prng_hash

Wheelz

On my client OpenVPN log I see a line that states prng_hash = 'SHA1".

Can this be changed to use SHA256 or SHA512?

Thanks!

maikcat

i am not sure though...

add inside your server & client config

auth sha512

Michael.

Wheelz

I do have auth SHA384 set for server and client, but still shows SHA1.

Is the prng_hash for control channel?

The client I am using is OpenVPN for Android.

lobi

I am also having this same exact issue. I am using the following ciphers for data and control channels (on both server and client):

cipher AES-256-CFB
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384

However, both the client and server end up using SHA1, according to syslog:

[root@hq1zvpnp02 joseph]# grep prng /var/log/messages
Dec 14 20:27:49 hq1zvpnp02 openvpn[32610]: prng_hash = 'SHA1'
Dec 14 20:27:49 hq1zvpnp02 openvpn[32610]: prng_nonce_secret_len = 16

[root@hq1zvpnp02 joseph]# grep authname /var/log/messages
Dec 14 20:27:49 hq1zvpnp02 openvpn[32610]: authname_defined = ENABLED
Dec 14 20:27:49 hq1zvpnp02 openvpn[32610]: authname = 'SHA1'

In the openvpn man page, thre is no "authname" option to force SH384.

lobi

While experiencing the same issue, it looks like you can change it by using the --auth [alg] option:

--auth alg
Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a com-
monly used message authentication algorithm (MAC) that uses a data string, a secure hash algorithm, and a
key, to produce a digital signature.

OpenVPN’s usage of HMAC is to first encrypt a packet, then HMAC the resulting ciphertext.

In static-key encryption mode, the HMAC key is included in the key file generated by --genkey. In TLS
mode, the HMAC key is dynamically generated and shared between peers via the TLS control channel. If Open-
VPN receives a packet with a bad HMAC it will drop the packet. HMAC usually adds 16 or 20 bytes per
packet. Set alg=none to disable authentication.

For more information on HMAC see http://www.cs.ucsd.edu/users/mihir/papers/hmac.html

lobi

Actually this does not change prng_hash 🙁

Tue Dec 15 20:44:12 2015 us=674582 authname_defined = ENABLED
Tue Dec 15 20:44:12 2015 us=674594 authname = 'SHA384'
Tue Dec 15 20:44:12 2015 us=674604 prng_hash = 'SHA1'

You must use prng alg:

--prng alg [nsl]
(Advanced) For PRNG (Pseudo-random number generator), use digest algorithm alg (default=sha1), and set nsl
(default=16) to the size in bytes of the nonce secret length (between 16 and 64).

Set alg=none to disable the PRNG and use the OpenSSL RAND_bytes function instead for all of OpenVPN’s
pseudo-random number needs.