manual entry for --cipher

[krzee king]

from 2.3 manual:
--cipher alg
Encrypt data channel packets with cipher algorithm alg. The default is BF-CBC, an abbreviation for Blowfish in Cipher Block Chaining mode. Blowfish has the advantages of being fast, very secure, and allowing key sizes of up to 448 bits. Blowfish is designed to be used in situations where keys are changed infrequently.

In light of sweet32 this probably needs an update in wording. I assume you guys have a few things to say here about cipher negotiation, but maybe for older manuals something like this will work:

--cipher alg
Encrypt data channel packets with cipher algorithm alg. The default in this version of openvpn is BF-CBC, an abbreviation for Blowfish in Cipher Block Chaining mode. Blowfish has the advantages of being fast and allowing key sizes of up to 448 bits. Blowfish was considered secure for a long time, but in 2016 the default was changed to AES after an attack against blowfish was demonstrated in a lab. For more information, see: ​http://community.openvpn.net/openvpn/wiki/SWEET32

[David Sommerseth]

Sent the following patch to the -devel ML
​https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12607.html

Author: David Sommerseth <davids@o_____.n__>
Date:   Wed Oct 5 14:44:43 2016 +0200

    man page: Update the --cipher section to reflect recommendations after SWEET32
    
    We should no longer make users believe Blowfish is a 'very secure' cipher.
    Update this section to reflect our recommendations after the SWEET32
    announcement.
    
    Trac: #732
    Signed-off-by: David Sommerseth <davids@o_____.n__>

[David Sommerseth]

So this can be closed. Steffan already had a patch out.

commit 5a1daf533ae283e258732260c96461e820e61fe6
Author: Steffan Karger <steffan@karger.me>
Date:   Sun Sep 11 16:50:31 2016 +0200

    Update cipher-related man page text
    
    As reported in trac #732, the man page text for --cipher is no longer
    accurate.  Update the text to represent current knowledge, about NCP and
    SWEET32.
    
    This does not hint at changing the default cipher, because we did not make
    a decision on that yet.  If we do change the default cipher, we'll have to
    update the text to reflect that.
    
    Signed-off-by: Steffan Karger <steffan@karger.me>
    Acked-by: Gert Doering <gert@greenie.muc.de>
    Message-Id: <1473605431-20842-1-git-send-email-steffan@karger.me>
    URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12439.html
    Signed-off-by: Gert Doering <gert@greenie.muc.de>