OpenVPN / OpenVPN/openvpn

Samples could use `tls-crypt` over `tls-auth`?

Open
#757 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

A suggestion (and no is a valid answer) but:

TLS Crypt

TLS Crypt improves upon TLS Auth by adding symmetric encryption to the control channel. This extra layer of encryption applies even to the key exchange before the TLS session starts. Like TLS Auth, it also provides protection against TLS-level attacks with post-quantum resistance if the pre-shared keys are kept secret.

Source: https://openvpn.net/as-docs/tls-control-channel.html#tls-auth

But the current samples still suggest optionally enabling tls-auth (which has the added annoyance/complication of needing to explain and set a direction).. perhaps tls-crypt would be better to include in the samples?

https://github.com/OpenVPN/openvpn/blob/c2776ee0ff03832bb2213ebd19e9a14d37445bed/sample/sample-config-files/server.conf#L247-L258
https://github.com/OpenVPN/openvpn/blob/c2776ee0ff03832bb2213ebd19e9a14d37445bed/sample/sample-config-files/client.conf#L111-L113

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the referenced sections in sample/sample-config-files/server.conf and sample/sample-config-files/client.conf, then review how the samples currently describe tls-auth and key direction. Determine whether tls-crypt should replace or accompany that guidance, and update both samples consistently if appropriate. Done means the sample configurations provide clear, valid control-channel protection guidance.

Written by the indexing model from the issue text.

Assessment

Domain
networking, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.