4 ms·
Why is he using AES-CBC rather than AES-GCM? GCM is generally faster & more optimized, especially for hardware offloads like might be present on some routers.
by drewg123 9y ago
Why is he using AES-CBC rather than AES-GCM? GCM is generally faster & more optimized, especially for hardware offloads like might be present on some routers.
Is there something about OpenVPN that doesn't support GCM?
- subliminalpanda 9y agoMaybe he wasn't aware of it? Just my speculation. In any case, AES-GCM is natively supported by OpenVPN 2.4, and Streisand as it is will configure it for you as part of the NCP ciphers list, with a fallback to AES-CBC if the client is a bit older [0] [0] https://github.com/jlund/streisand/blob/master/playbooks/roles/openvpn/defaults/main.yml https://github.com/jlund/streisand/blob/master/playbooks/rol...
- drdaeman 9y agoAFAIK OpenVPN officially has GCM mode support since v2.4, which is relatively recent (official release December 2016). I'm sure it was also present in 2.3.x - at the very least I'm certain that 2.3.10 I have on one host supports TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 - but it could be distro-specific backports or something like that. At least 2.3 changelogs don't mention anything about AEAD or GCM specifically, and GCM support is featured in https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes....
- drdaeman 9y agoUpdate: no I was wrong. OpenVPN v2.3.x has two connections, a control channel and data channel. That TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 (defined by `tls-cipher` setting) is a control channel, and data channel doesn't support GCM. Anyway, 2.4 is out already.