how secure is openvpn when using the easy-rsa scripts?

trainwreck

hello, i've had a working openvpn server at home for about a year now, and in light of recent NSA information I was wondering how secure my implementation is. bear in mind i'm very new to SSL/crypto stuff.

i used the easy-rsa scripts to generate a 2048-bit RSA key and am using AES-256-CBC as the data channel cipher. i've heard that 2048 RSA can be cracked if there isn't enough random data used when it's being generated?

perazim

debbie10t wroteYou could increase your RSA key to 4096 bit and use RSA-SHA512 for TLS .. but any encryption can be cracked eventually.
Although a 4096bit RSA key will give you a private key file which could be upto 1.04 e+1233 in length.
That is a 1 followed by about one thousand two hundred zeros ...

A pack of cards can be shuffled around 8 e+67 different ways ...

I have attempted to do this but the easy-rsa scripts don't seem to allow anything greater than 2048 bit RSA keys and I don't show a RSA-SHA512 in the list for TLS.

Could it be that this is a very new addition to openvpn in the last months?

Thanks,

Perzazim

perazim

Openvpn-2.2.2

Openssl-1.0.0-fips

Centos 6.3 with all updates

Running openvpn --show-ciphers --show-tls shows nothing past 2048 and 256 bit options

[root@bzq-219-224-198 ~]# openvpn --version
OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Aug 10 2012
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

$ ./configure --build=i686-redhat-linux-gnu --host=i686-redhat-linux-gnu --target=i686-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --enable-pthread --enable-password-save --enable-iproute2 --with-ifconfig-path=/sbin/ifconfig --with-iproute-path=/sbin/ip --with-route-path=/sbin/route

Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PKCS11 USE_SSL
[root@bzq-219-224-198 ~]#

Thanks,

Perazim

perazim

[root@bzq-219-224-198 ~]# openvpn --show-engines
OpenSSL Crypto Engines

Intel AES-NI engine (no-aesni) [aesni]
Dynamic engine loading support [dynamic]
[root@bzq-219-224-198 ~]#

I have no experience as to what this means.

Thanks,

Perazim

perazim

The lights went on. When I first setup the openvpn years ago, I didn't understand the docs concerning keysize and the ability in some cases to override defaults. What you just stated clears this up:

The default
key size is shown as well as whether or not it can be
changed with the --keysize directive.

I assumed that I couldn't override the key size in any case.

I am currently using a fixed key. What do you suggest for something larger?

Thanks,

Perazim

perazim

This is the cipher I am using. If possible, I am wanting to tighten security even further.