Score:0

Which Encryption Method Is Being Used in My OpenVPN server?

us flag

When I try connecting to my OpenVPN server , the log on OpenVPN software is a bit confusing .

Fri Nov 19 04:16:29 2021 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Nov 19 04:16:29 2021 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 19 04:16:29 2021 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Nov 19 04:16:29 2021 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 19 04:16:29 2021 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA

Is the data being encrypted in DHE-RSA-AES256-SHA ?

Here is my client .ovpn file content :

persist-key
persist-tun
resolv-retry infinite
nobind
pull

verb 3

auth-user-pass

here is my server.conf file on the VPS :

port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
#plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
persist-key
persist-tun
status 1194.log
verb 3
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf

so my question is : " what encryption method is being used here ? "

I see :

Fri Nov 19 04:16:29 2021 Data Channel Encrypt: **Cipher 'BF-CBC' initialized with 128 bit key**
Fri Nov 19 04:16:29 2021 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMA

and then :

Control Channel: TLSv1, cipher TLSv1/SSLv3 **DHE-RSA-AES256-SHA**, 1024 bit RSA

I want to use the lowest encryption method possible as I want higher speed and less data usage . If there is anyway I can improve the speed and have a faster connection , please let me know .

BTW , OpenVPN server version is 2.4.11 .

Score:1
cn flag

There is two differents things here :

SHA1

The Secure Hash Algorithm (SHA) is used to authenticate data and SSL/TLS connections. In this process, a unique fingerprint is created to validate the TLS certificate – that is, to check you’re connecting to the server you’re supposed to be. Without this, a hacker could re-route your traffic to their own server instead of your VPN provider’s

The cipher

Encryption ciphers are at the heart of VPN technology. They help determine how the secure tunnel is formed. Each cipher offers a different solution to secure, private and anonymous browsing.

Warnings

Be carefull using SHA1, because the algorythm is not enought secure now. You should use a better algo, like SHA512 for the handshake.

Conclusion

Your VPN encryption's algo is DHE-RSA-AES256-SHA

I recommand you to read this :)

master lfc6 avatar
us flag
thanks for the information . they were very useful . for speed purposes , I need to reduce encryption level . Do you know how to reduce encryption level in OpenVPN server 2.4.11 ? Perhaps to something like DHE-RSA-AES128-SHA . I tested different parameters in server.conf and also the ovpn file but didn't achieve anything .
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.