LoginSign Up
← Back to all sparks
L

Libreswan

DEVOPS
Velocity6.3

IPsec VPN implementation for Linux and BSD supporting IKEv1 and IKEv2

libreswan.org ↗

Libreswan puts post-quantum key exchange into IKEv2 — ML-KEM 768 ships in v5.4.

ipsecpost-quantum cryptoikev2rfc 9370vpn
◆Current state
Libreswan spent the last two releases on security patches, including a CVE found when the project ran an AI audit over its own codebase. v5.4 breaks that pattern: it implements RFC 9370's multiple-key-exchange machinery end to end — IKE_INTERMEDIATE, IKE_ADDITIONAL_KE and IKE_FOLLOWUP_KE — and uses it to carry ML_KEM_768 in IKE_SA_INIT and IKE_INTERMEDIATE. The rest of the release is a wide maintenance sweep across kernel integration on the BSDs, config parsing and logging.
◆Where it's heading
The post-quantum work is the spine of this release and it is not experimental framing — it is standards-track RFC 9370 plus a hard dependency on NSS 3.118.1, meaning distributions have to move their crypto library before users can turn it on. Around it, the project keeps grinding on operator experience: better proposal parsing, more specific error messages, traffic selectors and DIGSIG algorithms in logs, and rate-limited logging. Experimental flags for subnet leasing and updown-config suggest the next capability additions are already staged.
◆Prediction
Expect ML-KEM to move from supported to recommended in default proposals once NSS 3.118.1 is widely packaged, and the experimental leftaddresspool subnet leasing and per-connection debug options to stabilize in a following release.

◆Recent moves

  1. 5d ago

    5.4: ML-KEM 768 and RFC 9370 multiple key exchanges for IKEv2

    ⚡ SPARK

    After two releases of pure CVE response, v5.4 is where Libreswan adds capability: post-quantum key exchange in IKEv2, built on a complete RFC 9370 implementation rather than bolted on. The maintenance half of the release — host-to-host and on-demand fixes on FreeBSD, NetBSD and OpenBSD, proposal parser updates, and a large logging cleanup — reflects the same operator-facing grind visible in earlier releases.

    View source ↗
  2. 1mo ago

    5.3.2: FIPS-mode daemon crash from malformed X.509 certificates

    A single-CVE release for an assertion failure that crashes pluto in FIPS mode when it parses a badly formatted X.509 certificate, repeatable into a denial of service. Notable for how it was found: the project ran an AI-assisted audit over its own codebase and this came out of it.

    View source ↗
  3. 1mo ago

    5.3.1: three CVEs and a newer-GCC compile fix

    Three CVEs closed in one release, plus a compile fix for newer GCC versions. Together with 5.3.2 a month later, it marks the stretch where Libreswan's release stream was entirely security response — the contrast that makes v5.4's feature work stand out.

    View source ↗
  4. 2y ago

    IKEv1 cryptosuite defaults tightened; systemd libxz dependency dropped

    Reworks IKEv1's default proposals — SHA2 added to AH, DH19 and DH31 into the IKE defaults, AEAD rejected when combined with non-NULL integrity — and drops the libxz dependency pulled in via libsystemd. Default-tightening on the legacy protocol, which is how IKEv1 gets maintained rather than extended.

    View source ↗
  5. 2y ago

    Compile error fix carried over from 4.13

    A one-line compile fix and a test fixup. No user-visible change.

    View source ↗