The ciphers nobody had tried: SHA-384 taken, ChaCha20 refused, 2026-10-25
Discovery 15 of the discoveries.
The engine's cipher list names ChaCha20, AES with no encryption (GMAC), counter mode and 3DES besides
what had been measured, and SHA-384 had not been run. What decided which to try: OPNsense's IPsec
page offers ESP proposals with SHA-384 and ChaCha20-Poly1305, and none with GMAC or AES-CTR - so an
owner can choose the first two and not the others - and the vendor's own host
(generate_usfp_control) offloads AES-CBC with an HMAC, AES-GCM and AES-GMAC, never ChaCha20, CTR
or 3DES.
The whole page, with how it was taken and what it does not show: The ciphers nobody had tried: SHA-384 taken, ChaCha20 refused, 2026-10-25.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.