We have this rather old VPN tunnel software that is running in various wireless/mobile networks (from 2G mobile and upwards). It is currently running WTLS, as this software is from the old days when WAP was cool. We want to replace this WTLS implementation with "plain" TLS (v1.2). Security is just one of the reasons.
The question, then, becomes:
(?) How would you configure TLS to work with decent performance and security in slow 2G mobile networks? What parameters would you adjust? What algorithms/ciphers/record size/etc would you recommend? Any other tricks to "trim" TLS for our scenario?
Since this is a VPN software, the number of handshakes shouldn't be that high, so the priority here is to get as much application data as possible through, with as little overhead as possible.