<html><head></head><body>A good info on the topic as an additional source.<br>
<a href="https://blog.cryptographyengineering.com/2016/08/attack-of-week-64-bit-ciphers-in-tls.html">https://blog.cryptographyengineering.com/2016/08/attack-of-week-64-bit-ciphers-in-tls.html</a><br><br><div class="gmail_quote">On August 24, 2016 9:48:46 PM GMT+02:00, "René Pfeiffer" <lynx@luchs.at> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On Aug 24, 2016 at 2119 +0200, Akendo appeared and said:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> The openvpn configuration includes a keepalive parameter with following<br /> values: 10 120<br /> <br /> you think this is sufficient? Whereby I'm uncertain about the function<br /> in OpenVPN in regards to your statement.<br /></blockquote><br />OpenVPN uses the keepalive parameter to determin if the remote end is still<br />reachable. It is usually used to tune OpenVPN tunnels to lossy or high<br />latency network links. This means that it is different from Apache's<br />implementation.<br /><br />In order to protect your OpenVPN setup I suggest using the ciphers<br />discussed in the Bettyrcrypto guide (AES is a good choice). Furthermore I<br />recommend<br /><br />- using the shared key created by "openvpn --genkey --secret" to lock out<br /> scans,<br />- using X.509 keys and
certificates with a private CA (the only option<br /> which can take advantage of perfect forward secrecy).<br /><br />Cheers,<br />René.<br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>