Is OpenVPN secure if both the certificate and private key, are publicly known?

Question

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test.

It gives you the option of OpenVPN and provides a guide for Ubuntu.

Part of the guide involves downloading a certificate and its private key. You download it over SSL but the certificate isn't unique to you the user. Anybody can go to that page and download both halves of the key.

This question really comes from not understanding how OpenVPN uses TLS but...
How is the connection secure if a malicious party knows the encryption details and keys?

(Can somebody add the openvpn tag to this? That seems like it should be a valid tag here.)

Answer 1

I've just been talking with the IPredator guys on IRC and it's quite interesting. I've made some incorrect assumptions.

As part of the installation process you add their CA. That's fair enough. So the whole connection happens through RSA (or similar) public-key encryption.

The key-pair is just an additional TLS encryption layer for authentication. They freely admit it offers no additional security for users but it does mean that anybody trying to connect needs that pair of keys. Requiring them has meant a sharp drop in connection-style DDoSes.

So it is still secure. The key-pair is just some additional security-through-obscurity.

Answer 2

The TA keyfile from the guide is a static key used to authenticate all traffic between the VPN server and the client. This allows either party to discard all traffic not authenticated by that specific key.

On top of that, each session will use an exchanged session key (through Diffie-Hellman or similar methods) to encrypt to traffic.