Elliptical curve ecp256 not working

[gowdamanil]

Hello @tobiasbrunner

I configured swanctl.conf and saw that one algo for diffie hellman key exchange was not working properly.
That was ecp256, but ecp384 was working without a problem.
Just by going through the logs, I saw it was shown as no proposals chosen when I just used ecp256. I have loaded openssl plugin, even then this problem is seen.

But ecp384 works without a problem
Is there any solution to this?

Thanks,
Anil Gowda M

[tobiasbrunner]

Your peer apparently doesn't like that algorithm so it rejects the proposal.

[gowdamanil]

So what does it mean by 'does not like it?? '

Is there a way to accept that proposal?

I used it with aes256- sha256- ecp256

[tobiasbrunner]

It means that its configuration/implementation/whatever is such that it rejects your end's proposal. If you can't change that, there is no way to get that proposal accepted.

[gowdamanil]

Yes, thank you.

I have one final inquiry: I understand that StrongSwan loads an OpenSSL plugin for various encryption and decryption operations. Could you confirm whether this plugin connects to the OpenSSL library, and if so, does it utilize the version obtained from the command 'openssl version'? I installed StrongSwan using 'apt-get install charon-systemd', so it wasn't compiled from source by me. If the version obtained from 'openssl version' differs(I mean openssl plugin will connect to other openssl version), what version does the plugin use? Is the OpenSSL library included with the package I installed via 'apt-get' compiled with OpenSSL support, or is it reliant
on a different version?(For compatibility we use ikev1, will change to ikev2 in a year or so...till then need to keep this up).

Thanks

[tobiasbrunner]

I understand that StrongSwan loads an OpenSSL plugin for various encryption and decryption operations.

Only if that plugin is built and loaded.

Could you confirm whether this plugin connects to the OpenSSL library, and if so, does it utilize the version obtained from the command 'openssl version'?

Depends on the configuration during build time. It could link a library in some other location.

I installed StrongSwan using 'apt-get install charon-systemd', so it wasn't compiled from source by me.

Then there is no reason to assume it was linked against some other version.

Is the OpenSSL library included with the package I installed via 'apt-get' compiled with OpenSSL support, or is it reliant
on a different version?

No, it relies on the packaged version.

[gowdamanil]

Thanks @tobiasbrunner . for your kind hearted support.