I am currently working on a security-based product (VPN) and we have one critical requirement that I am unable to figure out.

The connection between the User and the VPN server is based on the OTP (One-time Pad) algorithm and I also have SSL on the server.

At the SSL handshake level, the certificate is sent over to client for verification. But we wish to encrypt the certificate as well using OTP before it is sent over the network.

The client is an iOS app. I am also looking for a solution so that the OTP encrypted certificate is first validated at the device level, before it is validated by the SSL handhshake. It is an additional security level that we wish to integrate.

Any idea how can I do this? As far as I know, the SSL handshake is an automated process and cannot be controlled.

  • 5
    Based on the OTP? Uh... what? – forest Sep 12 at 9:11
  • 2
    How are you planning to use OTP for a VPN? For OTP to be secure, you need to distribute the keys over a different channel, and keys need to be at minimum as large as the message. So if I want to use your VPN to download a 1GB file, your key needs to be 1 GB large. – MechMK1 Sep 12 at 9:13
  • 4
    Then you're not generating it correctly. An OTP can't be generated like that by a server. Also, by doing this, you are throwing away forward secrecy. What's wrong with just using AES or ChaCha20? – forest Sep 12 at 9:17
  • 2
    Why would you want to implement such a weird custom scheme? What is wrong with schemes that are in use by major tech companies today, that were created to solve exactly these probelms? – MechMK1 Sep 12 at 9:19
  • 4
    Your client is an idiot. Try to explain to them that an OTP will reduce security because 1) it's malleable, and 2) it lacks forward secrecy. But that still doesn't explain why you'd encrypt a certificate, of all things. You wouldn't even need to encrypt that without an OTP. But to be honest, at this point you might need to re-invent the VPN from scratch. Plugging all this weird stuff into it isn't going to go far. – forest Sep 12 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.