Open Radar

 
According to RFC 2367, the reply of a SADB_REGISTER message contains a Supported Algorithms Extension, which informs the client about the capabilities of the kernel:

https://tools.ietf.org/html/rfc2367#section-3.1.7
https://tools.ietf.org/html/rfc2367#section-2.3.8

According to the man page of `setkey` in macOS 10.15, the following algorithms are supported for encryption:

des-cbc      
3des-cbc     
null         
blowfish-cbc 
cast128-cbc  
des-deriv    
3des-deriv   
rijndael-cbc 
twofish-cbc  
aes-ctr      

However, the Supported Algorithms Extension only reports the following algorithms as available:

des-cbc      
3des-cbc     
null         
rijndael-cbc 


Looking at the source of xnu-6153.41.3, the problem is found in `esp_core.c` in the function `esp_algorithm_lookup()`:


const struct esp_algorithm *
esp_algorithm_lookup(int idx)
{
	switch (idx) {
	case SADB_EALG_DESCBC:
		return &des_cbc;
	case SADB_EALG_3DESCBC:
		return &des3_cbc;
	case SADB_EALG_NULL:
		return &null_esp;
	case SADB_X_EALG_RIJNDAELCBC:
		return &aes_cbc;
	case SADB_X_EALG_AES_GCM:
		return &aes_gcm;
	case SADB_X_EALG_CHACHA20POLY1305:
		return &chacha_poly;
	default:
		return NULL;
	}
}


which is called by `key_register()` that is found in `key.c` and builds up the Supported Algorithms Extension.