I'm playing around with IPSec VPN on our FG500D. I'd like to use Diffie-Hellman group 21 for my P1 and P2 negotiations as they are Elliptic Curve (EC) based and thus should be more efficient than the RSA based keys. I never realized what the groups represented until doing some digging today. Found this blurb:
Diffie-Hellman group 1 - 768 bit modulus - AVOID
Diffie-Hellman group 2 - 1024 bit modulus - AVOID
Diffie-Hellman group 5 - 1536 bit modulus - AVOID
Diffie-Hellman group 14 - 2048 bit modulus – MINIMUM ACCEPTABLE
Diffie-Hellman group 19 - 256 bit elliptic curve – ACCEPTABLE
Diffie-Hellman group 20 - 384 bit elliptic curve – Next Generation Encryption
Diffie-Hellman group 21 - 521 bit elliptic curve – Next Generation Encryption
Diffie-Hellman group 24 - modular exponentiation group with a 2048-bit modulus and 256-bit prime order subgroup – Next Generation Encryption
Algorithms marked as AVOID do not provide an adequate security level against modern threats and should not be used to protect sensitive information. It is recommended that these algorithms be replaced with stronger algorithms.
Next Generation Encryption (NGE) is expected to meet the security and scalability requirements of the next two decades.
If you are using encryption or authentication algorithms with a 128-bit key, use Diffie-Hellman groups 5, 14, 19, 20 or 24. If you are using encryption or authentication algorithms with a 256-bit key or higher, use Diffie-Hellman group 21 or 24.
From <https://supportforums.cisco.com/document/12276506/diffie-hellman-groups>
I'm making a concerted effort to use EC based crypto as often as possible going forward. As I'm using AES256-SHA256 for P1 and P2, using DH group 19-21 seems to be the best choice. I started off high with 21.
I was dismayed when I went to the FortiClient and saw it only supports DH groups 1,2,5, and 14. Why is that? Is the math of the higher groups too intense for a standard CPU? From all that I have read, DH 19-21 should actually be easier due to the efficiencies of EC.
"
