View Single Post
fasza2's Avatar
Posts: 187 | Thanked: 96 times | Joined on Sep 2010 @ London, UK
#43
Here is what I could dig up(the last 2 were both from tls mode options):

'OpenVPN's usage of HMAC is to first encrypt a packet, then HMAC the resulting ciphertext.'

'--tls-auth file [direction]
Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.

In a nutshell, --tls-auth enables a kind of "HMAC firewall" on OpenVPN's TCP/UDP port, where TLS control channel packets bearing an incorrect HMAC signature can be dropped immediately without response.

file (required) is a key file which can be in one of two formats:

(1) An OpenVPN static key file generated by --genkey (required if direction parameter is used).

(2) A freeform passphrase file. In this case the HMAC key will be derived by taking a secure hash of this file, similar to the md5sum(1) or sha1sum(1) commands.'

'It should be emphasized that this feature is optional and that the passphrase/key file used with --tls-auth gives a peer nothing more than the power to initiate a TLS handshake. It is not used to encrypt or authenticate any tunnel data.'

According to this the HMAC key is static and is not used in the authenication.(2048bit FYI)

Last edited by fasza2; 2011-06-16 at 23:23.