CycloneIPSEC is an IPsec / IKEv2 library dedicated to embedded applications. IPsec is a suite of protocols used to implement secure communication between two sites over the internet. IPsec works at the network layer of the OSI model. The main protocols comprising IPsec are AH (Authentication Header), ESP (Encapsulating Security Payload) and IKEv2 (Internet Key Exchange version 2). AH provides data integrity protection while ESP provides both confidentiality and data integrity protection. IKEv2 is the protocol used to manage security associations between two entities.
Key features:
- AH (Authentication Header) implementation
- ESP (Encapsulating Security Payload) implementation
- IKEv2 (Internet Key Exchange version 2) implementation
- Supports Transport mode over IPv4 (Tunnel mode is not supported)
- Pre-shared key and certificate authentication methods
- Key exchange using Diffie-Hellman, ECDH, Curve25519 and Curve448 algorithms
- RSA, RSA-PSS, DSA, ECDSA, Ed25519 and Ed448 signature algorithms
- AES, Camellia and ChaCha20Poly1305 encryption algorithms
- Legacy support for IDEA, DES and 3DES encryption algorithms
- CBC, CTR, CCM and GCM encryption modes
- SHA-256, SHA-384 and SHA-512 hash algorithms
- Legacy support for MD5, SHA-1 and Tiger hash algorithms
- Commercial National Security Algorithm (CNSA) suite cryptography
- Anti-replay mechanism with configurable sliding window size (64 by default)
- HMAC, CMAC and XCBC-MAC integrity algorithms
- Supports ESNs (Extended Sequence Numbers)
- Cookie generation and verification
- Supports Digital Signature method
- Supports SIGNATURE_HASH_ALGORITHMS and INITIAL_CONTACT notifications
- Supports DPD (Dead Peer Detection) mechanism
- Flexible memory footprint. Built-time configuration to embed only the necessary features
- Portable architecture (no processor dependencies)
- The library is distributed as a full ANSI C and highly maintainable source code
CycloneIPSEC is available either as open source (GPLv2 license) or under a royalty-free commercial license (non-GPL license). We also propose an evaluation license (90-day license in source form) with technical support for an easier onboarding and effective evaluation of our software.
