1

When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a client will be disregarded almost instantly.

This makes sense for personal VPNs, however when it comes to commercial VPNs is this still the case? I've downloaded some OpenVPN configuration files from NordVPN and they have their static key listed in the tls-auth section of the config. Now since this key is available to anybody on the internet (even people who aren't using them- I was able to download these and I'm not even subscribed to their service) can this actually still protect their servers against DoS attacks?

If everybody on the internet has access to this key, then surely the client won't be instantly disregarded anymore and it defeats the purpose of the key? An attacker could use this key just like a legitimate client right? If this is the case, won't it make using such an option in a commercial setting useless?

Or am I missing something, and there are other ways this key helps to secure a connection?

Thanks.

1 Answer 1

2

I don't think it's useless. Think of pre-shared key as an extra layer of protection for the TLS channel, requiring that incoming connections are correctly HMAC signed by the PSK key.

This feature protects a VPN gateway from certain types of DoS attacks aimed at overloading device CPU, for example. It also defeats casual port scanning, preventing the service from quick fingerprinting. And it acts as second line of defense for SSL library vulnerabilities.

Not all threats or DDos bots will use a properly configured TLS auth PSK for it's attack connection. So for those types threats it is useful.

1
  • 1
    Ah I see. So I guess if an attacker knew more about the setup they were trying to attack (like the key used etc) it becomes less useful, but for people who are scanning IP ranges looking for servers to attack it helps a lot there. After some more research I can also see how either way it can help with general SSL vulnerabilities too, thanks!
    – Letal1s
    May 3 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.