4 ms·

Interesting. If true, this seems to contradict the statement released here: http://docs.openvpn.net/important-security-notice-regarding-heartbleed-vulnerability

• Wilya 13y ago
  Note that this statement is about OpenVPN Access Server, the commercial distribution of OpenVPN. There is a bit more info in the "community" wiki [0]. It seems the key point is that TLS-auth would already mitigate the vulnerability. TLS-auth is on by default in OpenVPN Access Server, but for the vanilla openvpn, you have to configure it yourself. And, as noted in the community statement, the TLS-auth is a single global pre-shared key. It could leak a bit more easily than personal certificates. [0] https://community.openvpn.net/openvpn/wiki/heartbleed https://community.openvpn.net/openvpn/wiki/heartbleed
  • mrsaint 13y ago
    Well, TLS-auth should be used _on top_ of a PKI. It is a HMAC key that an attacker would need to know before he'd even be able to initiate a TLS handshake. Thus, if you have used it in your OpenVPN setup, and if you know that the few users who have access to your VPN wouldn't have heartbleed-attacked you, then yes, you could assume that your private key has been safe from heartbleed despite an exploitable OpenSSL library.
• kfreds 13y ago
  I published on the openvpn-users mailing list before HN. I'll also be contacting them directly with technical details.