Ask Your Question
0

Support for CHACHA20-POLY1305[RFC7634] is missing in ESP encryption algorithm list

asked 2025-05-12 14:01:07 +0000

abhati gravatar image

updated 2025-05-12 14:14:35 +0000

grahamb gravatar image

In the drop down menu of ESP preferences Encryption Algorithms, there is no entry for CHACHA20-POLY1305 [RFC 7634]

I have to configure that option to see decrypted packets created by implementation of RFC 7634.

I am using latest wireshark version Version 4.4.6 (v4.4.6-0-gaebb20483889).

In wireshark code, I checked that related code is present.

static const value_string esp_encryption_type_vals[] = {
  { IPSEC_ENCRYPT_NULL, "NULL" },
  { IPSEC_ENCRYPT_3DES_CBC, "TripleDES-CBC [RFC2451]" },
  { IPSEC_ENCRYPT_AES_CBC, "AES-CBC [RFC3602]" },
  { IPSEC_ENCRYPT_AES_CTR, "AES-CTR [RFC3686]" },
  { IPSEC_ENCRYPT_DES_CBC, "DES-CBC [RFC2405]" },
  { IPSEC_ENCRYPT_CAST5_CBC, "CAST5-CBC [RFC2144]" },
  { IPSEC_ENCRYPT_BLOWFISH_CBC, "BLOWFISH-CBC [RFC2451]" },
  { IPSEC_ENCRYPT_TWOFISH_CBC, "TWOFISH-CBC" },
  { IPSEC_ENCRYPT_AES_GCM,    "AES-GCM [RFC4106]" }, /* deprecated; (no ICV length specified) */
  { IPSEC_ENCRYPT_AES_GCM_8,  "AES-GCM with 8 octet ICV [RFC4106]" },
  { IPSEC_ENCRYPT_AES_GCM_12, "AES-GCM with 12 octet ICV [RFC4106]" },
  { IPSEC_ENCRYPT_AES_GCM_16, "AES-GCM with 16 octet ICV [RFC4106]" },
  { IPSEC_ENCRYPT_AES_GCM_16_IIV, "AES-GCM with IIV and 16 octet ICV [RFC4106 & RFC8750]" },
  { IPSEC_ENCRYPT_CHACHA20_POLY1305, "ChaCha20 with Poly1305 [RFC7634]" },
  { IPSEC_ENCRYPT_CHACHA20_POLY1305_IIV, "ChaCha20 with Poly1305 and IIV [RFC7634 & RFC8750]" },
  { 0x00, NULL }
};
edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2025-05-12 17:41:44 +0000

johnthacker gravatar image

Version 4.4.6 does not have support for CHACHA20-POLY1305 in ESP/IPSec. The code supporting it was added on the development branch and will not be backported to the 4.4 series, as it is a new feature. You might be able to use a daily development build, or build Wireshark yourself. Otherwise, it will be in the upcoming 5.0 release.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2025-05-12 14:01:07 +0000

Seen: 23 times

Last updated: 2 days ago