wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-09-02 18:13:13 +02:00
Code Issues Projects Releases Wiki Activity

New ciphers enabled

Browse source
This commit is contained in:
Jack Ivanov 2018-06-04 15:22:11 +03:00
parent 030cb9a830
commit 48f27c9eb1
5 changed files with 20 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
docs/client-linux.md
View file

@ -73,6 +73,6 @@ In this example we'll assume the IP of our Algo VPN server is `1.2.3.4` and the
* For the later 2 options, hover to option in the settings to see a description * For the later 2 options, hover to option in the settings to see a description
* Cipher proposal: * Cipher proposal:
* Check *Enable custom proposals* * Check *Enable custom proposals*
* IKE: `aes128gcm16-prfsha512-ecp256,aes128-sha2_512-prfsha512-ecp256,aes128-sha2_384-prfsha384-ecp256` * IKE: `aes256gcm16-prfsha512-ecp384,aes256-sha2_512-prfsha512-ecp384,aes256-sha2_384-prfsha384-ecp384`
* ESP: `aes128gcm16-ecp256,aes128-sha2_512-prfsha512-ecp256` * ESP: `aes256gcm16-ecp384,aes256-sha2_512-prfsha512-ecp384`
* Apply and turn the connection on, you should now be connected * Apply and turn the connection on, you should now be connected

10
docs/client-windows.md
View file

@ -48,12 +48,12 @@ Add-VpnConnection @addVpnParams
$setVpnParams = @{ $setVpnParams = @{
ConnectionName = $VpnName ConnectionName = $VpnName
AuthenticationTransformConstants = "GCMAES128" AuthenticationTransformConstants = "GCMAES256"
CipherTransformConstants = "GCMAES128" CipherTransformConstants = "GCMAES256"
EncryptionMethod = "AES128" EncryptionMethod = "AES256"
IntegrityCheckMethod = "SHA384" IntegrityCheckMethod = "SHA384"
DHGroup = "ECP256" DHGroup = "ECP384"
PfsGroup = "ECP256" PfsGroup = "ECP384"
Force = $true Force = $true
} }
Set-VpnConnectionIPsecConfiguration @setVpnParams Set-VpnConnectionIPsecConfiguration @setVpnParams

8
roles/vpn/defaults/main.yml
View file

@ -25,8 +25,8 @@ strongswan_enabled_plugins:
ciphers: ciphers:
defaults: defaults:
ike: aes128gcm16-prfsha512-ecp256! ike: aes256gcm16-prfsha512-ecp384!
esp: aes128gcm16-ecp256! esp: aes256gcm16-ecp384!
compat: compat:
ike: aes128gcm16-prfsha512-ecp256,aes128-sha2_512-prfsha512-ecp256,aes128-sha2_384-prfsha384-ecp256! ike: aes256gcm16-prfsha512-ecp384,aes256-sha2_512-prfsha512-ecp384,aes256-sha2_384-prfsha384-ecp384!
esp: aes128gcm16-ecp256,aes128-sha2_512-prfsha512-ecp256! esp: aes256gcm16-ecp384,aes256-sha2_512-prfsha512-ecp384!

10
roles/vpn/templates/client_windows.ps1.j2
View file

@ -169,12 +169,12 @@ function Add-AlgoVPN {
$setVpnParams = @{ $setVpnParams = @{
ConnectionName = $VpnName ConnectionName = $VpnName
AuthenticationTransformConstants = "GCMAES128" AuthenticationTransformConstants = "GCMAES256"
CipherTransformConstants = "GCMAES128" CipherTransformConstants = "GCMAES256"
EncryptionMethod = "AES128" EncryptionMethod = "AES256"
IntegrityCheckMethod = "SHA384" IntegrityCheckMethod = "SHA384"
DHGroup = "ECP256" DHGroup = "ECP384"
PfsGroup = "ECP256" PfsGroup = "ECP384"
Force = $true Force = $true
} }
Set-VpnConnectionIPsecConfiguration @setVpnParams Set-VpnConnectionIPsecConfiguration @setVpnParams

8
roles/vpn/templates/mobileconfig.j2
View file

@ -60,9 +60,9 @@
<key>ChildSecurityAssociationParameters</key> <key>ChildSecurityAssociationParameters</key>
<dict> <dict>
<key>DiffieHellmanGroup</key> <key>DiffieHellmanGroup</key>
<integer>19</integer> <integer>20</integer>
<key>EncryptionAlgorithm</key> <key>EncryptionAlgorithm</key>
<string>AES-128-GCM</string> <string>AES-256-GCM</string>
<key>IntegrityAlgorithm</key> <key>IntegrityAlgorithm</key>
<string>SHA2-512</string> <string>SHA2-512</string>
<key>LifeTimeInMinutes</key> <key>LifeTimeInMinutes</key>
@ -81,9 +81,9 @@
<key>IKESecurityAssociationParameters</key> <key>IKESecurityAssociationParameters</key>
<dict> <dict>
<key>DiffieHellmanGroup</key> <key>DiffieHellmanGroup</key>
<integer>19</integer> <integer>20</integer>
<key>EncryptionAlgorithm</key> <key>EncryptionAlgorithm</key>
<string>AES-128-GCM</string> <string>AES-256-GCM</string>
<key>IntegrityAlgorithm</key> <key>IntegrityAlgorithm</key>
<string>SHA2-512</string> <string>SHA2-512</string>
<key>LifeTimeInMinutes</key> <key>LifeTimeInMinutes</key>