strongSwan helps Cisco build a test for post-quantum IKEv2 security

Two Docker containers are now demonstrating mutual authentication over IKEv2, offering a self-contained lab environment accessible with only Docker. Julio Gomez is testing the post-quantum algorithm ML-DSA on an experimental branch of strongSwan, comparing it to ECDSA. This setup utilizes a single, small Certificate Authority spun up specifically for the lab, with each peer sending only its leaf certificate during the handshake, a strategy to minimize on-the-wire bytes, a concern amplified by larger post-quantum certificates as shown in Part 7. strongSwan Validates ECDSA for Baseline IKEv2 Authentication strongSwan’s latest validation of ECDSA for baseline IKEv2 authentication provides a crucial benchmark against which to measure the performance of emerging post-quantum cryptographic methods. While much attention has focused on algorithms like ML-DSA, a working implementation using currently deployed ECDSA remains the foundation for secure communication and serves as a direct comparison point for these newer technologies. This setup deliberately isolates the authentication layer from key exchange, allowing for focused testing of digital signatures. During the IKEv2 handshake, each peer transmits only its leaf certificate; the CA certificate is pre-installed on both sides, reducing the amount of data exchanged. This is a strategy used throughout the lab, particularly relevant as certificate sizes increase with post-quantum algorithms, as highlighted in Part 7 of this series. Confirming the integrity of the setup, the initiator picked up its own certificate, noting the presence of a private key alongside the public key in the swanctl output. This direct comparison allows for a clear assessment of the trade-offs between classical and post-quantum security protocols. The key exchange remained post-quantum hybrid, utilizing the previously established ML-KEM implementation, while the initial authentication phase still relied on classical ECDSA certificates. According to the source, “That’s exactly the posture real deployments ship right now: quantum-safe key exchange, classical authentication.” Switching to ML-DSA for authentication required rebuilding the peers from the experimental branch. The resulting tunnel, authenticated with ML-DSA signatures and secured by an ML-KEM key exchange, represents a fully post-quantum secure connection. Analysis of the handshake logs revealed that the IKE_AUTH message carrying the ML-DSA leaf certificate and signature was significantly larger than its ECDSA counterpart, leading to fragmentation. This fragmentation is a known issue with the current implementation and requires fragmentation to be enabled on both ends for successful operation, strongSwan says. Fragmentation set to yes is now required for post-quantum authentication to function reliably.

Docker Lab Demonstrates Mutual Authentication with Post-Quantum Certificates The ability to verify digital identities using post-quantum cryptography moved closer to practical implementation as a Docker-based laboratory successfully demonstrated mutual authentication over IKEv2 using ML-DSA signatures. This setup, detailed by the team, allows anyone with Docker to replicate the experiment and observe a complete handshake between two peers, proving identity before establishing a secure tunnel, according to strongSwan. Exercise An established a baseline using classical ECDSA authentication on a stable version of strongSwan, revealing that even with this established method, the key exchange was already leveraging a post-quantum hybrid approach.

The team observed that the key exchange utilized their previously established ML-KEM implementation, while identities were proven with classical certificates. This configuration mirrors current real-world deployments prioritizing quantum-safe key exchange alongside traditional authentication methods. To then test the post-quantum capabilities, the peers were rebuilt using an experimental branch of strongSwan, specifically incorporating ML-DSA support. Switching to ML-DSA required rebuilding the peers, but the team noted a significant advantage of the strongSwan architecture. ML-DSA-44 Enables Full Post-Quantum IKEv2 Tunnel Establishment Gomez has demonstrated a fully post-quantum IKEv2 tunnel using the strongSwan IPsec implementation, achieving mutual authentication with ML-DSA-44 certificates on an experimental branch of the software. This builds upon previous work establishing quantum-safe key exchange, now extending protection to the identity verification stage of a VPN connection. The peers trust one small Certificate Authority, and each peer gets the CA certificate pre-installed so it can verify the other side. A strategy was used to mitigate the increased size of post-quantum certificates observed in earlier testing. Reloading credentials after certificate minting was necessary. Two checks confirm the initiator picked up its own certificate: the subject and altNames match this peer’s identity, and the pubkey line ends with, has private key. The successful establishment of the tunnel with ML-DSA authentication is notable because it combines a post-quantum signature scheme with the previously implemented ML-KEM key exchange. However, the team notes that the experimental nature of the ml-dsa branch and the evolving IETF draft standards mean this setup is not yet ready for stable release. The source observes, “The approximately 6.9 KB to 6 fragments is the IKE_AUTH carrying the ML-DSA leaf certificate plus signature,” highlighting the need for fragmentation support in post-quantum authentication implementations. While ML-DSA-44 established a clean connection in their testing, they cautioned that larger variants or more complex certificate chains could trigger reassembly bugs, a known issue in the current implementation. Expectation setting: this is genuinely experimental. The branch changes often, the IKEv2-for-PQC-auth wire format is still an IETF draft, and there are known sharp edges (large IKE_AUTH messages that split into many fragments have hit reassembly bugs; see strongSwan issue #2889 ). IKE_AUTH Fragmentation Highlights Limits of ML-DSA Certificate Size The size of authentication payloads presents a practical hurdle in adopting post-quantum cryptography for secure communication channels. Testing with the strongSwan implementation revealed that utilizing ML-DSA-44 certificates introduces fragmentation within IKE_AUTH messages, a phenomenon not observed with traditional ECDSA certificates. Specifically, the team observed that the approximately 6 kilobytes differed sharply from ECDSA, where the entire authentication message consistently fit within a single, approximately 900-byte packet. This fragmentation isn’t merely an academic observation; it directly impacts network performance and stability. This approach, while effective in the lab, underscores the trade-offs between security, performance, and complexity as the industry prepares for a post-quantum future. Source: https://blogs.cisco.com/developer/mutual-post-quantum-auth-over-ikev2-ipsec-series-part-8 Stay currentSee today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals. Tags: