From owner-freebsd-net@freebsd.org  Sat Aug 11 01:48:52 2018
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id C379910559DC
 for <freebsd-net@mailman.ysv.freebsd.org>;
 Sat, 11 Aug 2018 01:48:52 +0000 (UTC)
 (envelope-from jmg@gold.funkthat.com)
Received: from gold.funkthat.com (gate2.funkthat.com [208.87.223.18])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "gate2.funkthat.com",
 Issuer "Let's Encrypt Authority X3" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 4CA9C853CE
 for <freebsd-net@freebsd.org>; Sat, 11 Aug 2018 01:48:52 +0000 (UTC)
 (envelope-from jmg@gold.funkthat.com)
Received: from gold.funkthat.com (localhost [127.0.0.1])
 by gold.funkthat.com (8.15.2/8.15.2) with ESMTPS id w7B1mokl023852
 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
 Fri, 10 Aug 2018 18:48:50 -0700 (PDT)
 (envelope-from jmg@gold.funkthat.com)
Received: (from jmg@localhost)
 by gold.funkthat.com (8.15.2/8.15.2/Submit) id w7B1mno5023851;
 Fri, 10 Aug 2018 18:48:49 -0700 (PDT) (envelope-from jmg)
Date: Fri, 10 Aug 2018 18:48:49 -0700
From: John-Mark Gurney <jmg@funkthat.com>
To: Mike Tancsa <mike@sentex.net>
Cc: "David P. Discher" <dpd@dpdtech.com>,
 "Andrey V. Elsukov" <bu7cher@yandex.ru>, freebsd-net@freebsd.org
Subject: Re: Is if_ipsec/ipsec - AESNI accelerated ?
Message-ID: <20180811014849.GC97145@funkthat.com>
Mail-Followup-To: Mike Tancsa <mike@sentex.net>,
 "David P. Discher" <dpd@dpdtech.com>,
 "Andrey V. Elsukov" <bu7cher@yandex.ru>, freebsd-net@freebsd.org
References: <D47976AF-A0AF-4A58-B80E-31E9DED96D26@dpdtech.com>
 <dc8bea35-1770-48d0-3662-c58e72bd3d2d@yandex.ru>
 <62E0C365-AD64-4383-8BA4-298AA0E292F4@dpdtech.com>
 <e9da62df-90e4-e45b-b073-c4c39555b38d@yandex.ru>
 <BE275E67-A768-47E9-97D4-0A5E4FDC44EF@dpdtech.com>
 <ef2e1dfe-bace-af46-6c64-fd387c646b0a@sentex.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ef2e1dfe-bace-af46-6c64-fd387c646b0a@sentex.net>
X-Operating-System: FreeBSD 11.0-RELEASE-p7 amd64
X-PGP-Fingerprint: D87A 235F FB71 1F3F 55B7  ED9B D5FF 5A51 C0AC 3D65
X-Files: The truth is out there
X-URL: https://www.funkthat.com/
X-Resume: https://www.funkthat.com/~jmg/resume.html
X-TipJar: bitcoin:13Qmb6AeTgQecazTWph4XasEsP7nGRbAPE
X-to-the-FBI-CIA-and-NSA: HI! HOW YA DOIN? can i haz chizburger?
User-Agent: Mutt/1.6.1 (2016-04-27)
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3
 (gold.funkthat.com [127.0.0.1]); Fri, 10 Aug 2018 18:48:50 -0700 (PDT)
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 11 Aug 2018 01:48:52 -0000

Mike Tancsa wrote this message on Fri, Aug 10, 2018 at 16:44 -0400:
> On 8/9/2018 4:11 PM, David P. Discher wrote:
> > [ pts/0 sjc2 util201:~ ]
> > [ dpd ] > sudo setkey -D
> > Password:
> > 10.245.0.201 10.245.0.202
> > 	esp mode=tunnel spi=60080461(0x0394c14d) reqid=12(0x0000000c)
> > 	E: rijndael-cbc  xxxx
>                          ^^^^^^^^ ^^^^^^^^ ^^^^^^^^ ^^^^^^^^
> 
> BTW, if you use a static psk, does not the above line essentially give
> someone with access to the ESP traffic a way to decode your traffic ?

Yes, this does...   And the A: line gives you the ability to spoof
packets as well...

Hopefully there wasn't any important data encrypted w/ that key...

Always X those out...

> > 	A: hmac-sha2-256  xxx

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."