Home A - Z
Page Index

An Otter Wiki

Commit 9db507

2025-02-11 08:54:52 Samuli Seppänen: -/-
Pages/CipherNegotiation.md ..
@@ 372,27 372,29 @@
**Client version 2.2**
| `--cipher` | NCP | Connection |
+ | --- | --- | --- |
| - | No | `Fail (no shared cipher)` |
| AES-256-CBC | No | **OK. AES-256-CBC** |
| BF-CBC | No | `Fail (no shared cipher)` |
- ---
-
### Server version 2.2
#### Default configuration: No effective directives specified.
| `--cipher` | NCP |
+ | --- | --- |
| - | No |
**Client version 2.5**
| `--data-ciphers` | NCP | Connection |
+ | --- | --- | --- |
| - | Partial | `Fail (no shared cipher)` |
| AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC | Partial | **Weak BF-CBC** |
**Client version 2.4**
| `--cipher` | `--ncp-ciphers` | NCP | Connection |
+ | --- | --- | --- |
| - | - | Partial | **Weak BF-CBC** |
| AES-256-CBC | - | Partial | `Fail (no shared cipher)` |
| BF-CBC | - | Partial | **Weak BF-CBC** |
@@ 400,6 402,7 @@
**Client version 2.3**
| `--cipher` | NCP | Connection |
+ | --- | --- | --- |
| - | No | **Weak BF-CBC** |
| AES-256-CBC | No | `Fail (no shared cipher)` |
| BF-CBC | No | **Weak BF-CBC** |
@@ 407,26 410,28 @@
**Client version 2.2**
| `--cipher` | NCP | Connection |
+ | --- | --- | --- |
| - | No | **Weak BF-CBC** |
| AES-256-CBC | No | `Fail (no shared cipher)` |
| BF-CBC | No | **Weak BF-CBC** |
- ---
-
#### Server version 2.2 Configuring: `--cipher`
| `--cipher` | NCP |
+ | --- | --- |
| AES-256-CBC | No |
**Client version 2.5**
| `--data-ciphers` | NCP | Connection |
+ | --- | --- | --- |
| - | Partial | `Fail (no shared cipher)` |
| AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC | Partial | **OK. AES-256-CBC** |
**Client version 2.4**
| `--cipher` | `--ncp-ciphers` | NCP | Connection |
+ | --- | --- | --- |
| - | - | Partial | `Fail (no shared cipher)` |
| AES-256-CBC | - | Partial | **OK. AES-256-CBC** |
| BF-CBC | - | Partial | `Fail (no shared cipher)` |
@@ 434,6 439,7 @@
**Client version 2.3**
| `--cipher` | NCP | Connection |
+ | --- | --- | --- |
| - | No | `Fail (no shared cipher)` |
| AES-256-CBC | No | **OK. AES-256-CBC** |
| BF-CBC | No | `Fail (no shared cipher)` |
@@ 441,12 447,11 @@
**Client version 2.2**
| `--cipher` | NCP | Connection |
+ | --- | --- | --- |
| - | No | `Fail (no shared cipher)` |
| AES-256-CBC | No | **OK. AES-256-CBC** |
| BF-CBC | No | `Fail (no shared cipher)` |
- ---
-
## Special requirement: OpenVPN built with `--enable-small`
When OpenVPN version 2.3 or older is built with `--enable-small` (typically found in routers) then OpenVPN 2.5 **must** use `--data-ciphers-fallback ALG`. The `ALG` must match the peers `--cipher ALG`. **This is the only case that** `--data-ciphers-fallback` **takes effect.**
@@ 459,11 464,15 @@
### Server version 2.3 built with `--enable-small`
#### Default configuration: No effective directives specified.
+
| `--cipher` | NCP |
+ | --- | --- |
| - | No |
- * **Client version 2.5**
+ **Client version 2.5**
+
| `--data-ciphers` | `-fallback` | NCP | Connection |
+ | --- | --- | --- | --- |
| - | - | No | `Fail (no shared cipher)` |
| - | BF-CBC | No | **Weak BF-CBC** |
@@ 472,11 481,13 @@
#### Configuring: `--cipher`
| `--cipher` | NCP |
+ | --- | --- |
| AES-256-CBC | No |
**Client version 2.5**
| `--data-ciphers` | `-fallback` | NCP | Connection |
+ | --- | --- | --- | --- |
| - | - | No | `Fail (no shared cipher)` |
| - | AES-256-CBC | No | **OK. AES-256-CBC** |
@@ 485,14 496,15 @@
#### Default configuration: No effective directives specified.
| `--cipher` | NCP |
+ | --- | --- |
| - | No |
**Server version 2.5**
| `--data-ciphers` | `-fallback` | NCP | Connection |
+ | --- | --- | --- | --- |
| - | - | No | `Fail (no shared cipher)` |
| | BF-CBC | |
- |--------------|---------------|--------|
| | **Weak** BF-CBC | No |
### Client version 2.3 built with `--enable-small`
@@ 509,4 521,3 @@
|------------------|--------------|-----|----------------------------|
| | | No | Fail (no shared cipher) |
| | AES-256-CBC | No | **OK. AES-256-CBC** |
- ```
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9