While reading the manual of OpenVPN 2.3, I came across the
--auth alg option. The manual says:
Authenticate packets with HMAC using message digest algorithm
alg. (The default is SHA1 ). HMAC is a commonly used message authentication algorithm (MAC) that uses a data string, a secure hash algorithm, and a key, to produce a digital signature.
From what I understand, HMAC is just a preferred way of making a MAC from a hash function, while potentially avoiding the length-extension properties of some hash functions.
So the algorithm specified in the
--auth option should be a hash function.
Now if I do
openvpn --show-digests to know what algorithms I can use with the
--auth option I got also entries like:
RSA-SHA, DSA-SHA, ECDSA-WITH-SHA1... etc.
These are the digital signature algorithms, why they are supposed to be used in the HMAC? To get sort of "double authentication"? Isn't it a bit of an overkill?
Or does it mean in this case the HMAC is actually replaced by digital signature to achive authentication? If this is the case, what is better to use in terms of security?