Blame
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 1 | # OpenVPN Cipher Negotiation (Quick reference) |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 2 | This wiki defines the **expected** behaviour of Cipher Negotiation between common configurations of OpenVPN servers and clients. |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 3 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 4 | **Important note**: `CHACHA20-POLY1305` is widely recognised as a suitable alternative to an `AES` based cipher. |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 5 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 6 | * OpenVPN would like to know about any: |
| 7 | 1. *Unexpected* behaviour. |
|||
| 8 | 1. Errors on this page. |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 9 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 10 | For full details please see: |
| 11 | https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/cipher-negotiation.rst |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 12 | |
| 13 | ||||
| 14 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 15 | ## Effective directives and terms |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 16 | |
| 17 | * **2.5**: `--data-ciphers ALG:ALG` - Data channel ciphers **list**. Default: AES-256-GCM:AES-128-GCM |
|||
| 18 | * **2.5**: `--data-ciphers-fallback ALG` - Single **ALG** (Essentially the same as `--cipher`) |
|||
| 19 | * Source: https://sourceforge.net/p/openvpn/mailman/message/37232992/ |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 20 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 21 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 22 | |
| 23 | **Use of `--data-ciphers-fallback` is limited to:** |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 24 | * Openvpn Clients which do not support `--data-ciphers` (Openvpn 2.4, 2.3) |
| 25 | * Solution: Upgrade or use `--data-ciphers-fallback` in your Server configuration. |
|||
| 26 | * Openvpn Clients using `--ncp-disable` DEPRECATED (Openvpn 2.4) |
|||
| 27 | * Solution: Do NOT use `--ncp-disable`, EVER |
|||
| 28 | * Openvpn built with `--enable-small` (see below) |
|||
| 29 | * Openvpn Server that does not support Cipher Negotiation: |
|||
| 30 | * Solution: Upgrade. Otherwise, both Client and Server will DEFAULT to an INSECURE BF-CBC cipher, unless both Client and Server have a **secure** `--cipher` configured... otherwise, the VPN connection will fail. |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 31 | |
| 32 | **The Point**: |
|||
| 33 | ``` |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 34 | @cron2_ | for clients calling in without NCP │ |
| 35 | @cron2_ | could be a 2.5 client called with --ncp-disable "because someone on the Internet said so" │ |
|||
| 36 | wiscii | but that would auto-fallback to AES* ? 2.5 .. no ? │ |
|||
| 37 | * | wiscii checks │ |
|||
| 38 | wiscii | --ncp-disable is deprecated .. │ |
|||
| 39 | wiscii | and using it is currently a total fail FATAL error │ |
|||
| 40 | wiscii | ok ,, that is 2.6 │ |
|||
| 41 | wiscii | i have clearly misunderstood the use of the data-cipher-fallback bit, it's just to convoluted | |
|||
| 42 | @cron2_ | the point is that 2.5 and up do not select BF-CBC "by default" anymore, just because it was the │ |
|||
| 43 | | cipher in earlier times │ |
|||
| 44 | @cron2_ | *if* NCP is active, this is a non-issue, because AES │ |
|||
| 45 | @cron2_ | but if *no* NCP is active (old client or --ncp-disable), openvpn does not know what to do, and │ |
|||
| 46 | | on purpose does not "just use BF-CBC". So it tells you: if you really want the old behaviour, │ |
|||
| 47 | | put it into your config. │ |
|||
| 48 | wiscii | yep .. i can see that logic │ |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 49 | ``` |
| 50 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 51 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 52 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 53 | **All**: `--cipher ALG` - Data channel cipher. **Will be deprecated**. |
| 54 | In OpenVPN 2.5 `--cipher` does not have a default `ALG`. |
|||
| 55 | In OpenVPN up to 2.4 the default `ALG` is BF-CBC. |
|||
| 56 | **2.4**: `--ncp-disable` - Disable Negotiated Cipher Protocol - **Deprecated**. |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 57 | **Note**: This document does **not** cover the use of `--ncp-disable`. |
| 58 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 59 | In this Wiki cipher negotiation comes in four flavours: |
| 60 | * **Full** negotiation: Both server and client support NCP |
|||
| 61 | * **Partial** negotiation: Only the client supports NCP (Known as "Poor man's NCP", See note below) |
|||
| 62 | * **No** negotiation: The client does not support NCP (The server NCP has no effect). |
|||
| 63 | * When the server supports NCP but has a mixture of clients then NCP is defined as '**Yes**'. |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 64 | |
| 65 | Cipher negotiation was originally named "Negotiated Cipher Protocol" **NCP** |
|||
| 66 | ||||
| 67 | ## Poor Man's NCP |
|||
