Category: General

OpenVPN cryptographic layer This is a technical overview of OpenVPN's cryptographic layer, and assumes a prior understanding of modern cryptographic concepts. For additional discussion on OpenVPN security. OpenVPN has two authentication modes: Static Key -- Use a pre-shared static key TLS -- Use SSL/TLS + certificates for authentication and key exchange In static key mode, a pre-shared key is generated and shared between both OpenVPN peers before the tunnel is started. This static key contains 4 independent keys: HMAC send, HMAC receive, encrypt, and decrypt. By default in static key mode, both hosts will use the same HMAC key and the same encrypt/decrypt key. However, using the direction parameter to --secret, it is possible to use all 4 keys independently. In SSL/TLS mode, an SSL session is established with bidirectional…

One of the often-repeated maxims of network communication security is that one should never place so much trust in a single security component that its failure causes a catastrophic security breach. We use several mechanisms to add additional security layers to hedge against such an outcome. The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. It can protect against: DoS attacks or port flooding on the OpenVPN UDP port. Port scanning to determine which server UDP ports are in a listening state. Buffer overflow vulnerabilities in the SSL/TLS implementation. SSL/TLS handshake…