I've searched this forum, in the faqs and on the internet itself and can't find an answer to this question: what cipher suites are supported by the OpenVPN Connect app on iOS?
I have an Asus RT-AC68U hw version A1 with AsusWRT-Merlin 386.1_alpha2-g9675e20696 firmware used as an OpenVPN server. This latest alpha version has OpenVPN v2.5.0 on it:
Code: Select all
openvpn --version OpenVPN 2.5.0 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov 2 2020 library versions: OpenSSL 1.1.1h 22 Sep 2020, LZO 2.08 Originally developed by James Yonan Copyright (C) 2002-2018 OpenVPN Inc <firstname.lastname@example.org> Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_werror=no enable_win32_dll=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no
I've used the AES-128-CBC cipher suite since it had the best speed on the router, but read that it's that not that secure anymore and should use AES-128-GCM instead. I didn't make this change since this router lacks AES hardware acceleration and the speed was much lower.
However recently I've read upon CHACHA20-POLY1305 cipher suite and that it has better throughput than AES-128-CBC (without hardware acceleration for AES) and also better security so I've changed the cipher to it, but when I've loaded an updated client config on the phone it refused to connect; from the router's log:
Code: Select all
PUSH: No common cipher between server and client. Server data-ciphers: 'CHACHA20-POLY1305:AES-128-CBC', client supported ciphers 'AES-256-GCM:AES-128-GCM'
Now I've switched the phone to use AES-128-GCM, but would like to use CHACHA20:POLY1305 instead.
Other clients, an Asus RT-AC66U B1 (similar hardware to the Asus RT-AC68U) running the same firmware and an Windows client, run happily with CHACHA20:POLY1305 cipher suites.
Can anybody shed any light on this? Thank you.