Site-to-Site VPN Ciphers and Lifetimes: Picking What You’ll Still Like in 3 Years

How to Choose the Right Encryption and Connection Lifetimes for Long-Term Security and Performance in Site-to-Site VPNs.

Photo by Privecstasy on Unsplash

Introduction: The Importance of Site-to-Site VPN Security

When it comes to securing communication between two or more networks, a Site-to-Site Virtual Private Network (VPN) is a go-to solution. Whether it’s for connecting branch offices, remote teams, or data centers, Site-to-Site VPNs enable encrypted communication over public networks, ensuring the safety of sensitive data.

However, choosing the right encryption and lifetime settings for a VPN tunnel is no small feat. With a rapidly evolving security landscape, the decisions you make today about your VPN’s cryptographic ciphers and session lifetimes will directly impact the future robustness and longevity of your VPN infrastructure.

We’ll dive deep into how to select the right ciphers and lifetimes for your Site-to-Site VPN. This is an essential step for maintaining a secure and resilient VPN tunnel. More importantly, we’ll help you choose settings that you’ll still be satisfied with in three years — without needing to go back and overhaul everything.

Understanding VPN Ciphers and Lifetimes

Before we get into the specifics of picking the right settings, it’s important to have a clear understanding of what “ciphers” and “lifetimes” mean in the context of Site-to-Site VPNs.

VPN Ciphers: The Backbone of Encryption

A cipher is a mathematical algorithm used to encrypt and decrypt data. In a VPN, ciphers secure the data exchanged between two sites, making it unreadable to anyone who might intercept it.

For example, the most common encryption protocols used in Site-to-Site VPNs are AES (Advanced Encryption Standard), 3DES (Triple DES), and ChaCha20, each with its own strengths and weaknesses.

1. AES (Advanced Encryption Standard):

• AES is one of the most widely adopted encryption standards today. It’s known for its robust security and efficiency.
• Key strengths: It’s supported by almost every hardware and software solution, and it’s highly efficient when dealing with large volumes of traffic.
• AES-128, AES-192, and AES-256 represent different key lengths, with AES-256 being the strongest in terms of security.

2. 3DES (Triple DES):

• This older cipher has been around for a long time but is considered less secure than AES. It applies the DES (Data Encryption Standard) algorithm three times to each data block.
• Key weakness: While still functional, 3DES is being phased out in favor of more secure alternatives due to its vulnerability to modern cryptographic attacks.

3. ChaCha20:

• ChaCha20 is a more modern cipher, known for being faster and more secure than older algorithms in some situations, especially in mobile environments.
• It’s typically paired with a MAC (Message Authentication Code) called Poly1305 to ensure both confidentiality and integrity of the data.

Choosing the right cipher is critical to ensure the data transmitted over your VPN tunnel remains protected against potential breaches.

VPN Lifetimes: Managing the Duration of Secure Sessions

A lifetime in VPN terminology refers to the duration for which the cryptographic keys (and in some cases, the VPN tunnel itself) remain valid before a rekeying process or reconnection happens.

• Phase 1 Lifetime: This is the lifetime of the initial secure connection between two VPN devices (usually your firewall or VPN gateway). It’s set during the IKE (Internet Key Exchange) process, where the two devices authenticate each other and agree on a shared secret.
• Phase 2 Lifetime: This pertains to the rekeying of the IPsec encryption keys used during the actual data transfer phase of the VPN. The Phase 2 lifetime dictates how often the encryption keys are renegotiated to ensure the ongoing security of the connection.

Why does lifetime matter? The longer a key is used, the greater the chance that it could be compromised. A shorter lifetime leads to more frequent key exchanges, making it harder for attackers to exploit any given key. However, setting lifetimes too short could result in excessive overhead and unnecessary disruptions.

