Why pfSense doesn't support larger DH groups?
Since m0n0wall and now with pfSense, I've been wondering why it doesn't support larger Diffie-Hellman groups as defined by RFC 3526 (http://www.ietf.org/rfc/rfc3526.txt).
The largest supported group is DH 5 (MODP 1536 bits), which is roughly equivalent to 96-bit symmetric key. I don't think ciphers with longer key such as 3DES, CAST, Blowfish and AES would be any useful without the larger groups.
ipsec-tools racoon does support larger DH groups in Linux. I don't know if it does so in FreeBSD, would somebody confirm or rebut this? Thanks.
Table 1. DH keysize and security (equivalent symmetric key size)
DH Security SuitableCipher
1024 80 Skipjack
1536 96 –-
2048 112 3DES
3072 128 AES128
4840 160 AES192
7680 192 AES192
It is my understanding that we support everything that the freebsd kernel + racoon supports. Feel free to supply diff's in unified format if this is not the case.