I use a VPN provider (tigerVPN) and they use OpenVPN with data channel cipher AES-256-CBC. For authentication, they use username/password and server cert.

I'm assuming that config doesn't support perfect forward secrecy?
Would an attacker be able to decrypt recorded data streams if he is able to obtain username/password? Is this configuration unsafe?


1 Answer 1


Does your configuration have a tls-client and tls-auth key settings? If not, your assumptions are correct and yes, an attacker could decrypt content of previously captured data streams. He would need the complete blockchain captured as well and some know clear text.

  • thank you for your response. this would be the config: client remote vie.tigervpn.com 1194 udp remote vie.tigervpn.com 443 tcp-client pull auth-user-pass password.txt comp-lzo adaptive ca ca.crt dev tun tls-client script-security 2 cipher AES-256-CBC mute 10 remote-cert-tls server
    – preheat
    Apr 16, 2016 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .