OS: Gentoo/Linux
Crypto: LibreSSL 3.2.6
Months ago my VPN provider switched to CHACHA20-POLY1305 as default cipher for the data channel, citing several advantages over AES-256-GCM on machines without AES-NI extensions. As I do have one such machine I decided to switch to the new cipher and see what all the fuss was about.
Upon restarting the client with the new configuration I get the following error with no connection being established:
[olog]2021-09-27 17:08:29 us=593887 Cipher algorithm 'ChaCha20-Poly1305' not found
2021-09-27 17:08:29 us=593908 Unsupported cipher in --data-ciphers: CHACHA20-POLY1305
Options error: NCP cipher list contains unsupported ciphers or is too long.
Use --help for more information.[/olog]
Below I include the basic makeup of my client configuration files:
[oconf=]client
dev tun
remote SUPPRESSED
resolv-retry infinite
nobind
persist-key
persist-tun
auth-nocache
route-delay 5
verb 4
explicit-exit-notify 5
push-peer-info
setenv UV_IPV6 yes
remote-cert-tls server
comp-lzo no
data-ciphers CHACHA20-POLY1305:AES-256-GCM:AES-256-CBC:AES-192-GCM:AES-192-CBC:AES-128-GCM:AES-128-CBC
data-ciphers-fallback AES-256-CBC
proto udp
key-direction 1
script-security 2
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh
log /var/log/openvpn.log
<ca>
SUPPRESSED
</ca>
<cert>
SUPPRESSED
</cert>
<key>
SUPPRESSED
</key>
<tls-auth>
SUPPRESSED
</tls-auth>[/oconf]
Available ciphers for the data channel:
https://dpaste.com/4BLQN4TUM
Available ciphers for the control channel:
https://dpaste.com/HXFW7S7UR
Any suggestions would be appreciated!
