Coturn: Are there best-practices crypto settings available?

[law]

Given the prevalence of various organizations surreptitiously listening in to folks' calls worldwide, would it be possible to recommend a preferred, 'high security', configuration for Coturn, a la https://cipherli.st/ ?

[saphsoph88]

Hi @law ,

Did you manage to get any solid feedback here. I'm in installation phase and I want to achieve your goals.

Thanks

[shadoxx]

As a general rule, TLS 1.0, 1.1, and 1.2 should be avoided as of the posting of this comment, as well as all versions of SSL.
When setting up web servers, I use the Mozilla SSL Configuration Generator (which can be easily adapted to a coturn configuration): https://mozilla.github.io/server-side-tls/ssl-config-generator/

As of the posting of this comment, the recommended "modern" cipher suites from Mozilla are:
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

I personally disable the CBC cipher suites because of how they operate, and it looks like Mozilla agrees with me. However, they are recommended for compatibility reasons for older devices. I would take an assessment of your environment, see what cipher suites all expected devices support, and go from there. Hope this helps!

[misi]

I have added a PR to cipherli.st. https://github.com/RaymiiOrg/cipherli.st/pull/110
Any comment warmly welcomed!