I understand the term "best" is subjective but I would like to try to keep this discussion as objective as possible and get the opinion of other security professionals for my chosen cipher suite parameters. I would like to disucss the tradeoffs of security and performance on modern hardware as of 2016. The configuration is for site-to-sites typically involving ASA->ASA and ASA->Linux (Strongswan). The goal of my security is protection against a corporate advesery or group of hackers. I assume the attacker is not a well funded nation state and am leaning toward performance over an increase in theoretical security.
I base my research on Strongswan's Security Recomendations
I have come up with the following transform sets
AES-256-XXX - I am torn between GCM and CBC mode as I believe GCM is theoretically more secure. AES is chosen due to the fact that AES extensions are implemented in modern hardware. Is there a large difference in performance between AES 128 v AES 256 in moden hardware? Is there large difference in performance between GCM and CBC mode? I assume cipher suties like blowfish, twofish, and 3des are far slower due to non-hardware implemtations. AES is also the "gold standard" of symetric cipher.
SHA 256 - SHA1 is generally considered insecure hence moving to SHA256. I don't anticipate large performance implecations between the two.
DH Group - I am torn between this one. I've read about performance implications of higher order DH groups. Strongswan's recomendations are modp3072. I have heard that modp1024 is suseptipble to weak DH but modp3072 results in worse performance by far.
Phase 1 vs Phase 2 - In all of my IPSec confiurations I've always matched phase 1 and phase 2 parameters. I also have also disabled PFS. Is it suggested that Phase1 and Phase 2 match? Also what are the implecations of performacne with regards to PRF.
Rekeying times and DPD - I have not formed an opinion on these.
As a a bonus, Strongswan also seems to recommend the following:
- aes128gcm16-prfsha256-ecp256 (AES-GCM-128 AEAD, SHA-256 as PRF and ECDH key exchange with 256 bit key length)
- aes256gcm16-prfsha384-ecp384 (AES-GCM-256 AEAD, SHA-384 as PRF and ECDH key exchange with 384 bit key length)
Any opinions on the above cipher suites vs what I've chosen?