Change Details

This patch introduces implementation of Extended Sequence Numbers in encrypt and authenticate mode (eg. AES-CBC and SHA256) and combined mode (eg. AES-GCM) Implementation was based on https://github.com/openbsd/src/commit/6b4cbaf181c6b60701d9fb888fd0e7a4333eecbd

This patch adds support for IPSec ESN (Extended Sequence Numbers) in encrypt and authenticate mode (eg. AES-CBC and SHA256) and combined mode (eg. AES-GCM). For encrypt and authenticate mode the ESN is stored in separate crp_esn buffer because the high-order 32 bits of the sequence number are appended after the Next Header (RFC 4303). For combined modes the high-order 32 bits of the sequence number [e.g. RFC 4106, Chapter 5 AAD Construction] are part of crp_aad (prepared by netipsec layer in case of ESN support enabled), therefore non visible diff around combined modes.

This patch introduces implementation of adds support for IPSec ESN (Extended Sequence Numbers in) in encrypt and authenticate mode (eg. AES-CBC and SHA256) and combined mode (eg (eg. AES-GCM). Implementation was based onFor encrypt and authenticate mode the ESN is stored in separate crp_esn https://github.com/openbsd/src/commit/6b4cbaf181c6b60701d9fb888fd0e7a4333eecbdbuffer because the high-order 32 bits of the sequence number are appended after the Next Header (RFC 4303). For combined modes the high-order 32 bits of the sequence number [e.g. RFC 4106, Chapter 5 AAD Construction] are part of crp_aad (prepared by netipsec layer in case of ESN support enabled), therefore non visible diff around combined modes.