Choosing the Right VPN Cipher for Your Network

When selecting a cipher for your Site-to-Site VPN, you need to balance security and performance while considering future-proofing. Here are some best practices to guide your decision:

1. Go with AES-256 for Maximum Security

If you want to ensure that your VPN remains secure for years to come, AES-256 is your best bet. Although AES-128 is still considered secure, the increased key size in AES-256 provides additional protection against potential future advances in computing power (such as quantum computing).

Real-World Example: Imagine you’re a financial institution with a Site-to-Site VPN connecting your regional offices. Given the sensitive nature of financial data, you’d want to choose AES-256 to ensure the highest level of encryption. While it may slightly impact performance, the trade-off is worth it when the data involved could be a target for high-level attackers.

2. Avoid 3DES — It’s Becoming Obsolete

While 3DES may still be supported by many devices, it’s no longer considered secure enough for the future. With increased computational power, 3DES is more vulnerable to attacks, and as more organizations adopt AES-based ciphers, support for 3DES is being phased out.

Best Practice: Avoid using 3DES, and if you are currently using it, start transitioning to AES-128 or AES-256 for better security.

3. Consider ChaCha20 for Mobile or Low-Power Devices

If your VPN needs to connect mobile devices or lower-powered hardware, ChaCha20 could be a better option. It’s faster and more efficient on platforms that may struggle with the computational intensity of AES, while still offering a high level of security.

Selecting the Right Lifetime Settings

Now that we’ve covered ciphers, let’s talk about VPN lifetimes. Both Phase 1 and Phase 2 lifetimes should be considered when configuring your Site-to-Site VPN.

1. Phase 1 Lifetime: Between 8 and 24 Hours

Phase 1 establishes the initial security parameters for your VPN tunnel, including the authentication and the negotiation of cryptographic keys. A typical Phase 1 lifetime is 8 hours to 24 hours.

• Too short a lifetime: Frequent renegotiation can cause additional overhead and strain the devices.
• Too long a lifetime: Increases the risk of key compromise. It’s a balancing act between performance and security.

2. Phase 2 Lifetime: Typically 1 Hour to 1 Day

The Phase 2 lifetime determines how long the encryption keys used for data transfer are valid. 1 hour to 1 day is a common range.

• Shorter lifetimes make it harder for an attacker to use a compromised key.
• Longer lifetimes reduce the frequency of key renegotiations and associated performance overhead.

Best Practice: In most cases, start with 8 hours for Phase 1 and 1 hour for Phase 2. If you don’t experience significant performance issues, you can gradually increase the Phase 1 lifetime.

Planning for the Future: Longevity of Your VPN Settings

One of the challenges of managing a Site-to-Site VPN is that it can be tempting to choose convenient, quick settings that work today but might not stand the test of time. To ensure your Site-to-Site VPN settings remain viable in 3 years, here are some tips:

1. Stay Current with Cryptographic Developments: Cryptography is an ever-evolving field. While AES-256 is considered secure today, keep an eye on new standards and security recommendations. Avoid locking yourself into ciphers and protocols that might become obsolete due to advances in computing.
2. Choose Flexible Devices and Vendors: The VPN hardware and software you choose should support evolving cryptographic standards. Look for solutions that offer easy firmware or software updates to ensure compatibility with the latest encryption standards and security features.
3. Regularly Review Your VPN Configuration: Just as with any security system, a “set it and forget it” mentality can lead to vulnerabilities over time. Schedule regular reviews of your Site-to-Site VPN configuration and make adjustments as needed.

Conclusion: Setting Up for the Future

When it comes to Site-to-Site VPNs, choosing the right cipher and lifetime settings is crucial for both current and future security. By selecting AES-256 for encryption and setting reasonable lifetimes, you ensure that your VPN will stand up to potential threats for years to come.

Remember that cryptography is an ever-evolving field, and by planning ahead with secure, future-proof settings, you can be confident that your VPN will continue to meet your organization’s security needs — without requiring a complete overhaul in just a few years.