default), 5, 14, 15, 16, 17, or 18.

Post by Harald Dunkel
Do you know of any commitments from Apple to fix this?

No idea. I wasn't the one adding that information to the wiki.
But you could report the bug to Apple to get a rough idea when it
is fixed. In this case they will close your bug report and mark
it as duplicate and you won't get any direct status updates etc.
but you can see whether the original ticket is still open or not.