New default cipher suite (#991)

* New ciphers enabled

* Update CHANGELOG.md

* Switch ecparam to secp384r1

* Change CertificateType to ECDSA384

CHANGELOG.md

@@ -1,3 +1,7 @@
+## 04 Jun 2018
+### Changed
+- Switched to [new cipher suite](https://github.com/trailofbits/algo/issues/981)
+
 ## 24 May 2018
 ### Changed
 - Switched to Ubuntu 18.04

docs/client-linux.md

@@ -73,6 +73,6 @@ In this example we'll assume the IP of our Algo VPN server is `1.2.3.4` and the
     * For the later 2 options, hover to option in the settings to see a description
   * Cipher proposal:
     * Check *Enable custom proposals*
-    * IKE: `aes128gcm16-prfsha512-ecp256,aes128-sha2_512-prfsha512-ecp256,aes128-sha2_384-prfsha384-ecp256`
+    * IKE: `aes256gcm16-prfsha512-ecp384,aes256-sha2_512-prfsha512-ecp384,aes256-sha2_384-prfsha384-ecp384`
-    * ESP: `aes128gcm16-ecp256,aes128-sha2_512-prfsha512-ecp256`
+    * ESP: `aes256gcm16-ecp384,aes256-sha2_512-prfsha512-ecp384`
 * Apply and turn the connection on, you should now be connected

docs/client-windows.md

@@ -48,12 +48,12 @@ Add-VpnConnection @addVpnParams
 
 $setVpnParams = @{
     ConnectionName = $VpnName
-    AuthenticationTransformConstants = "GCMAES128"
+    AuthenticationTransformConstants = "GCMAES256"
-    CipherTransformConstants = "GCMAES128"
+    CipherTransformConstants = "GCMAES256"
-    EncryptionMethod = "AES128"
+    EncryptionMethod = "AES256"
     IntegrityCheckMethod = "SHA384"
-    DHGroup = "ECP256"
+    DHGroup = "ECP384"
-    PfsGroup = "ECP256"
+    PfsGroup = "ECP384"
     Force = $true
 }
 Set-VpnConnectionIPsecConfiguration @setVpnParams

roles/vpn/defaults/main.yml

@@ -25,8 +25,8 @@ strongswan_enabled_plugins:
 
 ciphers:
   defaults:
-    ike: aes128gcm16-prfsha512-ecp256!
+    ike: aes256gcm16-prfsha512-ecp384!
-    esp: aes128gcm16-ecp256!
+    esp: aes256gcm16-ecp384!
   compat:
-    ike: aes128gcm16-prfsha512-ecp256,aes128-sha2_512-prfsha512-ecp256,aes128-sha2_384-prfsha384-ecp256!
+    ike: aes256gcm16-prfsha512-ecp384,aes256-sha2_512-prfsha512-ecp384,aes256-sha2_384-prfsha384-ecp384!
-    esp: aes128gcm16-ecp256,aes128-sha2_512-prfsha512-ecp256!
+    esp: aes256gcm16-ecp384,aes256-sha2_512-prfsha512-ecp384!

roles/vpn/tasks/openssl.yml

@@ -42,9 +42,9 @@
 
   - name: Build the CA pair
     shell: >
-      {{ openssl_bin }} ecparam -name prime256v1 -out ecparams/prime256v1.pem &&
+      {{ openssl_bin }} ecparam -name secp384r1 -out ecparams/secp384r1.pem &&
       {{ openssl_bin }} req -utf8 -new
-      -newkey ec:ecparams/prime256v1.pem
+      -newkey ec:ecparams/secp384r1.pem
       -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}"))
       -keyout private/cakey.pem
       -out cacert.pem -x509 -days 3650
@@ -71,7 +71,7 @@
   - name: Build the server pair
     shell: >
       {{ openssl_bin }} req -utf8 -new
-      -newkey ec:ecparams/prime256v1.pem
+      -newkey ec:ecparams/secp384r1.pem
       -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}"))
       -keyout private/{{ IP_subject_alt_name }}.key
       -out reqs/{{ IP_subject_alt_name }}.req -nodes
@@ -93,7 +93,7 @@
   - name: Build the client's pair
     shell: >
       {{ openssl_bin }} req -utf8 -new
-      -newkey ec:ecparams/prime256v1.pem
+      -newkey ec:ecparams/secp384r1.pem
       -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:{{ item }}"))
       -keyout private/{{ item }}.key
       -out reqs/{{ item }}.req -nodes

roles/vpn/templates/client_windows.ps1.j2

@@ -169,12 +169,12 @@ function Add-AlgoVPN {
 
     $setVpnParams = @{
         ConnectionName = $VpnName
-        AuthenticationTransformConstants = "GCMAES128"
+        AuthenticationTransformConstants = "GCMAES256"
-        CipherTransformConstants = "GCMAES128"
+        CipherTransformConstants = "GCMAES256"
-        EncryptionMethod = "AES128"
+        EncryptionMethod = "AES256"
         IntegrityCheckMethod = "SHA384"
-        DHGroup = "ECP256"
+        DHGroup = "ECP384"
-        PfsGroup = "ECP256"
+        PfsGroup = "ECP384"
         Force = $true
     }
     Set-VpnConnectionIPsecConfiguration @setVpnParams

roles/vpn/templates/mobileconfig.j2

@@ -60,9 +60,9 @@
                 <key>ChildSecurityAssociationParameters</key>
                 <dict>
                     <key>DiffieHellmanGroup</key>
-                    <integer>19</integer>
+                    <integer>20</integer>
                     <key>EncryptionAlgorithm</key>
-                    <string>AES-128-GCM</string>
+                    <string>AES-256-GCM</string>
                     <key>IntegrityAlgorithm</key>
                     <string>SHA2-512</string>
                     <key>LifeTimeInMinutes</key>
@@ -81,9 +81,9 @@
                 <key>IKESecurityAssociationParameters</key>
                 <dict>
                     <key>DiffieHellmanGroup</key>
-                    <integer>19</integer>
+                    <integer>20</integer>
                     <key>EncryptionAlgorithm</key>
-                    <string>AES-128-GCM</string>
+                    <string>AES-256-GCM</string>
                     <key>IntegrityAlgorithm</key>
                     <string>SHA2-512</string>
                     <key>LifeTimeInMinutes</key>
@@ -94,7 +94,7 @@
                 <key>PayloadCertificateUUID</key>
                 <string>{{ pkcs12_PayloadCertificateUUID }}</string>
                 <key>CertificateType</key>
-                <string>ECDSA256</string>
+                <string>ECDSA384</string>
                 <key>ServerCertificateIssuerCommonName</key>
                 <string>{{ IP_subject_alt_name }}</string>
                 <key>RemoteAddress</key>