Samples could use tls-crypt over tls-auth?

A suggestion (and no is a valid answer) but:

TLS Crypt

TLS Crypt improves upon TLS Auth by adding symmetric encryption to the control channel. This extra layer of encryption applies even to the key exchange before the TLS session starts. Like TLS Auth, it also provides protection against TLS-level attacks with post-quantum resistance if the pre-shared keys are kept secret.

Source: https://openvpn.net/as-docs/tls-control-channel.html#tls-auth

But the current samples still suggest optionally enabling tls-auth (which has the added annoyance/complication of needing to explain and set a direction).. perhaps tls-crypt would be better to include in the samples?

openvpn/sample/sample-config-files/server.conf

Lines 247 to 258 in c2776ee

    
           # For extra security beyond that provided 
        
           # by SSL/TLS, create an "HMAC firewall" 
        
           # to help block DoS attacks and UDP port flooding. 
        
           # 
        
           # Generate with: 
        
           #   openvpn --genkey tls-auth ta.key 
        
           # 
        
           # The server and each client must have 
        
           # a copy of this key. 
        
           # The second parameter should be '0' 
        
           # on the server and '1' on the clients. 
        
           ;tls-auth ta.key 0 # This file is secret

openvpn/sample/sample-config-files/client.conf

Lines 111 to 113 in c2776ee

    
           # If a tls-auth key is used on the server 
        
           # then every client must also have the key. 
        
           ;tls-auth ta.key 1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	# For extra security beyond that provided
	# by SSL/TLS, create an "HMAC firewall"
	# to help block DoS attacks and UDP port flooding.
	#
	# Generate with:
	# openvpn --genkey tls-auth ta.key
	#
	# The server and each client must have
	# a copy of this key.
	# The second parameter should be '0'
	# on the server and '1' on the clients.
	;tls-auth ta.key 0 # This file is secret

	# If a tls-auth key is used on the server
	# then every client must also have the key.
	;tls-auth ta.key 1

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions