maemo.org - Talk - View Single Post - Maemo 5 as a vulnerability / "hacking" victim

	fasza2	2011-06-16 , 21:05
	Posts: 187 \| Thanked: 96 times \| Joined on Sep 2010 @ London, UK	#40

Originally Posted by momcilo

In short, this is used for static keys when used with UDP. For dynamic (TLS based) you do not need it.

You got me confused now

I had to check my .conf file; but
I think tls-auth /etc/openvpn/ta.key 1 stands for the dynamic one.
So the preshared ta.key file is needed probably for this very reason:

Originally Posted by momcilo

My guess is that the shared secret is used to feed IV of hash function (MD5, SHA1, SHA224, SHA256, SHA384, SHA512), although I would have to inspect source code to see what is actually going on.

In fact, I'm not really sure what the static key mode is. Is it the non-PKI one?

Originally Posted by momcilo

Instead of putting SHA1 to the outer package, I would prefer to keep it together with plain-source, than encrypt everything together. That would provide more security.

Now I'm not sure how exacly they implemented this; if hash is encryped seperate from data or together. But I know if an attacker changes a single bit in the packet the hash will fail.

Originally Posted by momcilo

The drawback to this approach is the need to decrypt each packet, than calculate SHA1 to detect the "faulty" packet.

The whole idea is that the server has to be able to be extract the hash from the packet in order to filter out dodgy UDP packets to save the cypher and the TCP/IP stack from further processing. Sort of not letting your 'pipe' get 'clogged'. Thankfully, this is just the first line of defence. That being said as long as the hash can be extracted from the packet it would be possible to encrypt them together, but I'll try to read up on this later.

PS: MD5 is not recomended due to vulnerabilities and some other problems.

Quote & Reply |