Commit 2dec56

2025-02-24 15:40:21 Samuli Seppänen: -/-
Pages/CipherNegotiation.md ..
@@ 13,9 13,10 @@
## Effective directives and terms
- **2.5**: `--data-ciphers ALG:ALG` - Data channel ciphers **list**. Default: AES-256-GCM:AES-128-GCM
- **2.5**: `--data-ciphers-fallback ALG` - Single **ALG** (Essentially the same as `--cipher`)
- * Source: https://sourceforge.net/p/openvpn/mailman/message/37232992/
+
+ * **2.5**: `--data-ciphers ALG:ALG` - Data channel ciphers **list**. Default: AES-256-GCM:AES-128-GCM
+ * **2.5**: `--data-ciphers-fallback ALG` - Single **ALG** (Essentially the same as `--cipher`)
+ * Source: https://sourceforge.net/p/openvpn/mailman/message/37232992/
----
@@ 65,7 66,7 @@
## Poor Man's NCP
- ***Poor Man's NCP*** is a term used to describe when either peer does **not** support cipher negotiation, directly. **And** the subsequent configurations which can be used to get full AEAD cipher support, without the need to negotiate it.
+ **Poor Man's NCP** is a term used to describe when either peer does **not** support cipher negotiation, directly. **And** the subsequent configurations which can be used to get full AEAD cipher support, without the need to negotiate it.
This wiki fully expands the server side variety of Poor Man's NCP, which means this wiki does not apply *that* term to the server. This wiki only applies the term to mean the client because it is easier to understand. Also, clients which suffer from Poor Man's NCP can be more easily upgraded than an old server. So this wiki fully explains the server side, while encouraging the user to upgrade their client OpenVPN version.
@@ 159,18 160,18 @@
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.2
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
----
@@ 198,7 199,7 @@
| | | | |
|-|-|-|-|
| `--cipher` |`--ncp-ciphers`| NCP | Connection |
- | - |-| Full | **OK. AES-256-GCM )]** |
+ | - |-| Full | **OK. AES-256-GCM** |
| AES-256-CBC |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** |
| BF-CBC |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** |
@@ 207,18 208,18 @@
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | `Fail (no shared cipher)` |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.2
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | `Fail (no shared cipher)` |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
----
@@ 235,7 236,7 @@
|-|-|-|
|`--data-ciphers`| NCP | Connection |
|-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** |
- |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Full | **[[span(style=color: #007000, OK. AES-256-GCM )]** |
+ |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Full | **<span style=color:#007000> OK. AES-256-GCM </span>** |
|AES-256-CBC| Full | **<span style=color:#007000>OK. AES-256-CBC</span>** |
##### Client version 2.4
@@ 326,7 327,7 @@
|-|-|-|
|`--data-ciphers`| NCP | Connection |
|-| Partial | `Fail (no shared cipher)` |
- |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.4
@@ 335,25 336,25 @@
| `--cipher` |`--ncp-ciphers`| NCP | Connection |
| - |-| Partial | `Fail (no shared cipher)` |
| AES-256-CBC |-| Partial | `Fail (no shared cipher)` |
- | BF-CBC |-| Partial | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC |-| Partial | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.3
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | `Fail (no shared cipher)` |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.2
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | `Fail (no shared cipher)` |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
----
@@ 397,7 398,7 @@
|-|-|-|
| `--cipher` | NCP | Connection |
| - | No | `Fail (no shared cipher)` |
- | AES-256-CBC | No | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ | AES-256-CBC | No | **<span style=color:#007000> OK. AES-256-CBC </span>** |
| BF-CBC | No | `Fail (no shared cipher)` |
----
@@ 416,34 417,34 @@
|-|-|-|
|`--data-ciphers`| NCP | Connection |
|-| Partial | `Fail (no shared cipher)` |
- |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.4
| | | | |
|-|-|-|-|
| `--cipher` |`--ncp-ciphers`| NCP | Connection |
- | - |-| Partial | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - |-| Partial | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC |-| Partial | `Fail (no shared cipher)` |
- | BF-CBC |-| Partial | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC |-| Partial | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.3
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | `Fail (no shared cipher)` |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
##### Client version 2.2
| | | |
|-|-|-|
| `--cipher` | NCP | Connection |
- | - | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | - | No | *<span style=color:#806000> Weak BF-CBC </span>* |
| AES-256-CBC | No | `Fail (no shared cipher)` |
- | BF-CBC | No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* |
----
@@ 460,7 461,7 @@
|-|-|-|
|`--data-ciphers`| NCP | Connection |
|-| Partial | `Fail (no shared cipher)` |
- |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | **<span style=color:#007000> OK. AES-256-CBC </span>** |
##### Client version 2.4
@@ 468,7 469,7 @@
|-|-|-|-|
| `--cipher` |`--ncp-ciphers`| NCP | Connection |
| - |-| Partial | `Fail (no shared cipher)` |
- | AES-256-CBC |-| Partial | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ | AES-256-CBC |-| Partial | **<span style=color:#007000> OK. AES-256-CBC </span>** |
| BF-CBC |-| Partial | `Fail (no shared cipher)` |
##### Client version 2.3
@@ 477,7 478,7 @@
|-|-|-|
| `--cipher` | NCP | Connection |
| - | No | `Fail (no shared cipher)` |
- | AES-256-CBC | No | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ | AES-256-CBC | No | **<span style=color:#007000> OK. AES-256-CBC </span>** |
| BF-CBC | No | `Fail (no shared cipher)` |
##### Client version 2.2
@@ 486,7 487,7 @@
|-|-|-|
| `--cipher` | NCP | Connection |
| - | No | `Fail (no shared cipher)` |
- | AES-256-CBC | No | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ | AES-256-CBC | No | **<span style=color:#007000> OK. AES-256-CBC </span>** |
| BF-CBC | No | `Fail (no shared cipher)` |
----
@@ 510,7 511,7 @@
|-|-|-|-|
|`--data-ciphers` =|`-fallback`| NCP | Connection |
|-|-| No | `Fail (no shared cipher)` |
- |-|BF-CBC| No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ |-|BF-CBC| No | *<span style=color:#806000> Weak BF-CBC </span>* |
### Server version 2.3 built with `--enable-small`
#### Configuring: `--cipher`
@@ 523,7 524,7 @@
|-|-|-|-|
|`--data-ciphers`|`-fallback`| NCP | Connection |
|-|-| No | `Fail (no shared cipher)` |
- |-|AES-256-CBC| No | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ |-|AES-256-CBC| No | **<span style=color:#007000> OK. AES-256-CBC </span>** |
### Client version 2.3 built with `--enable-small`
#### Default configuration: No effective directives specified.
@@ 539,7 540,7 @@
|-|-|-|-|
|`--data-ciphers`|`-fallback`| NCP | Connection |
|-|-| No | `Fail (no shared cipher)` |
- |-|BF-CBC| No | *[[span(style=color: #806000, **Weak** BF-CBC )]* |
+ |-|BF-CBC| No | *<span style=color:#806000> Weak BF-CBC </span>* |
### Client version 2.3 built with `--enable-small`
#### Configuring: `--cipher`
@@ 555,4 556,4 @@
|-|-|-|-|
|`--data-ciphers`|`-fallback`| NCP | Connection |
|-|-| No | `Fail (no shared cipher)` |
- |-|AES-256-CBC| No | **[[span(style=color: #007000, OK. AES-256-CBC )]** |
+ |-|AES-256-CBC| No | **<span style=color:#007000> OK. AES-256-CBC </span>** |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9