Modify default cipher suite for IKEv2

[dguido]

As of August 2015, NSA recommends a stronger set of algorithms than the ones we currently configure. These changes were made to provide improved resistance to theoretical attacks from quantum computers.

The current cipher suite is:

• ike: aes128gcm16-prfsha512-ecp256!
• esp: aes128gcm16-ecp256!

The new proposed cipher suite is:

• ike: aes256gcm16-prfsha512-ecp384!
• esp: aes256gcm16-ecp384!

The primary changes are that:

• Bulk encryption is moved from AES-128 to 256 w/ no changes to the mode (still GCM)
• The DH group is moved from NIST P-256 to P-384

More information about available cipher suites for IKEv2 is available in the StrongSwan documentation.

[ndtob]

In addition to these changes, changes in the resulting iOS profile will be required:

Current:

                    <key>DiffieHellmanGroup</key>
                    <integer>19</integer>
                    <key>EncryptionAlgorithm</key>
                    <string>AES-128-GCM</string>

Change to:

                    <key>DiffieHellmanGroup</key>
                    <integer>20</integer>
                    <key>EncryptionAlgorithm</key>
                    <string>AES-256-GCM</string>

[pguizeline]

On iOS it runs great! But on Windows 10 I get the following message when trying to activate the VPN:
"IKE failed to find valid machine certificate. Contact your Network Security Administrator about installing a valid certificate in the appropriate Certificate Store."

I'm running Windows 10 Pro version 1803 build 17134.48

[jackivanov]

Could anybody provide some debug information from windows 10, please?

[pguizeline]

I still have the profile installed on this machine, I just don't know where to look.

[jackivanov]

For some reason that's happening because of switching from ECP256 to ECP384

[jackivanov]

I forgot to switch the ec params. Should work now. ping @pguizeline

[pguizeline]

Hi Jack! The VPN now works on Windows 10 with the latest changes.

I've tested:

• - iOS (failed)
• - macOS
• - Windows 10 (worked)
• - Android
• - Linux

The iOS seems to be unable to connect, I'm using the latest 11.4

I can test macOS later today. Thanks for all your help!