untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24KaOanlfUDTKaY1Rcs3iTl4cXh7lcEnmtocPNFNqo7ywohopNasuOoxLekjJt9eIGovqOyBQFJkJ4UbPc1aAFg0=

OpenBSD 6.6 errata 036, July 27, 2020:

In iked, incorrect use of EVP_PKEY_cmp allows an authentication bypass.

Apply by doing:
   signify -Vep /etc/signify/openbsd-66-base.pub -x 036_iked.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install iked:
   cd /usr/src/sbin/iked
   make obj
   make
   make install

Index: sbin/iked/ca.c
===================================================================
RCS file: /cvs/src/sbin/iked/ca.c,v
diff -u -p -u -r1.48 ca.c
--- sbin/iked/ca.c      3 Jul 2019 03:24:01 -0000       1.48
+++ sbin/iked/ca.c      23 Jul 2020 16:12:44 -0000
@@ -1251,7 +1251,7 @@ ca_validate_pubkey(struct iked *env, str
       if (localkey == NULL)
               goto sslerr;

-       if (!EVP_PKEY_cmp(peerkey, localkey)) {
+       if (EVP_PKEY_cmp(peerkey, localkey) != 1) {
               log_debug("%s: public key does not match %s", __func__, file);
               goto done;
       }