Community discussions

 
nicklowe
just joined
Topic Author
Posts: 13
Joined: Thu Dec 26, 2013 5:06 pm

SSTP: AES-GCM support, granular control of cipher suites.

Thu Dec 26, 2013 5:14 pm

I presently use SSTP for site to site VPNs between router boards.

It would be fantastic if MikroTik would consider offering the following in the future:

1) Support for TLS 1.2.
2) Granular control of the cipher suites offered on the server.
3) Support for AES-GCM. This is today the recommended secure cipher suite over RC4 for performance reasons. It offers strong performance benefits over AES-CBC.

Seasons regards to all! :)

Thanks,

Nick
 
iustinn
just joined
Posts: 6
Joined: Tue Dec 09, 2014 3:18 pm

Re: SSTP: AES-GCM support, granular control of cipher suites.

Tue Nov 24, 2015 4:26 pm

I presently use SSTP for site to site VPNs between router boards.

It would be fantastic if MikroTik would consider offering the following in the future:

1) Support for TLS 1.2.
2) Granular control of the cipher suites offered on the server.
3) Support for AES-GCM. This is today the recommended secure cipher suite over RC4 for performance reasons. It offers strong performance benefits over AES-CBC.

Seasons regards to all! :)

Thanks,

Nick
2years later, same situation. Mikrotik please update!!!
Screen Shot 2015-11-24 at 16.21.53.jpg
You do not have the required permissions to view the files attached to this post.
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 5798
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: SSTP: AES-GCM support, granular control of cipher suites.

Tue Nov 24, 2015 4:47 pm

TLS 1.2 is already supported and PFS already can be enabled.
Currently only GCM is not possible but might be added in the future.
 
iustinn
just joined
Posts: 6
Joined: Tue Dec 09, 2014 3:18 pm

Re: SSTP: AES-GCM support, granular control of cipher suites.

Wed Nov 25, 2015 7:29 pm

TLS 1.2 is already supported and PFS already can be enabled.
Currently only GCM is not possible but might be added in the future.
Indeed, TLS 1.2 is enabled, but have not find the option for PFS on the webservice for administering the router.
Also, if you look at HMAC, it is SHA1, and again, no option for SHA2

GCM is less of a problem, at least for me.
Best regards.
 
Zorro
Long time Member
Long time Member
Posts: 676
Joined: Wed Apr 16, 2014 2:43 pm

Re: SSTP: AES-GCM support, granular control of cipher suites.

Sun Dec 27, 2015 1:39 pm

its only matter of time cuz CWC, OCB was future of ciphers, and even updated/re-worked EAX shows Notably improved scalability.
so far GCM is good for "transition" period and step-up from CCM.
"in general" legacy things, like XTS, CBC and some time after - CCM, perhaps - been phased-out/deprecated eventually.

https://en.wikipedia.org/wiki/Block_cip ... _operation
so far both CWC and (to some degree)EAX variations - shows best scalability, performance/overhead, security among them, in my opinion.
but suporting some of them - painful. cuz some stuff is hard to backport and some wasn't really trivial to older kernels At ALL :(
 
iustinn
just joined
Posts: 6
Joined: Tue Dec 09, 2014 3:18 pm

Re: SSTP: AES-GCM support, granular control of cipher suites.

Mon Feb 01, 2016 11:30 pm

Any update on the PFS/sha1 issue ? ...
 
majestic
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Mon Dec 05, 2016 11:19 am

Re: SSTP: AES-GCM support, granular control of cipher suites.

Sun Jun 04, 2017 1:29 am

+1 This would be really helpful if ROS had AES-GCM support as theres a huge performance boot for all. That means lower hardware can achieve higher throughput which likely would be more cost effective.
 
kolyk
just joined
Posts: 5
Joined: Thu Jan 09, 2014 9:09 am

Re: SSTP: AES-GCM support, granular control of cipher suites.

Thu Jan 10, 2019 9:44 am

Are there any plans for upgrading cipher suites?

I was using Windows 10 + Mikrotik SSTP VPN for years and now it is not possible to connect because they don't have any cipher suite in common after some upgrade.
 
User avatar
Anastasia
newbie
Posts: 30
Joined: Wed Oct 28, 2015 7:12 pm

Re: SSTP: AES-GCM support, granular control of cipher suites.

Sat Jan 26, 2019 6:23 pm

add the ability to select the encryption mode to the settings: aes-128 cbc, aes-256 cbc, blowfish, twofish, aes-128 ctr, aes-256 ctr, aes-128 gcm, aes-256 gcm and MPPE 128

Who is online

Users browsing this forum: No registered users and 3 guests