QKD-IPSec Docker Testing Environment

This repository contains a testing environment for our QKD-enabled strongSwan fork which integrates Quantum Key Distribution into (in substitution of the) the IKEv2 protocol. The setup uses Docker containers to simulate a client-server (Alice-Bob) environment for testing secure communication channels.

The testing environment is derived from the strongX509/docker project and modified to support our QKD integration testing.

Setting the QKD Plugin

The qursa-uc3m/strongswan strongSwan fork includes two plugins:

• QKD-KEM Plugin: Hybridizes QKD with Post-Quantum Cryptography using the QKD-KEM Provider, which depends on the QKD-ETSI API.
• QKD Plugin: Implements bare QKD integration.

To test a specific plugin:

1. Set the BUILD_QKD_KEM variable in docker-compose.yml:

   • "true" - Builds QKD-KEM plugin with required dependencies (qkd-etsi-api and qkd-kem-provider)
   • "false" - Builds only the basic QKD plugin

2. Enable the corresponding plugin in scripts/build_strongswan.sh:

   • For QKD plugin: --enable-qkd
   • For QKD-KEM plugin: --enable-qkd-kem

3. Copy the plugin-specific configuration files:

# From config/<plugin_name>/ to:
alice/           # Client configuration
bob/            # Server configuration
strongswan.conf  # Main strongSwan configuration

Note: The provided configuration for the QKD-KEM plugin tests the hybridization of QKD with Kyber768.

Setup

Generate certificates (run outside Docker):

./scripts/gen_certs.sh

Clean Docker environment (optional):

sudo docker system prune -a --volumes

Build and launch containers:

docker-compose build --no-cache && docker-compose up

Running Tests

Start Bob (server):

docker exec -ti bob /bin/bash
./charon

Start Alice (client):

docker exec -ti alice /bin/bash
./charon

Initiate test connection:

docker exec -ti alice /bin/bash
swanctl --initiate --child net

If you run Wireshark before initiating the connection and filter for IKEv2 traffic with the filter udp.port==500 || udp.port==4500 you should see the IKEv2 exchange.