When I look at the logs for my OpenVPN connection, I am seeing two items that stand out. Was hoping that someone would be kind enough to point out the difference between the two: 014-10-06 10:47:00 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client [color=#0040FF]In my server config, I am using cipher AES-128-CBC. My understanding is that while 256 bit would be better, 128 bit is usually "good enough". Trying to focus on VPN performance just a bit.[/color] 2014-10-06 10:47:01 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA [color=#0040FF]Closely below the tunnel options line, I see that the SSL Handshake occurred with 256 bit encryption. This makes me wonder what the difference is between the two. Is the certificate verification encrypted with 256 bits, but the data across the tunnel itself only encrypted with 128 bits? I'm thining maybe two totally independent encryptions taking place?[/color] Thanks for any explanations!

[quote="cas8100"]'m thining maybe two totally independent encryptions taking place?[/quote]Indeed .. control channel and data channel .. Plus you have some differences between [b]symmetric :: xx-cbc[/b] and [b]asymmetric encryption :: PKI[/b] And have you read about elliptic curves ? [url]http://kakaroto.homelinux.net/2012/01/how-the-ecdsa-algorithm-works/[/url]

Understanding Encryption

cas8100

When I look at the logs for my OpenVPN connection, I am seeing two items that stand out. Was hoping that someone would be kind enough to point out the difference between the two:

014-10-06 10:47:00 Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client

In my server config, I am using cipher AES-128-CBC. My understanding is that while 256 bit would be better, 128 bit is usually "good enough". Trying to focus on VPN performance just a bit.

2014-10-06 10:47:01 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA

Closely below the tunnel options line, I see that the SSL Handshake occurred with 256 bit encryption. This makes me wonder what the difference is between the two. Is the certificate verification encrypted with 256 bits, but the data across the tunnel itself only encrypted with 128 bits? I'm thining maybe two totally independent encryptions taking place?

Thanks for any explanations!

Traffic

cas8100 wrote'm thining maybe two totally independent encryptions taking place?

Indeed .. control channel and data channel ..

Plus you have some differences between symmetric :: xx-cbc and asymmetric encryption :: PKI

And have you read about elliptic curves ?
http://kakaroto.homelinux.net/2012/01/how-the-ecdsa-algorithm-works/

cas8100

Thank you. All interesting information regarding ECC, but I think a little more detail than I'd like to dive into.

While some of the more modern methods are significantly more secure, would the encryption I'm using for both channels would still be considered adequate for the average home user? That is dh1024 keys and the 128 bit AES cipher.

Thanks again.