What’s New in strongSwan 6.0
| Please refer to the full release notes for a complete list of changes. |
Plugins
New Plugin
The following new libstrongswan plugin has been added:
| Plugin Name | Description |
|---|---|
ml |
Module-Lattice-based crypto (ML-KEM) |
ML-KEM is also supported via Botan (botan plugin),
wolfSSL (wolfssl plugin), and AWS-LC (openssl plugin).
|
The following IKEv2 configuration examples show the use of the ML-KEM algorithm:
with the |
with the |
with the |
Removed Plugins
The following deprecated libstrongswan plugins have been removed:
| Plugin Name | Description |
|---|---|
bliss |
Bimodal Lattice Signature Scheme (BLISS) post-quantum computer signature scheme |
newhope |
Key exchange based on post-quantum computer New Hope algorithm |
ntru |
Key exchange based on post-quantum computer NTRU encryption |
Default Plugins
The powerful openssl crypto plugin is now enabled by default:
| Plugin Name | Description |
|---|---|
openssl |
Crypto backend based on the OpenSSL library |
Due to the nearly all-encompassing capabilities of the openssl default
crypto plugin, the following libstrongswan plugins are not enabled by
default anymore:
| Plugin Name | Description |
|---|---|
aes |
AES-128/192/256 cipher software implementation |
curve25519 |
X25519 DH group and Ed25519 public key authentication |
des |
DES/3DES cipher software implementation |
fips-prf |
PRF specified by FIPS, used by EAP-SIM/AKA algorithms |
gmp |
RSA/DH crypto backend based on libgmp |
hmac |
HMAC wrapper using various hashers |
md5 |
MD5 hasher software implementation |
pkcs12 |
PKCS#12 decoding routines |
rc2 |
RC2 cipher software implementation |
sha1 |
SHA1 hasher software implementation |
sha2 |
SHA-2 hasher software implementation |
The legacy stroke management interface has been deprecated for many
years and has been replaced by the versatile vici
management interface. Thus with strongSwan 6.0, the stroke plugin
is not enabled by default anymore and has to be built separately.
|
| Plugin Name | Description |
|---|---|
stroke |
Deprecated stroke configuration/control backend used with ipsec script and starter |
Thus the following 25 plugins are now enabled by default.
Configuration Options
The following strongswan.conf
configuration option is now enabled by default:
| Key | Default | Description [Default] |
|---|---|---|
make_before_break |
|
Initiate IKEv2 reauthentication with a make-before-break instead of a
break-before-make scheme. Make-before-break uses overlapping |