Does an option exist for AES-GCM 256bit encryption for client connections with OpenVPN? I've tried to google around this question, but found no algorithm how to patch my openvpn/openssl.

So my question is GCM mode support possible for OpenSSL 1.0.1e, OpenVPN 2.2.1, Debian GNU/Linux 7 (wheezy)? If yes, what should I do exactly to get it?


There's two parts to this answer, since an OpenVPN connection consists of two parts. Part 1 is the control channel, this is a TLS connection over which OpenVPN sends control messages and keys for the second part; the data channel. The data channel is where the actual network packets are transferred over.

For the TLS control channel, support for GCM is available from OpenVPN 2.3.4+. By default, OpenVPN 2.3 will negotiate TLS 1.0, which has no support for GCM, but setting tls-version-min 1.0 in your config file (or supplying --tls-version-min 1.0 on the command line) will enable TLS version negotiation. That will give you TLS 1.2, which supports GCM mode.

For the data channel no support for GCM is available yet. Implementation is ongoing, and GCM will be available in OpenVPN 2.4+.

Edit: And if you want to use a newer OpenVPN under Wheezy, take a look at the repos from openvpn.net: https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.