Bonjour,
Je vous souhaites une bonne année 2024 
, en vous souhaitant des meilleurs vœux.
Avant tout, je souhaite vous partager cette information (j’ai « copié », pour celles et ceux qui ne sont pas encore abonné·e·s, l’article de Science & Vie – Groupe Reworld Media).
« Désormais, il est possible de téléporter l’information de sorte qu’elle ne voyage jamais physiquement à travers la connexion – une technologie « Star Trek » devenue réalité »
#Quantum #QuantumLeap #OptiqueNonLinéaire #NonlinearOptic #TransportQuantiqueHauteDimension #HighDimensionalQuantumTransport
On saute dans le quantique pour cette année 
Sinon, je vous invite à voir/lire cette page : PostQuantum StrongSwan v6.x + la documentation.
#PQStrongSwan #StrongSwan #VPN #Security
Ci-dessous quelques Algorithmes de cryptage (authentification et encryption) :
root@vps:/etc/swanctl # swanctl --list-algs
encryption:
AES_CBC[openssl]
AES_CTR[openssl]
AES_ECB[openssl]
AES_CFB[openssl]
CAMELLIA_CBC[openssl]
CAMELLIA_CTR[openssl]
CAST_CBC[openssl]
BLOWFISH_CBC[openssl]
3DES_CBC[openssl]
DES_CBC[openssl]
DES_ECB[openssl]
NULL[openssl]
integrity:
HMAC_MD5_96[openssl]
HMAC_MD5_128[openssl]
HMAC_SHA1_96[openssl]
HMAC_SHA1_128[openssl]
HMAC_SHA1_160[openssl]
HMAC_SHA2_256_128[openssl]
HMAC_SHA2_256_256[openssl]
HMAC_SHA2_384_192[openssl]
HMAC_SHA2_384_384[openssl]
HMAC_SHA2_512_256[openssl]
HMAC_SHA2_512_512[openssl]
CAMELLIA_XCBC_96[xcbc]
AES_XCBC_96[xcbc]
AES_CMAC_96[cmac]
aead:
AES_GCM_16[openssl]
AES_GCM_12[openssl]
AES_GCM_8[openssl]
AES_CCM_16[openssl]
AES_CCM_12[openssl]
AES_CCM_8[openssl]
CHACHA20_POLY1305[openssl]
hasher:
HASH_SHA1[openssl]
HASH_MD5[openssl]
HASH_MD4[openssl]
HASH_SHA2_224[openssl]
HASH_SHA2_256[openssl]
HASH_SHA2_384[openssl]
HASH_SHA2_512[openssl]
HASH_SHA3_224[openssl]
HASH_SHA3_256[openssl]
HASH_SHA3_384[openssl]
HASH_SHA3_512[openssl]
HASH_IDENTITY[openssl]
prf:
PRF_KEYED_SHA1[openssl]
PRF_HMAC_MD5[openssl]
PRF_HMAC_SHA1[openssl]
PRF_HMAC_SHA2_256[openssl]
PRF_HMAC_SHA2_384[openssl]
PRF_HMAC_SHA2_512[openssl]
PRF_AES128_XCBC[xcbc]
PRF_CAMELLIA128_XCBC[xcbc]
PRF_AES128_CMAC[cmac]
xof:
XOF_SHAKE128[openssl]
XOF_SHAKE256[openssl]
kdf:
KDF_PRF[openssl]
KDF_PRF_PLUS[openssl]
drbg:
DRBG_CTR_AES256[drbg]
DRBG_CTR_AES128[drbg]
DRBG_CTR_AES192[drbg]
DRBG_HMAC_SHA1[drbg]
DRBG_HMAC_SHA256[drbg]
DRBG_HMAC_SHA384[drbg]
DRBG_HMAC_SHA512[drbg]
ke:
MODP_3072[openssl]
MODP_4096[openssl]
MODP_6144[openssl]
MODP_8192[openssl]
MODP_2048[openssl]
MODP_2048_224[openssl]
MODP_2048_256[openssl]
MODP_1536[openssl]
MODP_1024[openssl]
MODP_1024_160[openssl]
MODP_768[openssl]
MODP_CUSTOM[openssl]
ECP_256[openssl]
ECP_384[openssl]
ECP_521[openssl]
ECP_224[openssl]
ECP_192[openssl]
ECP_256_BP[openssl]
ECP_384_BP[openssl]
ECP_512_BP[openssl]
ECP_224_BP[openssl]
CURVE_25519[openssl]
CURVE_448[openssl]
FRODO_SHAKE_L1[frodo]
FRODO_SHAKE_L3[frodo]
FRODO_SHAKE_L5[frodo]
FRODO_AES_L1[frodo]
FRODO_AES_L3[frodo]
FRODO_AES_L5[frodo]
KYBER_L1[oqs]
KYBER_L3[oqs]
KYBER_L5[oqs]
BIKE_L1[oqs]
BIKE_L3[oqs]
BIKE_L5[oqs]
HQC_L1[oqs]
HQC_L3[oqs]
HQC_L5[oqs]
rng:
RNG_WEAK[openssl]
RNG_STRONG[random]
RNG_TRUE[random]
nonce-gen:
NONCE_GEN[nonce]
Exemple de certificats associés au VPN :
root@vps:/etc/swanctl # swanctl --list-certs
List of X.509 End Entity Certificates
subject: "C=FR, O=Cyber, CN=moon.zw3b.eu"
issuer: "CN=FR, O=ZW3B, CN=Cyber Root CA"
validity: not before Jan 03 03:35:07 2024, ok
not after Jan 03 03:35:07 2028, ok (expires in 1460 days)
serial: 1d:53:f2:90:91:2a:65:9c
altNames: moon.zw3b.eu
flags:
authkeyId: 1b:25:0d:2e:19:51:22:0f:cc:54:d2:d3:26:4a:6b:a4:15:b5:16:03
subjkeyId: d0:8a:b8:5b:f8:a9:9c:05:3c:1d:21:21:a0:3d:e5:f9:74:2e:74:9a
pubkey: Falcon1024 14344 bits, has private key
keyid: e8:c5:4d:79:f4:79:36:61:00:80:fd:88:91:de:ea:f9:39:d8:da:b6
subjkey: d0:8a:b8:5b:f8:a9:9c:05:3c:1d:21:21:a0:3d:e5:f9:74:2e:74:9a
List of X.509 CA Certificates
subject: "CN=FR, O=ZW3B, CN=Cyber Root CA"
issuer: "CN=FR, O=ZW3B, CN=Cyber Root CA"
validity: not before Dec 20 02:17:23 2023, ok
not after Dec 19 02:17:23 2033, ok (expires in 3637 days)
serial: 18:9a:c0:0c:ab:57:44:8f
flags: CA CRLSign self-signed
OCSP URIs: utform
subjkeyId: d4:d6:18:86:8e:bd:8d:20:74:60:4a:a2:89:bb:75:cd:3e:7e:31:4f
pubkey: ECDSA 521 bits
keyid: 6b:83:6a:aa:a4:17:75:b3:2c:1e:3c:a8:af:be:80:4d:70:33:c6:ee
subjkey: d4:d6:18:86:8e:bd:8d:20:74:60:4a:a2:89:bb:75:cd:3e:7e:31:4f
subject: "CN=FR, O=ZW3B, CN=Cyber Root CA"
issuer: "CN=FR, O=ZW3B, CN=Cyber Root CA"
validity: not before Dec 20 05:24:50 2023, ok
not after Dec 19 05:24:50 2033, ok (expires in 3638 days)
serial: 1c:80:73:15:85:2a:f7:5c
flags: CA CRLSign self-signed
OCSP URIs: utform
subjkeyId: 1b:25:0d:2e:19:51:22:0f:cc:54:d2:d3:26:4a:6b:a4:15:b5:16:03
pubkey: ED448 456 bits
keyid: 27:eb:9e:6b:83:3b:a1:35:2d:ef:fd:76:5f:84:4f:7f:f2:c1:e4:ec
subjkey: 1b:25:0d:2e:19:51:22:0f:cc:54:d2:d3:26:4a:6b:a4:15:b5:16:03
Voir un certificat avec la commande pki:
root@vps:/etc/swanctl # pki --print --in x509/moonCert.pem --type x509
subject: "C=FR, O=Cyber, CN=moon.zw3b.eu"
issuer: "CN=FR, O=ZW3B, CN=Cyber Root CA"
validity: not before Jan 03 03:35:07 2024, ok
not after Jan 03 03:35:07 2028, ok (expires in 1460 days)
serial: 1d:53:f2:90:91:2a:65:9c
altNames: moon.zw3b.eu
flags:
authkeyId: 1b:25:0d:2e:19:51:22:0f:cc:54:d2:d3:26:4a:6b:a4:15:b5:16:03
subjkeyId: d0:8a:b8:5b:f8:a9:9c:05:3c:1d:21:21:a0:3d:e5:f9:74:2e:74:9a
pubkey: Falcon1024 14344 bits
keyid: e8:c5:4d:79:f4:79:36:61:00:80:fd:88:91:de:ea:f9:39:d8:da:b6
subjkey: d0:8a:b8:5b:f8:a9:9c:05:3c:1d:21:21:a0:3d:e5:f9:74:2e:74:9a
Et pour finir :
root@vps:/etc/swanctl # pki --gen --help
strongSwan 6.0.0beta5 PKI tool
usage:
pki --gen [--type rsa|ecdsa|ed25519|ed448|dilithium2|dilithium3|dilithium5|falcon512|falcon1024]
[--size bits] [--safe-primes] [--shares n] [--threshold l]
[--outform der|pem]
--help (-h) show usage information
--type (-t) type of key, default: rsa
--size (-s) keylength in bits, default: rsa 2048, ecdsa 384
--safe-primes (-p) generate rsa safe primes
--shares (-n) number of private rsa key shares
--threshold (-l) minimum number of participating rsa key shares
--outform (-f) encoding of generated private key, default: der
--debug (-v) set debug level, default: 1
--options (-+) read command line options from file
root@vps:~ # cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
En vous souhaitant un bon dimanche à toutes et à tous.
#internetQuantum : Sur la Opérating System Solar (la planete, and Moonlight) tu te transformeras en étoile ; dans un rayon de lumière (d’un point à un autre ^^)
Romain.
Note de Moi-même 20240128 : Mes certificats Krystals PQ Dilitium, Falcon ne sont toujours pas valable dans Windows 11 - La signature numérique de ce certificat n’est pas valide → Algoritme de Signature : 1.3.9999.3.4 et 1.3.101.112 
