I want to setup an VPN server in pfsense and I can choose a lot of Encryption algorithm types ,alot!! What I have read is that the AES 256 (512 is not an option) is the best. Well even then there are a couple of option this is what I can choose from:

  1. CBC
  2. CFB
  3. CFB1
  4. CFB8
  5. OFB

I did find this answer https://stackoverflow.com/questions/1220751/how-to-choose-an-aes-encryption-mode-cbc-ecb-ctr-ocb-cfb, but it did not include all options and there are some critic comments on the answer. Of course there is an wikipedia page: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation , but that does not give me an clear answer on what is the most secure and gives a lot of extra info I do not understand.

Question 1: Is AES 256 the most secure algorithm?

Question 2: If 1 is true then which one of the above list is the most secure?

Many thanks and any thought about this is appreciated!!

  1. AES-256 is the most secure publicly known algorithm. It is however probable, that there exist more secure algorithms in the military use.

  2. From the above list, OFB will be the most secure and also the least CPU intensive.

Here you have some explanation about these modes:


  • Many thanks, but have things like Encryption parallelizable no inpact on the security (because OFB do not have that option)? – user3892683 Jun 12 '15 at 8:45
  • I didn't mention paralellizable encryption. In fact, either CBC and OFB can be more secure than the other, depending on what you use it for. For VPN and its traffic encryption character, OFB should be better than CBC. Detailed explanation would require mathematical proof, and I don't unfortunately have time for that in work, so I provided you Wikipedia link, where you can read about each mode and try to understand the differences. – Tomasz Klim Jun 12 '15 at 9:14
  • Of course, that is true. I don't even think that I have the knowledge to understand the mathematical explanation, but many thanks anyway. – user3892683 Jun 12 '15 at 9:26
  • AES-256 is not the most secure publicly known algorithm, however it is still practically unbreakable. Newer CPUs have hardware acceleration so it is very fast and very secure. Also, how is OFB the least CPU intensive from the list? For example a benchmark says OFB is slightly slower than CBC. – KovBal Jul 9 '15 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.