0

In OpenVPN which algorithm is used for control channel encryption (--tls-crypt directive in OVPN profile)?

By using --tls-crypt, will there be only encryption or authentication-then-encryption? I want to disable --auth by using alg=none parameter. I know --auth is required for --tls-auth (control channel authentication).

Is --auth necessary for --tls-crypt too, or I can disable --auth without any upcoming issues related to --tls-crypt functioning?

Update 1: I searched in OpenVPN 2.4 manual and it states --tls-crypt is used for encryption "and" authentication control channel. The rest of the question remains unanswered.

Update 2: After searching in OpenVPN support forum; I realized --tls-crypt uses AES-256-CTR for encryption; still know nothing about the authentication side.

Improve this question
1
  • This seems like a question for the OpenVPN support forum.
    – Tom K.
    May 15, 2018 at 11:41

1 Answer 1

Reset to default
1

First: don't disable --auth. --auth controls the authentication mechanism for the data channel, while --tls-crypt is for the control channel (though, and this is slightly confusing, --auth also controls the auth algorithm used by --tls-auth).

--tls-crypt uses fixed crypto methods, which are HMAC-SHA256 for authentication and AES-256-CTR for encryption. So yes, as the man page says, --tls-crypt offers an extra layer of both encryption and authentication for the control channel. The algorithms are not mentioned in the man page, but printed at --verb 3 log level by openvpn op startup:

Sat May 12 22:07:42 2018 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sat May 12 22:07:42 2018 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sat May 12 22:07:42 2018 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sat May 12 22:07:42 2018 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication

For more information, you could read the commit message of the commit that introduced tls-crypt (https://github.com/OpenVPN/openvpn/commit/c6e24fa3), or the in-code documentation (https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/tls_crypt.h, or the generated doxygen available on https://build.openvpn.net/doxygen/html/group__tls__crypt.html).

Improve this answer
3
  • Thanks @Steffan Karger - I forgot to mention that I'm using AES-256-GCM for the data channel, which is AEAD and ignores --auth option; this has been stated in the v2.4 manual page. Also I'm only using --tls-crypt and not --tls-auth. Do you think disabling --auth has any disadvantages/harms in this circumstances? I mean: Is there somewhere else which --auth is necessary for?
    – HansRX
    May 13, 2018 at 1:31
  • @SteffanKarger Are you in any way affiliated with OpenVPN? ;)
    – Tom K.
    May 15, 2018 at 11:46
  • 1
    @Hans: no, if you're using --tls-crypt and AES-256-GCM, --auth has no effect. Even so, it would be wiser to leave it at it's default value than to set it to none. If it were only to prevent you from disabling authentication by mistake in a later config edit. @TomK.: Yeah, somewhat. ;-)
    – Steffan Karger
    May 15, 2018 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .