OpenVPN SWEET32 warning in 2.4

nickh

I have a site to site tunnel set up between two servers, both running OpenVPN 2.4.4 x86_64-redhat-linux-gnu [Fedora EPEL patched]. In the connection logs I see:

Dec 12 23:25:14 server openvpn: Wed Dec 12 23:25:14 2018 OpenVPN 2.4.4 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 26 2017
Dec 12 23:25:14 server openvpn: Wed Dec 12 23:25:14 2018 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Dec 12 23:25:14 server openvpn: Wed Dec 12 23:25:14 2018 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Dec 12 23:2

My configs are pretty much symmetric and this is one end:

dev tun
port 1195
remote remote_FQDN
ifconfig 10.8.20.40 10.8.20.41
route 10.137.0.0 255.255.0.0 10.8.20.41
comp-lzo
keepalive 10 60
persist-key
persist-tun
user nobody
group nobody
secret static.key

I thought OpenVPN 2.4+ was supposed to autonegotiate a stronger cipher without having to specify one. Am I mistaken or is there a bug here?

TinCanTech

nickh wrote I thought OpenVPN 2.4+ was supposed to autonegotiate a stronger cipher

Not the way you have it configured.

nickh

Please give me a clue? How do I get autonegotiation? It seem to happen automatically with my roadwarrior config without any explicit parameters.

nickh

From the man pages:

–cipher alg
Encrypt data channel packets with cipher algorithm alg.The default is BF-CBC, an abbreviation for Blowfish in Cipher Block Chaining mode. When cipher negotiation (NCP) is allowed, OpenVPN 2.4 and newer on both client and server side will automatically upgrade to AES-256-GCM.See –ncp-ciphers and –ncp-disable for more details on NCP.

I can do it manually by setting both ends to "cipher AES-256-CBC", but setting one end does not work so clearly it is not auto-negotiating.

FWIW AES-256-GCM does not work as it is for client/server mode only.

TinCanTech

nickh wrote FWIW AES-256-GCM does not work as it is for client/server mode only

As is negotiated cypher protocol.