2

I'm currently getting familiar with OpenVPN by building and testing some client–server infrastructure using VMware workstation.

This is what I've recently noticed: if you manually change some values in client's ta.key, you still will be able to connect to the server, no errors or warnings appear in the log during the connection process.

Example: My current key, which is the same on client and server side looks like this:

-----BEGIN OpenVPN Static key V1----- 135e25bb334841d0144bc9cada39d8f4 dc4185d5d78289e6b449d2616d808baa 149a110f3985d5b5698d0766f0e91826
96fd9f886210f30cd4198713f7e5268d 02d5b88276e36c0152a1e117e02b02f5
3918ddfaead2efa1760224024f9426dc 02e4f660da96c22fa9256374b72d5e95
f0f154fb5acb65af4934e17a31d0bab3 1c96053d7c9ffac4e91da542bdff3bdc
146b3dc28f484609d8d2b95e6b7b9ecb 0919f3a7bd1275810da8851b8699ab2c
3d4f03e54ad77ec4a8b76cebfeac98d1 4c81af32861be3c396469710c0cfe4ea
4b8285dd5dd925d2c4a9ba976ea137da cdaf8af33d0a69a341df41d1873f8e0f
f30627ac336f6dd4dfe607efdf135740
-----END OpenVPN Static key V1-----

Now, on client's side I make some changes to it, say, set first and last 4 values to 0, so it looks like this:

-----BEGIN OpenVPN Static key V1----- 000025bb334841d0144bc9cada39d8f4 dc4185d5d78289e6b449d2616d808baa 149a110f3985d5b5698d0766f0e91826
96fd9f886210f30cd4198713f7e5268d 02d5b88276e36c0152a1e117e02b02f5
3918ddfaead2efa1760224024f9426dc 02e4f660da96c22fa9256374b72d5e95
f0f154fb5acb65af4934e17a31d0bab3 1c96053d7c9ffac4e91da542bdff3bdc
146b3dc28f484609d8d2b95e6b7b9ecb 0919f3a7bd1275810da8851b8699ab2c
3d4f03e54ad77ec4a8b76cebfeac98d1 4c81af32861be3c396469710c0cfe4ea
4b8285dd5dd925d2c4a9ba976ea137da cdaf8af33d0a69a341df41d1873f8e00
f30627ac336f6dd4dfe607efdf130000
-----END OpenVPN Static key V1-----

And surprisingly I'm still able to connect to the server. Only if I generate a completely new key with openvpn --genkey --secret ta2.key command and use it instead of old one, only then I will get error when trying to connect to the server:

Fri Sep 7 11:33:04 2018 us=232609 TLS Error: incoming packet authentication failed from [AF_INET]192.168.1.2:33596

Fri Sep 7 11:33:12 2018 us=212985 Authenticate/Decrypt packet error: packet HMAC authentication failed

So, how is this even possible? I thought that changing a single bit in the key should lead to authentication error, but it does not. Any ideas?

--

OpenVPN version, if needed:

OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017

Improve this question

1 Answer 1

Reset to default
2

https://community.openvpn.net/openvpn/wiki/327-changed-hex-bytes-in-the-static-key-the-key-still-connects-to-a-remote-peer-using-the-original-key

In short, the key is overly large. Not all portions of the file is actually used in current implementations.

Improve this answer
1
  • 1
    Yeah, thanks a lot for this link. I set the verbosity level to 7 and was able to see which bits exactly were used in the HMAC auth.
    – ImJustCurious
    Commented Sep 7, 2018 at 11:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .