OpenVPN offers the use of various digest algorithms (see list below).
I've read that the the digests, printed with a leading RSA-
, DSA-
or ecdsa-with-
are simply due to a print function in OpenSSL and do not affect the algorithm mentioned afterwards (e.g. RSA-SHA, DSA-SHA and SHA, are all the same and can be equally used).
What I do not understand are the differences between the SHA1 digests SHA
, SHA1
, DSA-SHA1-old
and RSA-SHA1-2
. All share the same 160 bit digest size.
Complete list of --show-digests
:
MD5 128 bit digest size
RSA-MD5 128 bit digest size
SHA 160 bit digest size
RSA-SHA 160 bit digest size
SHA1 160 bit digest size
RSA-SHA1 160 bit digest size
DSA-SHA 160 bit digest size
DSA-SHA1-old 160 bit digest size
DSA-SHA1 160 bit digest size
RSA-SHA1-2 160 bit digest size
DSA 160 bit digest size
RIPEMD160 160 bit digest size
RSA-RIPEMD160 160 bit digest size
MD4 128 bit digest size
RSA-MD4 128 bit digest size
ecdsa-with-SHA1 160 bit digest size
RSA-SHA256 256 bit digest size
RSA-SHA384 384 bit digest size
RSA-SHA512 512 bit digest size
RSA-SHA224 224 bit digest size
SHA256 256 bit digest size
SHA384 384 bit digest size
SHA512 512 bit digest size
SHA224 224 bit digest size
whirlpool 512 bit digest size
With OpenVPN 2.4.0 and OpenSSL 1.0.2k
Is this again an odd way of OpenSSL printing digests and they all simply represent SHA1?
edit: Interestingly, there's no plain SHA
nor a DSA-SHA1-old
, when you openssl list -digest-algorithms
.
RSA-
algorithms just map to the corresponding algorithm withoutRSA-
(seeopenssl list -digest-algorithms
), but there's no mention ofDSA
at all.