7 ms·
Apologies for the possibly stupid question: Did your OpenVPN server use TLS Authentication (tls-auth option) and, if so, did the attacker have access to that ke
by claudius 13y ago
Apologies for the possibly stupid question: Did your OpenVPN server use TLS Authentication (tls-auth option) and, if so, did the attacker have access to that key?
What I have read so far seems to imply that OpenVPN is vulnerable, but only if not used with tls-auth or if the attacker has access to the tls-auth key (as is the case for e.g. clients).
- kfreds 13y agoNo, our target server did not use tls-auth because it would only have added complexity and no valuable information. The threat model for tls-auth is pretty straightforward. You're correct in your second paragraph. I'll quote James Yonan and myself from last Monday: Using the tls-auth option should protect against this vulnerability (assuming that your tls-auth key is not known to the attacker). tls-auth is irrelevant if the attacker knows the key, which is the case for consumer VPN services like ours.
- jlgaddis 13y ago> Using the tls-auth option should protect against this vulnerability (assuming that your tls-auth key is not known to the attacker). Thank you for clarifying this.
- claudius 13y agoThank you very much for your reply! Of course it is irrelevant if the attacker knows the key, but that naturally depends on the threat model under consideration and your OP wasn’t too clear on that, hence my question :) Thanks again!
- kfreds 13y agoNo problem, I only added the quotes for more clarity. I'm glad I could help :)