New ciphers implementing #247 #352
Conversation
|
I think we can keep aes128gcm16 and ecp256 unless there is a good reason to switch both. We should hardcode the prf (prfsha512) like before. IMHO default and windows should look like: defaults: windows: (unless we find we can support something better on Windows after the Creators Update comes out) |
|
This PR closes #247 btw |
|
You need to change the mobileconfig too |
|
Works on iOS 10.3.1 |
|
macOS 10.12.4 works |
|
Ubuntu 17.04 confirmed with above requested changes. |
jackivanov
force-pushed
the
new_cipher_suit
branch
from
83ca5a7 to
fe83055
Compare
This reverts commit b06524d.
|
Works on Windows 10 |
|
Works on Android 7.1.1 strongSwan 1.8.2 |
|
Should the order be reversed? Right now, it's ciphers: Should it be ciphers: |
|
Yes, it should! @gunph1ld can you please make this change? Strongest ciphers first. |
|
@jauderho in your comment on going from AES256 to 128: the additional security margin gains nothing between the two sizes, but 128 will generate less overhead in terms of network, cpu, etc. We default to 128 when available. |
Switches to SHA2_512_256 HMAC integrity algorithm and adds cipher compatibility for other platforms.
Additional testing required.
The cipher suite should be review