F07-RA: Yes
Rationale
The selected policy authenticates the remote enrolled IPCP through RSA-OAEP challenges and checked responses incorporating the DH shared secret. The code loads the expected peer key by peer name, validates replies and fails the exchange when the check fails.
Assessment method
Pinned documentation and authentication source inspection with explicit policy selection; no execution or audit
Source context
IRATI SSH2-inspired authentication policy
Outstanding qualification
The authenticated participant is the IPCP in the enrollment exchange, not automatically the final application behind it. The implementation is SSH2-inspired, with custom key derivation and MD5-based internal challenge hashing; selecting SHA256 for SDU MACs does not remove those internal uses. Yes records the authentication mechanism, not a security audit, contemporary cryptographic recommendation or proof of absence of attacks.
Public sources
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/librina/src/security-manager.cc
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/README.md
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/rinad/src/ipcp/plugins/sm-auth-psoc/sm-auth-psoc-plugin.cc
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round665.html