I understand the term "best" is subjective but I would like to try to keep this discussion as objective as possible and get the opinion of other security professionals for my chosen cipher suite parameters. I would like to disucss the tradeoffs of security and performance on modern hardware as of 2016. The configuration is for site-to-sites typically involving ASA->ASA and ASA->Linux (Strongswan). The goal of my security is protection against a corporate advesery or group of hackers. I assume the attacker is not a well funded nation state and am leaning toward performance over an increase in theoretical security.

I base my research on Strongswan's Security Recomendations

I have come up with the following transform sets

  • AES-256-XXX - I am torn between GCM and CBC mode as I believe GCM is theoretically more secure. AES is chosen due to the fact that AES extensions are implemented in modern hardware. Is there a large difference in performance between AES 128 v AES 256 in moden hardware? Is there large difference in performance between GCM and CBC mode? I assume cipher suties like blowfish, twofish, and 3des are far slower due to non-hardware implemtations. AES is also the "gold standard" of symetric cipher.

  • SHA 256 - SHA1 is generally considered insecure hence moving to SHA256. I don't anticipate large performance implecations between the two.

  • DH Group - I am torn between this one. I've read about performance implications of higher order DH groups. Strongswan's recomendations are modp3072. I have heard that modp1024 is suseptipble to weak DH but modp3072 results in worse performance by far.

  • Phase 1 vs Phase 2 - In all of my IPSec confiurations I've always matched phase 1 and phase 2 parameters. I also have also disabled PFS. Is it suggested that Phase1 and Phase 2 match? Also what are the implecations of performacne with regards to PRF.

  • Rekeying times and DPD - I have not formed an opinion on these.

As a a bonus, Strongswan also seems to recommend the following:

  • aes128gcm16-prfsha256-ecp256 (AES-GCM-128 AEAD, SHA-256 as PRF and ECDH key exchange with 256 bit key length)
  • aes256gcm16-prfsha384-ecp384 (AES-GCM-256 AEAD, SHA-384 as PRF and ECDH key exchange with 384 bit key length)

Any opinions on the above cipher suites vs what I've chosen?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.