We have this rather old VPN tunnel software that is running in various wireless/mobile networks (from 2G mobile and upwards). It is currently running WTLS, as this software is from the old days when WAP was cool. We want to replace this WTLS implementation with "plain" TLS (v1.2). Security is just one of the reasons.

The question, then, becomes:

(?) How would you configure TLS to work with decent performance and security in slow 2G mobile networks? What parameters would you adjust? What algorithms/ciphers/record size/etc would you recommend? Any other tricks to "trim" TLS for our scenario?

Since this is a VPN software, the number of handshakes shouldn't be that high, so the priority here is to get as much application data as possible through, with as little overhead as possible.

closed as off-topic by StackzOfZtuff, Xander, schroeder Nov 22 '15 at 17:38

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I think this question does has less to do with security than with network engineering. Might be better for network stackexchange. – Lucas Kauffman Nov 22 '15 at 13:28
  • 1
    Suggesting move to http://networkengineering.stackexchange.com. – StackzOfZtuff Nov 22 '15 at 13:30
  • The optimal record size is a networking question, but the cipher suite is a security question. I would recommend PFS and AEAD to get modern crypto. – Z.T. Nov 23 '15 at 19:23