From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4ftC3j3584z2yDM for ; Sat, 11 Apr 2026 12:02:57 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4ftC3f0THDz2xP7 for ; Sat, 11 Apr 2026 12:02:54 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4ftC3d1ML9z20D; Sat, 11 Apr 2026 12:02:53 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1775908973; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4tnHNhamhAcwhiLXToWVkkKSPTY7eG9ofdFirlkspKo=; b=bVMj1A9I7ewKTlwUlQ7UBwclATygwnsZeeVj4PUqcq9sBT2oi8jf+QsCG+BmQRsB22hpMi ZUQUi5HGQQTi8RAw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1775908973; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4tnHNhamhAcwhiLXToWVkkKSPTY7eG9ofdFirlkspKo=; b=Gpv9bxEaX1a+4D4HW5EXWAnkZcTR+OmS8k7HA9a4Q8iC6tSqVbfKZdtyTTwkDVuM9yWs6Z vqWDOilSM4BWz6A57zmytUB8EBhZFUEmYZh06WHQxX6FXxfJvHE8q9UxCNDz8tFh2Mftql iJ3iCDcY2vikvutirAq5sz/xZ+dvooXefz9AT0lavT4zIcFc4qV1TjCY8bpZY9mdaZDA6M t8XdL9bSIVgOtlv0jVTlF08xxMYcU3eAr4K5w4YZYxNVFyJFyJEA/T6paaqXoE7EYlYmlo LFp9WDLxcYi3XE85E3UM/R3jRyfn4bgXFgZ9iigYyXejK8atukeevAvFGHQyzQ== Message-ID: <9bf52d4d-a127-40c9-b850-6d2e38100072@ipfire.org> Date: Sat, 11 Apr 2026 14:02:43 +0200 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Subject: OpenVPN-2.7.1 To: Michael Tremer References: <4247a605-6aac-4c9c-93c8-db236c2cb769@ipfire.org> <414d5c1c72ceabb0f3051ba917bb45ff7de3f90f.camel@ipfire.org> <7b53160b-eb3a-4b1b-b068-94057bd680e1@ipfire.org> <1eccafd1bfb3b86c75dd7b3082fd204c3a70e38a.camel@ipfire.org> <8a117269-3a2f-4226-b6cc-39e5f7a9b529@ipfire.org> <281A0C82-AF08-471A-AAD5-FC2A4FDA2985@ipfire.org> <3556afcad312edbc2fec0f51202ba7ec832af1ce.camel@ipfire.org> <09DCA30B-E8F0-4082-BC21-46A452BE26E0@ipfire.org> <7A7871F9-75CC-4605-8337-BB7BFC61072F@ipfire.org> Content-Language: en-GB Cc: "IPFire: Development-List" , ummeegge From: Adolf Belka In-Reply-To: <7A7871F9-75CC-4605-8337-BB7BFC61072F@ipfire.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Michael & Erik, I have submitted a patch set for the update to openvpn-2.7.1 One thing I noticed when scanning through the changelog notes is the following two entries. ** Use of --dh dh2048.pem in all sample configs has been replaced with --dh none. The dh2048.pem file has been removed. ** --dh none is now the default if --dh is not specified. Modern TLS implementations will prefer ECDH and other more modern algorithms anyway. And finite field Diffie Hellman is in the proces of being deprecated (see draft-ietf-tls-deprecate-obsolete-kex) We are not using dh2048, we are using ffdhe4096 which looks to me like it might be a finite field Diffie Hellman. If that is the case then at some time in the future it looks like it will be deprecated. Looking through that draft ietf document I was unable to determine if this deprecation will only apply to 2048 that is mentioned in the openvpn-2.7.0 changelog or if it will also apply to our use of 4096 bit. I thought I would flag it so that others more knowledgeable than me could decide. I thought it would be good to know early if this was going to affect us so that it can be decided how to manage that before it becomes a requirement (if that is in fact the case). Regards, Adolf.