[strongSwan] Forward Secrecy

[Noel Kuntze]

strongSwan isn't software for the proletariat. As the introduction says, you need a background in networking. Obviously, to read the introduction you have to be able to find and read the documentation. The same is true for finding the list of cipher keywords on the wiki, where you will find the available ciphers, DH and HMAC keywords.

Read the introduction and the tutorial about forwarding. VPNs are not trivial to set up and operate securely and correctly. If you're unsure, just use Algo[1].

The BLISS certificates are broken. Don't use them.

Just use very long RSA keys (4096 bit). That gives you a good security margin, even in post quantum computing.

[1] https://github.com/trailofbits/algo

On 20.12.2017 16:55, Colony.three wrote:
> I am not very happy using RSA as the cipher, since it's been cracked.  And, as any reader of Schnier knows, elliptic curve is out of the question.
>
> ikev2 only here.   I would like to use a DHE cipher, or better yet a lattice cipher, but I can not find any evidence of how to set these.  I presume it would be part of the ike= directive, but there are no examples of what strings to use.  (I have no idea what the esp= directive pertains to)  Can anyone advise?
>
> I notice that there is a provisional lattice cipher for StrongSwan, very good news (though I'd have to compile SS), but unfortunately it is not supported by the Android app.  Would but that it were...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20171221/d300c940/attachment.sig>