OpenVPN config - Authentication username password

Question

I use a VPN provider (tigerVPN) and they use OpenVPN with data channel cipher AES-256-CBC. For authentication, they use username/password and server cert.

I'm assuming that config doesn't support perfect forward secrecy?
Would an attacker be able to decrypt recorded data streams if he is able to obtain username/password? Is this configuration unsafe?

Answer 1

Does your configuration have a tls-client and tls-auth key settings? If not, your assumptions are correct and yes, an attacker could decrypt content of previously captured data streams. He would need the complete blockchain captured as well and some know clear text.