From 0693c96797f7d5dfa097d24070e2bd4c9528d0e7 Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 04:41:00 +0100 Subject: [PATCH 1/5] Add missing recommended key lengths to OpenVPN options Add key lengths to the OpenVPN options, for asymmetric keys of size 3072 (for current use), 7680, 15360 (for long term resistance), 8192 and 16384 (common binary exponents). These are both supported by OpenVPN anyhow, and for certain uses are currently recommended (eg long term resistance to replay/decryption). See keylength.com for citations. This PR would only affect OpenVPN, and OpenVPN supports these key sizes, so should not cause any issue. --- src/etc/inc/openvpn.inc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/etc/inc/openvpn.inc b/src/etc/inc/openvpn.inc index 9e87170262..2be9b373fa 100644 --- a/src/etc/inc/openvpn.inc +++ b/src/etc/inc/openvpn.inc @@ -103,7 +103,8 @@ $openvpn_verbosity_level = array( global $openvpn_dh_lengths; $openvpn_dh_lengths = array( - 1024, 2048, 4096); + 1024, 2048, 3072, 4096, 7680, 8192, 15360, 16384 +); global $openvpn_cert_depths; $openvpn_cert_depths = array( From 49810252681df9bd553e2221c885ceffaa2c4c7f Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 04:52:09 +0100 Subject: [PATCH 2/5] Update OpenVPN Wizard to include missing key sizes ...and add some useful info to guide the user. --- src/usr/local/www/wizards/openvpn_wizard.xml | 24 ++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/src/usr/local/www/wizards/openvpn_wizard.xml b/src/usr/local/www/wizards/openvpn_wizard.xml index a4498bd25f..02a651f867 100644 --- a/src/usr/local/www/wizards/openvpn_wizard.xml +++ b/src/usr/local/www/wizards/openvpn_wizard.xml @@ -367,7 +367,7 @@ keylength Key length - <br/>Size of the key which will be generated. The larger the key, the more security it offers, but larger keys are generally slower to use. + <br/>Size of the key which will be generated. The larger the key, the more security it offers, but larger keys are generally slower to use. As of 2016, 2048 bit is the minimum and most common selection and 4096 is the maximum in common use. For more information see <a href="https://keylength.com">keylength.com</a> select 2048 ovpnserver->step6->keylength @@ -385,9 +385,29 @@ 2048 + + + + + From 7c684f3b95f641134496bc1210cfb2d814468767 Mon Sep 17 00:00:00 2001 From: stilez Date: Sun, 8 May 2016 04:54:36 +0100 Subject: [PATCH 3/5] missed a comment I added and shouldn't have - removed --- src/usr/local/www/wizards/openvpn_wizard.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/usr/local/www/wizards/openvpn_wizard.xml b/src/usr/local/www/wizards/openvpn_wizard.xml index 02a651f867..59a0cc3c90 100644 --- a/src/usr/local/www/wizards/openvpn_wizard.xml +++ b/src/usr/local/www/wizards/openvpn_wizard.xml @@ -389,7 +389,7 @@ 3072