Hello,
First post, a Google search at first, but I didn't find the answer so here am I 🙂
I have subscribed to a known VPN provider (don't know if I can tell which one ?). Their Windows client works fine, and allow the user to select AES-128 as encryption, SHA256 as authentication, and RSA-4096 as handshake. Their client is based on OpenVPN.
However I'm trying to figure out how to translate it to OpenVPN on OpenBSD 5.4. I'm trying to keep the same settings SHA256/AES-128-CBC/RSA-4096.
I have the following config file :
client
dev tun
proto tcp
remote their.server.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass mypass.txt
comp-lzo
verb 1
reneg-sec 0
auth-nocache
# Part I'm trying to set up
tls-cipher TLS-DHE-RSA-WITH-AES-128-CBC-SHA
cipher BF-CBC
auth SHA1
The connection is working well without the three last lines. However, as soon as I add something like "cipher AES-126-CBC" or "auth SHA256" I have warnings while I'm connecting :
Mon Apr 28 00:12:56 2014 WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
Mon Apr 28 00:12:56 2014 WARNING: 'auth' is used inconsistently, local='auth SHA256', remote='auth SHA1'
I tried to modify the "tls-cipher" option as above, the connection is ok without warning, but I suppose the TLS cipher only applies to the handshake, and that my connection is still encrypted with Blowfish afterward ?Finally, how to setup the RSA-4096 too ?
I asked their support, and they said it is doable, that it's not too complicated, but that they do not offer support for OpenVPN (as it is not their software, from what I understood). How to setup "SHA256/AES-128-CBC/RSA-4096" in an OpenVPN config file ?
Thanks in advance for any help 🙂
Regards,
Guillaume.
