topic Re: SHA-512 unavailable for hashing method in Checkpoint Firewall in Firewall and Security Management

SHA-512 unavailable for hashing method in Checkpoint Firewall

CSR — Thu, 28 Nov 2019 06:37:40 GMT

Hi Team,

SHA-512 is not available as Hashing option in Checkpoint Firewall to configure in VPN community. Even I checked the same on R80.30 as well but its still not feasible. Screenshot attached below.

When can we expect SHA-512 to be included in configuration as nowadays many clients ask to use SHA-512 for Integrity.

Thanks,

CSR

Mobile- +91- 971 727 2237

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

PhoneBoy — Fri, 29 Nov 2019 06:36:03 GMT

It will presumably be in an upcoming release.
Not sure if it's in R80.40 or not.

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

Alex- — Fri, 29 Nov 2019 08:59:45 GMT

Sha384 is a truncated output of SHA512, so you will benefit from 64-bit computing and 512-bits states (but no VPN acceleration R80 mechanism I believe), so you can consider for customers asking you for the biggest number.

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

CSR — Fri, 29 Nov 2019 09:03:19 GMT

Yeah @PhoneBoy But Checkpoint must include this option as earliest as possible.

Thanks,

CSR

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

Timothy_Hall — Fri, 29 Nov 2019 13:28:10 GMT

SHA-384 works fine, but is still not implemented in SecureXL. So any VPN traffic using SHA-384 for a hashing algorithm will be ineligible for acceleration by SecureXL. All the other encryption and hashing algorithms are eligible for acceleration, including the GCM variants of AES which were added to SecureXL recently and are particularly speedy if AES-NI is present.

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

PhoneBoy — Tue, 03 Dec 2019 16:00:41 GMT

There does appear to be a customer release of R80.30 that enables SHA512 support.
It can be obtained through your local Check Point office.

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

CSR — Wed, 04 Dec 2019 03:54:09 GMT

Thanks @PhoneBoy, will reach out to CP office for the solution.

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

CSR — Wed, 04 Dec 2019 03:59:56 GMT

Thanks @Timothy_Hall for the explanation. Actually my point is also the same. There is no point of using SHA-384/512 is it's not included in SecureXL. For 1-2 VPN it may be okay but not more VPNs as it can cause Firewall performance issues. So I believe we'll have to wait until Checkpoint includes SHA-512/384 to be used with SecureXL.

Thanks,

CSR

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

benko2 — Thu, 24 Sep 2020 09:09:51 GMT

We did upgrade to R80.40. SHA512 still not available. Does anybody know when Check Point plans to implement it?

Re: SHA-512 unavailable for hashing method in Checkpoint Firewall

idants — Thu, 24 Sep 2020 11:50:16 GMT

Hi,

SHA-512 support was added into R81 (also to SecureXL).

SHA-384 was added to SecureXL as part of R81 as well.

Thanks,

Idan Tsarfati.