From 8fd83f5a3f8b1c745b2e932bcaff7f8d850a8b9d Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Fri, 10 Feb 2012 15:59:26 -0500 Subject: [PATCH] updated docs to reference the default AES encryption mode of CBC --- doc/fwknop.man.asciidoc | 12 +++++------- doc/fwknopd.man.asciidoc | 10 +++------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/doc/fwknop.man.asciidoc b/doc/fwknop.man.asciidoc index ade2674d..7d8ff1f2 100644 --- a/doc/fwknop.man.asciidoc +++ b/doc/fwknop.man.asciidoc @@ -198,13 +198,11 @@ SPA OPTIONS are: *MD5*, *SHA1*, *SHA256* (the default), *SHA384*, and *SHA512*. *-M, --encryption-mode*='':: - Specify the encryption mode when AES is used. The default (for now) is - ECB mode in order to remain backwards compatible with pre-2.0 versions of - fwknop which relied on the Crypt::CBC perl module. This will be changed - in an upcoming version of fwknop to use the more secure CBC mode. In the - meantime, it is recommend to use this option to specify CBC mode (use the - string "CBC" as the argument), and then also use the ENCRYPTION_MODE - variable in the 'access.conf' file on the server. + Specify the encryption mode when AES is used for encrypting SPA packets. + The default is CBC mode, but others can be chosen such as CFB or OFB + as long as this is also specified in the 'access.conf' file on the + server side via the ENCRYPTION_MODE variable. In general, it is + recommended to not use this argument and just use the default. *-N, --nat-access*='':: The *fwknopd* server offers the ability to provide SPA access through diff --git a/doc/fwknopd.man.asciidoc b/doc/fwknopd.man.asciidoc index 36cb3e39..d39c9201 100644 --- a/doc/fwknopd.man.asciidoc +++ b/doc/fwknopd.man.asciidoc @@ -345,13 +345,9 @@ directive starts a new stanza. will automatically be set. *ENCRYPTION_MODE*: '':: - Specify the encryption mode when AES is used. The default (for now) is - ECB mode in order to remain backwards compatible with pre-2.0 versions of - fwknop which relied on the Crypt::CBC perl module. This will be changed - in an upcoming version of fwknop to use the more secure CBC mode. In the - meantime, it is recommend to use this option to specify CBC mode (use the - string "CBC" as the argument), and then also use '--encryption-mode' - command line argument on the *fwknop* client. + Specify the encryption mode when AES is used. The default is CBC mode, + but other modes can be selected such as OFB and CFB. In general, it is + recommended to not use this variable and leave it as the default. *ENABLE_CMD_EXEC*: '':: This instructs *fwknopd* to accept complete commands that are contained