0

I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails:

ip xfrm state add src 0.0.0.0 dst 192.168.121.138 proto esp spi 0x201 enc des3_ede 0x8a718c734f68865738a3d9780e49cc2f52c40ef9fa368acc mode transport

RTNETLINK answers: No such file or directory

If I remove the fips=1 parameter from the kernel statement it succeeds. Does anyone know why?

Alternatively, if I leave the fips=1 parameter in the kernel grub statement but include an AH key (even if it's an empty string) then it succeeds.

ip xfrm state add src 0.0.0.0 dst 192.168.121.138 proto esp spi 0x201 auth sha1 "" enc des3_ede 0x8a718c734f68865738a3d9780e49cc2f52c40ef9fa368acc mode transport

1

You seem to have some misconceptions about IPsec. Using integrity protection for ESP has nothing to do with AH. So that's not an AH key you are specifying with auth sha1 "", but an integrity protection/authentication key and algorithm for ESP (with "" you just get an all zero key).

Using ESP encryption without integrity protection is generally not recommended (for instance, directly in the introduction of RFC 4303 that specifies ESP) and the kernel prevents you from doing that in FIPS mode. If you check crypto/testmgr.c in the kernel sources (4.14.15 linked here) you'll see that there is no definition for authenc(digest_null,cbc(des3_ede)), which is what your SA uses, with fips_allowed = 1 (actually, there is no authenc definition with digest_null at all).

Combining ESP with AH is possible and requires defining separate ESP and AH SAs and then IPsec policies that combine them. So on Linux in FIPS mode that's apparently only supported if ESP is still used with integrity protection. By setting the ICV truncation for ESP to 0 you could probably avoid the additional overhead on the network but the computational overhead of having two integrity protection services would remain (the use of a combined mode algorithm like AES-GCM for ESP might improve that a bit).

Anyway, combining ESP and AH is not that common and not recommended, instead using ESP with a combined mode algorithm like AES-GCM or ChaCha20/Poly1305 (not yet FIPS certified) is the general recommendation due to their efficiency, see RFC 8221.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.