Back to The Libreswan Project
GSoC 2026

Add Support For Announcing Authentication Methods To Libreswan

Currently, during an IKEv2 negotiation in Libreswan, each peer independently selects its authentication method without knowing what the other side supports, which can lead to SA establishment failures when peers are configured with multiple credentials. The goal of this project is to implement RFC 9593, which introduces the SUPPORTED_AUTH_METHODS notification to allow peers to announce their supported authentication methods during SA establishment, enabling Libreswan to adjust its authentication selection to a method both sides support. The deliverables include: New ipsec.conf configuration option. Modifications to emit and parse SUPPORTED_AUTH_METHODS notification across IKE_SA_INIT, IKE_INTERMEDIATE, and IKE_AUTH exchanges. Modifications to select the applicable authentication method based on the peer's announced capabilities. Additions to the test-suite.

Project details

Contributor

Osema Fadhel

Mentors

Not available

Technologies

Not listed in the archive