| 68 | ||||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 69 | **Poor Man's NCP** is a term used to describe when either peer does **not** support cipher negotiation, directly. **And** the subsequent configurations which can be used to get full AEAD cipher support, without the need to negotiate it. |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 70 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 71 | This wiki fully expands the server side variety of Poor Man's NCP, which means this wiki does not apply *that* term to the server. This wiki only applies the term to mean the client because it is easier to understand. Also, clients which suffer from Poor Man's NCP can be more easily upgraded than an old server. So this wiki fully explains the server side, while encouraging the user to upgrade their client OpenVPN version. |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 72 | |
| 73 | ## Common configurations |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 74 | Commonly expected configurations of the *Effective directives* above. |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 75 | ### Servers |
| 76 | ||||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 77 | * Version 2.5 |
| 78 | 1. Default configuration: No effective directives specified. |
|||
| 79 | 1. Configuring: `--data-ciphers` |
|||
| 80 | * Version 2.4 |
|||
| 81 | 1. Default configuration: No effective directives specified. |
|||
| 82 | 1. Configuring: `--cipher` |
|||
| 83 | 1. Configuring: `--cipher` and `--ncp-disable` |
|||
| 84 | * Version 2.3 |
|||
| 85 | 1. Default configuration: No effective directives specified. |
|||
| 86 | 1. Configuring: `--cipher` |
|||
| 87 | * Version 2.2 |
|||
| 88 | 1. Default configuration: No effective directives specified. |
|||
| 89 | 1. Configuring: All bets are off - Upgrade now! |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 90 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 91 | ### Clients |
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 92 | * Version 2.5 |
| 93 | 1. Default configuration: No effective directives specified. |
|||
| 94 | * Version 2.4 |
|||
| 95 | 1. Default configuration: No effective directives specified. |
|||
| 96 | 1. Configuring: `--cipher` |
|||
| 97 | * Version 2.3 |
|||
| 98 | 1. Default configuration: No effective directives specified. |
|||
| 99 | 1. Configuring: `--cipher` |
|||
| 100 | * Version 2.2 |
|||
| 101 | 1. Default configuration: No effective directives specified. |
|||
| 102 | 1. Configuring: All bets are off - Upgrade now! |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 103 | |
| 104 | ## Expected Behaviour indexed by Server version |
|||
| 105 | ### Server version 2.5 |
|||
| 106 | #### Default configuration: No effective directives specified. |
|||
| 107 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 108 | | | | |
| 109 | |-|-| |
|||
| 110 | |`--data-ciphers`| NCP | |
|||
| 111 | |-| Yes | |
|||
| 112 | ||||
| 113 | ##### Client version 2.5 |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 114 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 115 | | | | |
| 116 | |-|-| |
|||
| 117 | |`--data-ciphers`| NCP | Connection | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 118 | |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 119 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 120 | |AES-256-CBC| Full | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 121 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 122 | ##### Client version 2.4 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 123 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 124 | | | | |
| 125 | |-|-| |
|||
| 126 | | `--cipher` | NCP | Connection | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 127 | | - | Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 128 | | AES-256-CBC | Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| 129 | | BF-CBC | Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 130 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 131 | ##### Client version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 132 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 133 | | | | |
| 134 | |-|-| |
|||
| 135 | | `--cipher` | NCP | Connection | |
|||
| 136 | | - | No | `Fail (no shared cipher)` | |
|||
| 137 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
|||
| 138 | | BF-CBC | No | `Fail (no shared cipher)` | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 139 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 140 | ##### Client version 2.2 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 141 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 142 | | | | |
| 143 | |-|-| |
|||
| 144 | | `--cipher` | NCP | Connection | |
|||
| 145 | | - | No | `Fail (no shared cipher)` | |
|||
| 146 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
|||
| 147 | | BF-CBC | No | `Fail (no shared cipher)` | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 148 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 149 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 150 | |
| 151 | #### Server version 2.5 Configuring: `--data-ciphers` |
|||
| 152 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 153 | | | | |
| 154 | |-|-| |
|||
| 155 | |`--data-ciphers`| NCP | |
|||
| 156 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Yes | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 157 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 158 | ##### Client version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 159 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 160 | | | | | |
| 161 | |-|-|-| |
|||
| 162 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 163 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 164 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 165 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 166 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 167 | ##### Client version 2.2 |
| 168 | ||||
| 169 | | | | | |
|||
| 170 | |-|-|-| |
|||
| 171 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 172 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 173 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 174 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 175 | |
| 176 | ---- |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 177 | |
| 178 | ### Server version 2.4 |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 179 | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 180 | #### Default configuration: No effective directives specified. |
| 181 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 182 | | | | | |
| 183 | |-|-|-| |
|||
| 184 | |`--cipher`|`--ncp-ciphers`|NCP| |
|||
| 185 | |-|-|Yes| |
|||
| 186 | ||||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 187 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 188 | ##### Client version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 189 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 190 | | | | | |
| 191 | |-|-|-| |
|||
| 192 | |`--data-ciphers`| NCP | Connection | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 193 | |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 194 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 195 | |AES-256-CBC| Full | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 196 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 197 | ##### Client version 2.4 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 198 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 199 | | | | | | |
| 200 | |-|-|-|-| |
|||
| 201 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| ab1385 | Samuli Seppänen | 2025-02-24 15:41:12 | 202 | | - |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 203 | | AES-256-CBC |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 204 | | BF-CBC |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 205 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 206 | ##### Client version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 207 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 208 | | | | | |
| 209 | |-|-|-| |
|||
| 210 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 211 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 212 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 213 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 214 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 215 | ##### Client version 2.2 |
| 216 | ||||
| 217 | | | | | |
|||
| 218 | |-|-|-| |
|||
| 219 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 220 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 221 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 222 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 223 | |
| 224 | ---- |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 225 | |
| 226 | #### Server version 2.4 Configuring: `--cipher` |
|||
| 227 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 228 | | | | | |
| 229 | |-|-|-| |
|||
| 230 | | `--cipher` |`--ncp-ciphers`| NCP | |
|||
| 231 | | AES-256-CBC |-| Yes | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 232 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 233 | ##### Client version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 234 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 235 | | | | | |
| 236 | |-|-|-| |
|||
| 237 | |`--data-ciphers`| NCP | Connection | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 238 | |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 239 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Full | **<span style=color:#007000> OK. AES-256-GCM </span>** | |
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 240 | |AES-256-CBC| Full | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 241 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 242 | ##### Client version 2.4 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 243 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 244 | | | | | | |
| 245 | |-|-|-|-| |
|||
| 246 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 247 | | - |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
| 248 | | AES-256-CBC |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| 249 | | BF-CBC |-| Full | **<span style=color:#007000>OK. AES-256-GCM</span>** | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 250 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 251 | ##### Client version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 252 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 253 | | | | | |
| 254 | |-|-|-| |
|||
| 255 | | `--cipher` | NCP | Connection | |
|||
| 256 | | - | No | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 257 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 258 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 259 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 260 | ##### Client version 2.2 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 261 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 262 | | | | | |
| 263 | |-|-|-| |
|||
| 264 | | `--cipher` | NCP | Connection | |
|||
| 265 | | - | No | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 266 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 267 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 268 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 269 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 270 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 271 | #### Server version 2.4 Configuring: `--cipher` and `--ncp-disable` |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 272 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 273 | | | | | |
| 274 | |-|-|-| |
|||
| 275 | | `--cipher` |`--ncp-ciphers`| NCP | |
|||
| 276 | | AES-256-CBC |-| No `--ncp-disable` | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 277 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 278 | ##### Client version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 279 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 280 | | | | | |
| 281 | |-|-|-| |
|||
| 282 | |`--data-ciphers`| NCP | Connection | |
|||
| 283 | |-| Partial | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 284 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 285 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 286 | ##### Client version 2.4 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 287 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 288 | | | | | | |
| 289 | |-|-|-|-| |
|||
| 290 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| 291 | | - |-| Partial | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 292 | | AES-256-CBC |-| Partial | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 293 | | BF-CBC |-| Partial | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 294 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 295 | ##### Client version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 296 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 297 | | | | | |
| 298 | |-|-|-| |
|||
| 299 | | `--cipher` | NCP | Connection | |
|||
| 300 | | - | No | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 301 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 302 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 303 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 304 | ##### Client version 2.2 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 305 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 306 | | | | | |
| 307 | |-|-|-| |
|||
| 308 | | `--cipher` | NCP | Connection | |
|||
| 309 | | - | No | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 310 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 311 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 312 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 313 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 314 | |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 315 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 316 | ### Server version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 317 | #### Default configuration: No effective directives specified. |
| 318 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 319 | | | | |
| 320 | |-|-| |
|||
| 321 | | `--cipher` | NCP | |
|||
| 322 | | - | No | |
|||
| 323 | ||||
| 324 | ##### Client version 2.5 |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 325 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 326 | | | | | |
| 327 | |-|-|-| |
|||
| 328 | |`--data-ciphers`| NCP | Connection | |
|||
| 329 | |-| Partial | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 330 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | *<span style=color:#806000> Weak BF-CBC </span>* | |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 331 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 332 | ##### Client version 2.4 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 333 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 334 | | | | | | |
| 335 | |-|-|-|-| |
|||
| 336 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| 337 | | - |-| Partial | `Fail (no shared cipher)` | |
|||
| 338 | | AES-256-CBC |-| Partial | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 339 | | BF-CBC |-| Partial | *<span style=color:#806000> Weak BF-CBC </span>* | |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 340 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 341 | ##### Client version 2.3 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 342 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 343 | | | | | |
| 344 | |-|-|-| |
|||
| 345 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 346 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 347 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 348 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 349 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 350 | ##### Client version 2.2 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 351 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 352 | | | | | |
| 353 | |-|-|-| |
|||
| 354 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 355 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 356 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 357 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 358 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 359 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 360 | |
| 361 | ||||
| 362 | #### Server version 2.3 Configuring: `--cipher` |
|||
| 363 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 364 | | | | |
| 365 | |-|-| |
|||
| 366 | | `--cipher` | NCP | |
|||
| 367 | | AES-256-CBC | No | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 368 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 369 | ##### Client version 2.5 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 370 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 371 | | | | | |
| 372 | |-|-|-| |
|||
| 373 | |`--data-ciphers`| NCP | Connection | |
|||
| 374 | |-| Partial | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 375 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 376 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 377 | ##### Client version 2.4 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 378 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 379 | | | | | | |
| 380 | |-|-|-|-| |
|||
| 381 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| 382 | | - |-| Partial | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 383 | | AES-256-CBC |-| Partial | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 384 | | BF-CBC |-| Partial | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 385 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 386 | ##### Client version 2.3 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 387 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 388 | | | | | |
| 389 | |-|-|-| |
|||
| 390 | | `--cipher` | NCP | Connection | |
|||
| 391 | | - | No | `Fail (no shared cipher)` | |
|||
| 75938b | Samuli Seppänen | 2025-02-24 15:25:13 | 392 | | AES-256-CBC | No | **<span style=color:#007000>OK. AES-256-CBC</span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 393 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 394 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 395 | ##### Client version 2.2 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 396 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 397 | | | | | |
| 398 | |-|-|-| |
|||
| 399 | | `--cipher` | NCP | Connection | |
|||
| 400 | | - | No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 401 | | AES-256-CBC | No | **<span style=color:#007000> OK. AES-256-CBC </span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 402 | | BF-CBC | No | `Fail (no shared cipher)` | |
| 403 | ||||
| 404 | ---- |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 405 | |
| 406 | ### Server version 2.2 |
|||
| 407 | #### Default configuration: No effective directives specified. |
|||
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 408 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 409 | | | | |
| 410 | |-|-| |
|||
| 411 | | `--cipher` | NCP | |
|||
| 412 | | - | No | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 413 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 414 | ##### Client version 2.5 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 415 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 416 | | | | | |
| 417 | |-|-|-| |
|||
| 418 | |`--data-ciphers`| NCP | Connection | |
|||
| 419 | |-| Partial | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 420 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 421 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 422 | ##### Client version 2.4 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 423 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 424 | | | | | | |
| 425 | |-|-|-|-| |
|||
| 426 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 427 | | - |-| Partial | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 428 | | AES-256-CBC |-| Partial | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 429 | | BF-CBC |-| Partial | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 430 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 431 | ##### Client version 2.3 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 432 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 433 | | | | | |
| 434 | |-|-|-| |
|||
| 435 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 436 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 437 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 438 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 439 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 440 | ##### Client version 2.2 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 441 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 442 | | | | | |
| 443 | |-|-|-| |
|||
| 444 | | `--cipher` | NCP | Connection | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 445 | | - | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 446 | | AES-256-CBC | No | `Fail (no shared cipher)` | |
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 447 | | BF-CBC | No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 448 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 449 | ---- |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 450 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 451 | #### Server version 2.2 Configuring: `--cipher` |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 452 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 453 | | | | |
| 454 | |-|-| |
|||
| 455 | | `--cipher` | NCP | |
|||
| 456 | | AES-256-CBC | No | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 457 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 458 | ##### Client version 2.5 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 459 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 460 | | | | | |
| 461 | |-|-|-| |
|||
| 462 | |`--data-ciphers`| NCP | Connection | |
|||
| 463 | |-| Partial | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 464 | |AES-256-GCM:AES-128-GCM:AES-256-CBC:BF-CBC| Partial | **<span style=color:#007000> OK. AES-256-CBC </span>** | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 465 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 466 | ##### Client version 2.4 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 467 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 468 | | | | | | |
| 469 | |-|-|-|-| |
|||
| 470 | | `--cipher` |`--ncp-ciphers`| NCP | Connection | |
