3

This question elaborates that OpenVPN uses two channels to transfer data.

It first sets up a TLS connection (called control channel) and uses that to transfer a symmetric key and some other control data. It then sets up another channel (data channel) and starts transferring the actual data encrypted using the key.

Why the second channel? Why not simple transferring all data using TLS?

3

There's some truth in the other answers, but the primary reason is different: because OpenVPN was designed as IP-over-UDP, while TLS runs over TCP. Futhermore, the initial versions of OpenVPN did not have key exchange at all, but already had their own (better designed than TLS) data channel protocol. So when TLS was added, it made sense to stick to that for the data channel.

(Nowadays there's DTLS that runs over UDP, but that didn't exist when the OpenVPN protocol was created.)

  • That's what I thought that it is a legacy thing. Thank you – tsusanka Nov 30 '17 at 10:44
  • 1
    Not just legacy, also because the openvpn data channel is optimized for openvpn's needs. – Steffan Karger Nov 30 '17 at 10:51
  • 1
    This is a much better answer than mine. I did not know OpenVPN came before DTLS! – forest Dec 1 '17 at 5:05
2

OpenVPN is not designed only for one type of key exchange. There are multiple types of key exchange supported by OpenVPN. Rather than creating a new protocol for every single type, the developers use a single protocol, the data channel, and allows different features to provide the key using their own protocols, such as TLS. Additionally, this allows features such as --tls-auth to be used to provide security features which plain TLS does not provide (in this case, authentication before TLS even comes into play, as a second line of defense).

The OpenVPN documentation explains the two default types of key exchange, static keys and TLS.

  • Hm, I understand. Is it actually common to use other protocols to provide the key? It seems as a little bit as a theoretical option – tsusanka Nov 28 '17 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.