3

I am in the process of setting up some site-to-site VPN connections between our sites.

Our new VPN servers at each site have numerous encryption/authentication methods and I want to know which are the best from a security perspective. Our existing VPN servers used DES/SHA1.

These are the methods that it supports:

Encryption

  • DES
  • 3DES
  • AES128
  • AES192
  • AES256
  • NULL

Authentication

  • MD5
  • SHA1
  • SHA256
  • SHA512

Please can someone suggest the best encryption/authentication methods to use from a security perspective? I was thinking AES256 and SHA512.

1
  • I'm not sure what you mean by SHA512 authentication. Perhaps it is an essential part of some other authentication scheme, but by itself it is only a hashing algorithm. Since you didn't identify your "VPN Server", some detail might be linked there.
    – Sas3
    Aug 20, 2017 at 17:51

2 Answers 2

2

SHA512 and AES256 would be the strongest combination of the options you provided.

SHA256 and AES128 should be sufficient, at the time of writing. If that is dedicated hardware, the computational cost benefit is probably minuscule.

If you're asking this here, you will probably make other configuration mistakes later on; it seems you didn't quite grasp the concept, especially since a hash function is not authentication and a block cipher is not encryption - from a security point of view, the block cipher and hash function mentioned above are most suited from that selection to construct those functionalities, though.

2
  • "Authentication" and "encryption" are the headings that the options come under on a ZyXEL device. Thanks for your answer.
    – Jack
    Aug 20, 2017 at 17:12
  • Welcome to sec.SE! You already found the accept-button, which means "this solved my problem". There is an upvote-button as well which serves as a "this answer is good" or "thank you". Please refrain from expressing your thankfulness in comments, even if it is appreciated, it does not provide help for others.
    – Tobi Nary
    Aug 20, 2017 at 17:16
0

For authentication, SHA512 is more than enough for above mention requirement. rather you are going SHA512 you can go with SHA256.

If you consider encryption,its time consuming compare to the HASH function. Its better to use some middle stronger encryption mechanism rather going to complex encryption. I also recommend the AES128 for your requirement as encryption algorithm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .