interesting question - I'd repost it on the #openvpn-devel IRC channel for better response.
First of all, changes like this ARE planned for OpenVPN 3.0, but there is no timeline for that at all at this moment.
It should be possible to do this, even without breaking the OpenVPN protocol, but the change is not trivial; you'd have to move the cipher (and digest) used from a global 'struct' to a session 'struct' and adjust all code to grab the cipher+digest from that. Someone who is familar with the OpenVPN codebase should be to do this in a few days time. I don't have the time to do it, unfortunately, but I think this is a very useful change. I could even foresee some negotation, e.g. on the server you specify
cipher AES-256-CBC:AES-128-CBC:BF-CBC:NONE
and when a client connects and presents a similar list of ciphers than a choice can be made; you could even add stuff like
cipher *
to accept any cipher.
But now I am getting ahead of things, I *think* it should be possible to do this by moving the cipher+digest to the session variables, but I may be completely wrong , of course.
