Hi,
Happy to see that there’s finally support for ECDH groups in IPsec, but there seem to be compatibility issues with strongSwan (5.6.0):
charon[935]: 15[ENC] invalid DH public value size (65 bytes) for ECP_256
charon[935]: 09[ENC] invalid DH public value size (97 bytes) for ECP_384
charon[935]: 11[ENC] invalid DH public value size (133 bytes) for ECP_521
According to crypto/diffie_hellman.c, strongSwan expects one byte less (64, 96, or 132) than RouterOS is trying to send…
Hi!
Maybe you want to post your request as an answer to this post: https://forum.mikrotik.com/viewtopic.php?f=21&t=123936&start=50#p613935. And you may send an email to support@mikrotik.com
greetings, Daniel
Should be fixed in the next release candidate version (6.41rc17 or later). Please let us know if you experience any issues with this version.
Thanks, I tried rc17 and rc18, but:
13[ENC] invalid DH public value size (130 bytes) for ECP_521
13[IKE] remote host is behind NAT
13[IKE] applying DH public value failed
Meanwhile with ecp256 and ecp384:
10[LIB] MAC verification failed
10[ENC] verifying encrypted payload integrity failed
10[ENC] could not decrypt payloads
10[IKE] integrity check failed
10[IKE] IKE_AUTH request with message ID 1 processing failed
(I’m using IKEv2 PSK; so far only tried this with peer configuration, not phase2 proposals yet)
6.41rc21 will contain additional fixes regarding this issue. Please let us know if you experience any issues with this version.