|||
| 471 | | - |-| Partial | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 472 | | AES-256-CBC |-| Partial | **<span style=color:#007000> OK. AES-256-CBC </span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 473 | | BF-CBC |-| Partial | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 474 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 475 | ##### Client version 2.3 |
| 6d3fab | Samuli Seppänen | 2025-02-11 08:47:26 | 476 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 477 | | | | | |
| 478 | |-|-|-| |
|||
| 479 | | `--cipher` | NCP | Connection | |
|||
| 480 | | - | No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 481 | | AES-256-CBC | No | **<span style=color:#007000> OK. AES-256-CBC </span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 482 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 483 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 484 | ##### Client version 2.2 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 485 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 486 | | | | | |
| 487 | |-|-|-| |
|||
| 488 | | `--cipher` | NCP | Connection | |
|||
| 489 | | - | No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 490 | | AES-256-CBC | No | **<span style=color:#007000> OK. AES-256-CBC </span>** | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 491 | | BF-CBC | No | `Fail (no shared cipher)` | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 492 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 493 | ---- |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 494 | |
| 495 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 496 | ## Special requirement: OpenVPN built with `--enable-small` |
| 497 | When OpenVPN version 2.3 or older is built with `--enable-small` (Typically found in routers) then Openvpn 2.5 **must** use `--data-ciphers-fallback ALG`. The `ALG` must match the peers `--cipher ALG`. **This is the only case that** `--data-ciphers-fallback` **takes effect.** |
|||
| 498 | 2.5: `--data-ciphers-fallback ALG` - Fallback data channel cipher |
|||
| 499 | Only to allow OpenVPN version 2.5 to connect with old peers built with `--enable-small`. |
|||
| 500 | **Will be deprecated and removed** |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 501 | ### Server version 2.3 built with `--enable-small` |
| 502 | #### Default configuration: No effective directives specified. |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 503 | | | | |
| 504 | |-|-| |
|||
| 505 | | `--cipher` | NCP | |
|||
| 506 | | - | No | |
|||
| 9db507 | Samuli Seppänen | 2025-02-11 08:54:52 | 507 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 508 | ##### Client version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 509 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 510 | | | | | | |
| 511 | |-|-|-|-| |
|||
| 512 | |`--data-ciphers` =|`-fallback`| NCP | Connection | |
|||
| 513 | |-|-| No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 514 | |-|BF-CBC| No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 515 | |
| 516 | ### Server version 2.3 built with `--enable-small` |
|||
| 517 | #### Configuring: `--cipher` |
|||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 518 | | `--cipher` | NCP | |
| 519 | | AES-256-CBC | No | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 520 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 521 | ##### Client version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 522 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 523 | | | | | | |
| 524 | |-|-|-|-| |
|||
| 525 | |`--data-ciphers`|`-fallback`| NCP | Connection | |
|||
| 526 | |-|-| No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 527 | |-|AES-256-CBC| No | **<span style=color:#007000> OK. AES-256-CBC </span>** | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 528 | |
| 529 | ### Client version 2.3 built with `--enable-small` |
|||
| 530 | #### Default configuration: No effective directives specified. |
|||
| 531 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 532 | | | | |
| 533 | |-|-| |
|||
| 534 | | `--cipher` | NCP | |
|||
| 535 | | - | No | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 536 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 537 | ##### Server version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 538 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 539 | | | | | | |
| 540 | |-|-|-|-| |
|||
| 541 | |`--data-ciphers`|`-fallback`| NCP | Connection | |
|||
| 542 | |-|-| No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 543 | |-|BF-CBC| No | *<span style=color:#806000> Weak BF-CBC </span>* | |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 544 | |
| 545 | ### Client version 2.3 built with `--enable-small` |
|||
| 546 | #### Configuring: `--cipher` |
|||
| 547 | ||||
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 548 | | | | |
| 549 | |-|-| |
|||
| 550 | | `--cipher` | NCP | |
|||
| 551 | | AES-256-CBC | No | |
|||
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 552 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 553 | ##### Server version 2.5 |
| aa0ece | Samuli Seppänen | 2025-02-11 08:39:49 | 554 | |
| e7ada2 | Samuli Seppänen | 2025-02-24 14:52:12 | 555 | | | | | | |
| 556 | |-|-|-|-| |
|||
| 557 | |`--data-ciphers`|`-fallback`| NCP | Connection | |
|||
| 558 | |-|-| No | `Fail (no shared cipher)` | |
|||
| 2dec56 | Samuli Seppänen | 2025-02-24 15:40:21 | 559 | |-|AES-256-CBC| No | **<span style=color:#007000> OK. AES-256-CBC </span>** | |