Samples could use `tls-crypt` over `tls-auth`?
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
A suggestion (and no is a valid answer) but:
TLS Crypt
TLS Crypt improves upon TLS Auth by adding symmetric encryption to the control channel. This extra layer of encryption applies even to the key exchange before the TLS session starts. Like TLS Auth, it also provides protection against TLS-level attacks with post-quantum resistance if the pre-shared keys are kept secret.
Source: https://openvpn.net/as-docs/tls-control-channel.html#tls-auth
But the current samples still suggest optionally enabling tls-auth (which has the added annoyance/complication of needing to explain and set a direction).. perhaps tls-crypt would be better to include in the samples?
https://github.com/OpenVPN/openvpn/blob/c2776ee0ff03832bb2213ebd19e9a14d37445bed/sample/sample-config-files/server.conf#L247-L258
https://github.com/OpenVPN/openvpn/blob/c2776ee0ff03832bb2213ebd19e9a14d37445bed/sample/sample-config-files/client.conf#L111-L113
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the referenced sections in sample/sample-config-files/server.conf and sample/sample-config-files/client.conf, then review how the samples currently describe tls-auth and key direction. Determine whether tls-crypt should replace or accompany that guidance, and update both samples consistently if appropriate. Done means the sample configurations provide clear, valid control-channel protection guidance.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100