|
| 1 | +--- |
| 2 | +meta: |
| 3 | + title: Site-to-Site VPN security proposals |
| 4 | + description: Find out what the different encryption and authentication ciphers available with Scaleway Site-to-Site VPN, and how to to choose the best algorithm for your use case. |
| 5 | + noindex: true |
| 6 | +content: |
| 7 | + h1: Site-to-Site VPN security proposals |
| 8 | + paragraph: Find out what the different encryption and authentication ciphers available with Scaleway Site-to-Site VPN, and how to to choose the best algorithm for your use case. |
| 9 | + noindex: true |
| 10 | +tags: vpn connection encryption authentication security cipher security-proposal |
| 11 | +categories: |
| 12 | + - site-to-site-vpn |
| 13 | + - network |
| 14 | +dates: |
| 15 | + validation: 2025-06-03 |
| 16 | + posted: 2025-06-03 |
| 17 | +--- |
| 18 | + |
| 19 | +<Message type="note"> |
| 20 | +Site-to-Site VPN is currently in Private Beta, and available to selected testers only via the Scaleway API. [Request an invitation](https://www.scaleway.com/en/betas/#site-to-site-vpn). |
| 21 | +</Message> |
| 22 | + |
| 23 | +When creating a VPN [connection](/site-to-site-vpn/reference-content/understanding-s2svpn/#connection), you must define a **security proposal** (aka IPSec proposal). The security proposal defines the encryption and authentication methods used to secure the IPSec VPN tunnel. |
| 24 | + |
| 25 | +A security proposal is made up of several parts, each with definable algorithms or settings. You should define these bearing in mind the use case of your Site-to-Site VPN, balancing **security**, **performance** and **compatibility**. |
| 26 | + |
| 27 | +It is important to find the optimal trade-off between these elements: the strongest possible security may be overkill for your use-case, and slow down performance to unacceptable levels. Some algorithms are outdated and not optimal for modern VPNs, but may be the only compatible option for legacy VPNs. |
| 28 | + |
| 29 | +In this document, we explain the different elements of a security protocol, and describe the different algorithms and security options available with Scaleway Site-to-Site VPN, giving advice to help you choose the best options for your use-case. |
| 30 | + |
| 31 | +## Defining a security proposal |
| 32 | + |
| 33 | +There are two parts to a security proposal: |
| 34 | + |
| 35 | +- **IKEv2** (Internet Key Exchange): Establishes a secure connection between the VPN gateway and the customer gateway |
| 36 | +- **ESP** (Encapsulating Security Payload): Encrypts and authenticates the payload of the IP data packets traveling through the tunnel. |
| 37 | + |
| 38 | +When defining your Site-to-Site VPN security proposal, you must define the algorithms/ options to be used for IKEv2 and ESP as described below: |
| 39 | + |
| 40 | +| Protocol | Element | Description | User must define? | |
| 41 | +|-----------------|-----------------|----------------------------------------------------|----------------------------| |
| 42 | +| **IKEv2** | **Encryption** | Algorithm to encrypt IKE negotiation messages | ✅ Yes | |
| 43 | +| **IKEv2** | **Integrity** | HMAC-based algorithm to verify IKE negotiation messages have not been tampered with. <br/><br/>Only set an HMAC integrity algorithm if **not** using an AEAD algorithm for IKEv2 encryption (see below). Otherwise, integrity is built in, and you do not need to set an IKEv2 integrity algorithm. | ❓ Depends | |
| 44 | +| **IKEv2** | **Key Exchange Method** | DH group to define strength of key exchange | ✅ Yes | |
| 45 | + |
| 46 | +| Protocol | Element | Description | User must define? | |
| 47 | +|-----------------|-----------------|----------------------------------------------------|----------------------------| |
| 48 | +| **ESP** | **Encryption** | Algorithm to encrypt traffic's data payloads | ✅ Yes | |
| 49 | +| **ESP** | **Integrity** | HMAC-based algorithm to verify data payloads have not been tampered with. <br/><br/> Only set an HMAC integrity algorithm if **not** using an AEAD algorithm for ESP encryption (see below). Otherwise, integrity is built in, and you do not need to set an ESP integrity algorithm. | ❓ Depends | |
| 50 | +| **ESP** | **Key Exchange Method** | DH group to define strength of key exchange | ❌ No | |
| 51 | + |
| 52 | +## Encryption algorithms |
| 53 | + |
| 54 | +The following encryption algorithms are available. |
| 55 | + |
| 56 | +| Algorithm | AEAD / non-AEAD* | Key Size (bits)| Security Level | Notes | Recommended? | |
