From owner-freebsd-security@FreeBSD.ORG Fri Jan 14 14:44:24 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E52CC16A4CE for ; Fri, 14 Jan 2005 14:44:24 +0000 (GMT) Received: from citadel.icyb.net.ua (citadel.icyb.net.ua [212.40.38.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id 373C243D48 for ; Fri, 14 Jan 2005 14:44:23 +0000 (GMT) (envelope-from avg@icyb.net.ua) Received: from [212.40.38.87] (oddity.topspin.kiev.ua [212.40.38.87]) by citadel.icyb.net.ua (8.8.8p3/ICyb-2.3exp) with ESMTP id QAA19317; Fri, 14 Jan 2005 16:44:19 +0200 (EET) (envelope-from avg@icyb.net.ua) Message-ID: <41E7DAC3.3050707@icyb.net.ua> Date: Fri, 14 Jan 2005 16:44:19 +0200 From: Andriy Gapon User-Agent: Mozilla Thunderbird 1.0 (X11/20041230) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Bruce M Simpson References: <41E796DC.2090102@icyb.net.ua> <20050114140709.GD57985@empiric.icir.org> In-Reply-To: <20050114140709.GD57985@empiric.icir.org> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Mailman-Approved-At: Sat, 15 Jan 2005 15:30:13 +0000 cc: freebsd-security@freebsd.org Subject: Re: debugging encrypted part of isakmp X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jan 2005 14:44:25 -0000 on 14.01.2005 16:07 Bruce M Simpson said the following: > On Fri, Jan 14, 2005 at 11:54:36AM +0200, Andriy Gapon wrote: > man 8 isakmpd: > > %%% > -L Enable IKE packet capture. When this option is given, isakmpd > will capture to file an unencrypted copy of the negotiation pack- > ets it is sending and receiveing. This file can later be read by > tcpdump(8) and other utilities using pcap(3). > %%% > The problem is it is not isakmpd. Here's more information: I am trying to reverse-engineer asymmetric xauth/mode cfg exchange between third-party VPN/ipsec client and server. I know all configuration parameters for both, but I don't have any access to internal workings. At this point, I also have too little information to successfully emulate either side, but I know what phase1 mode they use and what key material they have. So, I am looking for the easiest way to decrypt isakmp packets using both packet data and information like pre-shared keys, certificates etc. -- Andriy Gapon