Sophos Firewall: v18.5 MR2: Feedback and experiences

How does one actually know if the GCM suite is being used for the IPSEC connections? I don't see any options to enable it in the IPSEC policies.

Run this on Advanced shell

ipsec statusall | grep GCM

Meaning the firewall will automatically determine if the GCM suite is needed or not? what  is the default behaviour?

You have to specify GCM chiper in a custom ipsec profile

It isn't listed as an option. Checked on an XG135 and XG86

It is available in IPSec phase 2 only. It is listed on XGS107 and home license barebone machine. I don’t have a Hardware XG machine on hand. 

Its only a feature for Phase 2. Phase 1 cannot "use" GCM" in that term. 

For SSLVPN, it will come in the next major release (V19.0). 

Its only a feature for Phase 2. Phase 1 cannot "use" GCM" in that term. 

For SSLVPN, it will come in the next major release (V19.0). 

Are there any benefits of using GCM besides  security and performance? Or its just those two?

It brings you you a cup of tea in the morning.

Apart from security and performance, I'm not sure what else you could want from a secure connection.

Copied from a post by Luis Casillas on Stack. Exchange regarding CBC v GCM that may be illuminating:

GCM = CTR + Authentication.

But in general you are right; CBC is an older mode that was invented back in the dark ages cryptographically speaking (no later than the 1970s), and is now disfavored because of the lack of built-in authentication and all the trouble that's been caused by padding oracles. One good practical example of this is that TLS 1.3 got rid of support for CBC.

GCM isn't a panacea either, however. It is strictly speaking correct, but has proven itself to be far from foolproof in practice:

1. It fails spectacularly if you reuse a nonce. A single repeated nonce allows an adversary to recover its authentication subkey, plus to learn the XOR of the two messages with the same nonce.
2. Its nonces are uncomfortably short (96 bits), which can be tricky to use with random nonces.

CBC doesn't have these problems. Random IVs work just fine (and are in fact required), and if you do repeat an IV you don't get catastrophic failure, you just leak information about equal plaintext prefixes.

Is there a rationale on why its only present in Phase 2? Just need to know how to explain to customers.

"For SSLVPN, it will come in the next major release (V19.0)."

It is already in v19 EAP1, and it seems to be working quite well.

See: https://crypto.stackexchange.com/questions/74411/why-cant-aes-gcm-be-used-in-ikev1-phase-1