| 57 | +|-------------------------|------------------|----------------|----------------|-----------------------------------------------|---------------------| |
| 58 | +| `aes256gcm16` (AES-GCM) | AEAD | 256 | ✅ Very Strong | Generally the best choice for IPSec ESP & IKE | ✅ Recommended | |
| 59 | +| `aes192gcm16` (AES-GCM) | AEAD | 192 | ✅ Strong | Suitable for high-performance VPNs | 👍 Acceptable | |
| 60 | +| `aes128gcm16` (AES-GCM) | AEAD | 128 | ✅ Strong | Suitable for high-performance VPNs | 👍 Acceptable | |
| 61 | +| `aes256ccm16` (AES-CCM) | AEAD | 256 | ✅ Strong | Alternative to AES-GCM, but GCM is preferred | 👍 Acceptable | |
| 62 | +| `aes128ccm16` (AES-CCM) | AEAD | 128 | ⚠️ Medium | Alternative to AES-GCM, but GCM is preferred | 👍 Acceptable | |
| 63 | +| `chacha20poly1305` | AEAD | 256 | ✅ Strong | Performance-sensitive (mobile, embedded), best choice for low-power devices | ✅ Recommended | |
| 64 | +| `aes256` (AES-CBC) | non-AEAD | 256 | ✅ Strong | Suitable for legacy VPNs. Use only with HMAC (e.g. `sha256`)| ⚠️ Use with caution | |
| 65 | +| `aes192` (AES-CBC) | non-AEAD | 192 | ⚠️ Medium | Rarely used, `aes256` is preferred. | ⚠️ Use with caution | |
| 66 | +| `aes128` (AES-CBC) | non-AEAD | 128 | ⚠️ Medium | Suitable for performance-sensitive VPNs, where constraints don't allow `aes256` | ⚠️ Use with caution | |
| 67 | + |
| 68 | +\* **A**uthenticated **E**ncryption with **A**ssociated **D**ata (**AEAD**) algorithms provide both encryption and authentication in a single step. They are more secure and efficient than non-AEAD algorithms, but are not supported by all legacy devices. We recommend that you always prefer AEAD algorithms (`aes256gcm16` or `chacha20poly1305`) for performance and security. Choosing an AEAD algorithm for IKEv2/ESP encryption means you do **not** need to define an algorithm for IKEv2/ESP integrity. |
| 69 | + |
| 70 | +## Integrity algorithms |
| 71 | + |
| 72 | +Integrity is based on **H**ash-based **M**essage **A**uthentication **C**ode (HMAC). The following algorithms are available: |
| 73 | + |
| 74 | +| Algorithm | Output Size (bits)| Security Level | Notes | Recommended? | |
| 75 | +|-------------------------|--------------------|-----------------|---------------------------------------------------------|---------------------| |
| 76 | +| `sha512` | 512 | ✅ Very Strong | Suitable for high security environments. Use for long term security. | ✅ Recommended | |
| 77 | +| `sha384` | 384 | ✅ Strong | Balanced security/performance. Good alternative to `sha-512`. | ✅ Recommended | |
| 78 | +| `sha256` | 256 | ✅ Strong | Default for most VPNs. Recommended baseline. | ✅ Recommended | |
| 79 | + |
| 80 | +## Key exchange methods |
| 81 | + |
| 82 | +Key exchange is **D**iffie-**H**ellman-based. The following DH groups can be set to determine the strength and performance of the key exchange: |
| 83 | + |
| 84 | +| DH Group | Bit Size | Security Level | Use Case | Recommended? | |
| 85 | +|------------------------|-----------|-----------------|------------------------------------------------------------------|------------------| |
| 86 | +| `ecp521` | 521 | ✅ Very Strong | Suitable for high security environments. May be overkill (lowers performance). |👍 Acceptable | |
| 87 | +| `ecp384` | 384 | ✅ Strong | Both strong and fast. **Our top choice for modern VPNs.** |✅ Recommended | |
| 88 | +| `ecp256` | 256 | ✅ Strong | Suitable for performance-sensitive VPNs. |✅ Recommended | |
| 89 | +| `curve25519` (X25519) | 256 | ✅ Very Strong | Both strong and fast. **Our top choice for performance**. |✅ Recommended | |
| 90 | +| `modp4096` | 4096 | ✅ Strong | Strong but slow. May be suitable for legacy VPNs. |👍 Acceptable | |
| 91 | +| `modp3072` | 3072 | ✅ Medium-Strong | May be suitable for legacy VPNs. |👍 Acceptable | |
| 92 | +| `modp2048` | 2048 | ⚠️ Minimum | Use for older VPNs only if absolutely needed. |⚠️ Use with caution | |
| 93 | + |
| 94 | +## Standard recommendation |
| 95 | + |
| 96 | +For standard usage on modern equipment we recommend the following security proposal: |
| 97 | + |
| 98 | +| IKEv2 Encryption | IKEv2 Integrity | IKEv2 Key Exchange | ESP Encryption | ESP Integrity | ESP Key Exchange | |
| 99 | +|------------------|-----------------|--------------------|----------------|---------------|------------------| |
| 100 | +| `aes256gcm16` | not required | `curve25519` | `aes256gcm16` | not required | not required | |
0 commit comments