From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fvMHb2nBBz2yDM for ; Mon, 13 Apr 2026 09:17:15 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fvMHW6Fzrz2xLl for ; Mon, 13 Apr 2026 09:17:11 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4fvMHV0YvMz2lC; Mon, 13 Apr 2026 09:17:10 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1776071830; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JbA1Jt8spvjQ/BkjJJFcF0cHmtbfXVHOyLvOfz6gqMU=; b=DzWMsBx6WFENjElggOFqA/qruhZiNmuy4cUs22vl1idfkpa1UOPoDKpJukFMxeHMQvCQ+g qQTw0f/Gd85cREDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1776071830; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JbA1Jt8spvjQ/BkjJJFcF0cHmtbfXVHOyLvOfz6gqMU=; b=ZEhwmmDztiyiwN20FYBejo6EI9okpCDo1yn18rwPoGNMfasnpBSfT6+HOzEvSUKGkfZ3tF /BfwG42E/bmVhjfflUGmNzA0oSZmQuUIvchUobwsCD7jm+q6MRppOpm1eyODIE6ba4OIsP 0MWCK/65uCDGWJGY5spVJODENfZX8d5OCWuTbc4PQcRRE7ccgJJYokUaU44ouXRdmtrA1t ctOWsrs8OE3dZPufAZZqJGxKNov5Lg1r/xYl2TFj5jV24hs7LnMy8qKCG0rT6ptt8t3foh fGoNOe8sorvuHICzUJuML3YrZtUKh2U0stHjUlmHNlH+k8UNXxmMNW7XGT8nJw== Content-Type: text/plain; charset=utf-8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: OpenVPN-2.7.1 From: Michael Tremer In-Reply-To: <9bf52d4d-a127-40c9-b850-6d2e38100072@ipfire.org> Date: Mon, 13 Apr 2026 10:17:09 +0100 Cc: "IPFire: Development-List" , ummeegge Content-Transfer-Encoding: quoted-printable Message-Id: <134019CD-5C20-4999-A640-DCAD50564FBA@ipfire.org> References: <4247a605-6aac-4c9c-93c8-db236c2cb769@ipfire.org> <414d5c1c72ceabb0f3051ba917bb45ff7de3f90f.camel@ipfire.org> <7b53160b-eb3a-4b1b-b068-94057bd680e1@ipfire.org> <1eccafd1bfb3b86c75dd7b3082fd204c3a70e38a.camel@ipfire.org> <8a117269-3a2f-4226-b6cc-39e5f7a9b529@ipfire.org> <281A0C82-AF08-471A-AAD5-FC2A4FDA2985@ipfire.org> <3556afcad312edbc2fec0f51202ba7ec832af1ce.camel@ipfire.org> <09DCA30B-E8F0-4082-BC21-46A452BE26E0@ipfire.org> <7A7871F9-75CC-4605-8337-BB7BFC61072F@ipfire.org> <9bf52d4d-a127-40c9-b850-6d2e38100072@ipfire.org> To: Adolf Belka Hello Adolf, Thanks for raising this. I suppose we should be fine. I would just leave what we have in our = configuration right now and eventually remove it. By then, it should = already not be used by any client at all. At the moment, I cannot think = of a client implementation that would so old that it would rely on plain = old DH to work. But it wouldn=E2=80=99t do us any harm to leave it in = there since we already have it. I just merged the branch. Thanks for working on this. I am not feeling = very scared about this update, but it is yet another large one very = briefly after the previous 2.6 release in IPFire. Fingers crossed that = we caught everything right the first time and that we will now be able = to earn the fruits of our hard work. Best, -Michael > On 11 Apr 2026, at 13:02, Adolf Belka wrote: >=20 > Hi Michael & Erik, >=20 > I have submitted a patch set for the update to openvpn-2.7.1 >=20 > One thing I noticed when scanning through the changelog notes is the = following two entries. >=20 > ** Use of --dh dh2048.pem in all sample configs has been replaced with = --dh none. The dh2048.pem file has been removed. >=20 > ** --dh none is now the default if --dh is not specified. Modern TLS = implementations will prefer ECDH and other more modern algorithms = anyway. And finite field Diffie Hellman is in the proces of being = deprecated (see draft-ietf-tls-deprecate-obsolete-kex) >=20 > We are not using dh2048, we are using ffdhe4096 which looks to me like = it might be a finite field Diffie Hellman. If that is the case then at = some time in the future it looks like it will be deprecated. Looking = through that draft ietf document I was unable to determine if this = deprecation will only apply to 2048 that is mentioned in the = openvpn-2.7.0 changelog or if it will also apply to our use of 4096 bit. >=20 > I thought I would flag it so that others more knowledgeable than me = could decide. >=20 > I thought it would be good to know early if this was going to affect = us so that it can be decided how to manage that before it becomes a = requirement (if that is in fact the case). >=20 > Regards, >=20 > Adolf. >=20 >=20