1

I am configuring an OpenVPN server and I would like to use TLS-CRYPT-V2. For that, in the documentation, it is said that I have to create a TLS-CRYPT-V2 key for the server and one for each client, because it is more secure.

But I don't know how it works. I understand that if a someone stole the key for a client, the keys of the others clients are still safe, so it is better one key for client than one key for all the clients.

However, I don't know how OpenVPN handles each key, does it allow only one key at the same time? Is it possible to revoke a TLS key in the same way a certificate is revoked? If a key is stolen, how does OpenVPN know that it shouldn't allow to connect to the client that uses this TLS key?

In summary, I would like to know how the TLS key works, how to provide another layer of security and what should be done in case the key is stolen.

1 Answer 1

2

TLS Crypt v2 doesn't have a key revocation mechanism by default, but you can implement one yourself based on key metadata.

When you use TLS Crypt v2, you generate a unique key Kc for each client. Additionally, you generate arbitrary metadata like the timestamp of key creation or a unique key ID. The concatenated string Kc || metadata is encrypted with the server key Ke and authenticated with HMAC to produce the wrapped client key WKc. See the documentation for more details.

When a client wants to establish a connection, it sends WKc to the server. The server decrypts WKc with its key Ke and can then check the metadata using a script which has been specified in the --tls-crypt-v2-verify command line option. See the OpenVPN manpage for for details..

So you could, for example, store a unique key ID in the metadata and maintain a database of valid key IDs. Whenever you want to revoke a compromised key, you remove its ID from the database. In the verification script, you simply check whether the ID from the provided WKc is in the database. Of course you could also do the opposite and create a database of revoked IDs, similar to a certificate revocation list in X.509.

2
  • Thanks so much, now it is more clear, but I have a doubt. If I use tls-crypt-v2 is without the metadata and the script, is it the same than use the same key for all the clients? If this is true, then is it more similar to tls-auth and tls-crypt? Commented May 15 at 7:30
  • tls-crypt-v2 without revocation is still more secure than tls-crypt, because if a client key is compromised, this only affects one client, not all clients. However, this one client will have a serious issue, because the compromised key will still be accepted by the server. So revocation should definitely be implemented. The only other way would be to change the server key and thereby invalidate all client keys at once.
    – Ja1024
    Commented May 15 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .