Parameters for Control Channel Encryption, Randoms?

bjsdaiyu

Hello, in order to have some basic knowledge about cryptography I have decided to go through a very short OpenVPN session and "manually" decode everything (i.e., work through the HMAC authentication, determine how the private/public keys are used to sign and/or encrypt traffic, reproduce the steps myself using scripts, etc). I have managed to decode everything except for the Control Channel messages with opcode=P_CONTROL_V1 that are encrypted following (and including):

- the pair of (what Wireshark dubs) the "Encrypted Handshake Messages."
- a small number of P_CONTROL_V1 messages between the server and client that I guess perform the following function:
* server->client: push routing settings to the client
* server<->client: exchange 64 bytes of random for input into the TLS-PRF leading to the data channel keys

Since this is a learning exercise I have access to the private public keys on both ends, and also know the premaster secret derived from the Diffie Helman exchange (and indeed can calculate the correct ciphers to decrypt the Data Channel). I am unable to decrypt any of the messages in the control messages since I am confused about the encryption protocol. Is public key RSA being used to encrypt all of the data in this channel - if so are keys other than those for the client/server being used; or, is a block cipher such as AES256 (which appears in the logging) used for encrypting the actual contents of the channel- if so where should I look for the session key (premaster secret negoatiated by Diffie Hellman? something xmitted over RSA?) and initialization vector(s)?

Also, am I correct that OpenVPN entirely ignores the random bytes that are sent by client and server during their respective hellos early in the session. It seems that the 64 bytes of client and server random that are being fed into TLS-PRF are being passed along the secure control channel (instead of being generated algorithmically from the client/server hello values) - is this supposition correct, as I cannot find anywhere in the source where the hello values are hashed or otherwise manipulated into the values appearing in the logs.

These are things I have some trouble figuring out. Thank you for any assistance.

bjsdaiyu

unraveled some additional information... by inserting the following at strategic places in ssl_openssl.c:

key_state_write_ciphertext (struct key_state_ssl *ks_ssl, struct buffer *buf)
{
  int ret = 0;
  perf_push (PERF_BIO_WRITE_CIPHERTEXT);

  ASSERT (NULL != ks_ssl);

    //MY ADD                                                                                                                                                                                 
  struct gc_arena gc = gc_new();
  if (ks_ssl->ssl->session != NULL)
    {
      dmsg (D_TLS_DEBUG,"ME: session master key %s",format_hex(ks_ssl->ssl->session->master_key,ks_ssl->ssl->session->master_key_length,0,&gc));
      dmsg (D_TLS_DEBUG,"ME: key cipher name %s",ks_ssl->ssl->session->cipher->name);                                                                                              
    }
  gc_free(&gc);
   // END MY ADD
  [...]

It looks like you can retrieve the SSL master key I believe for the SSL'd control channel. Also confirmed that it is DHE-RSA-AES256-SHA encryption method for the control channel (by default). Finally, by cheating and printing out the plaintext version of whatever is entering/leaving the BIO have confirmed that the client/server random values used for the data channel are indeed being passed encrypted over the control channel prior to calculation of the data channel keys. However still cannot decrypt the control channel directly, onward through the fog.:\

bjsdaiyu

FINALLY GOT IT!My mistake was idiotic, I was not including the gmt_unix_time bytes as part of the Client/Server Random and that was messing everything up. Now the keyblocks are calculated correctly.

As is suggest quite strongly by the payload lengths (and common sense) the actual control channel data is encrypted using AES256, not public key. Public key or diffie helman is still used only to negotiate a block key.

FYI for other learners, it's possible to get OpenVPN to return quite a bit of useful information about what's going on "under the hood" as OpenSSL does its thing in the background. I ended up inserting the following logic:

void MYdebug(SSL * s)
{
    struct gc_arena gc = gc_new();
    if (NULL != s->session)
      {
        if (NULL != s->session->master_key) // this master key is the result of applying TLS PRF once to the premaster key.  so only apply the second round of TLS PRF (i.e., using "key expansion" label.  For OpenVPN with AES256 the block size will be 136 bytes)
          {
            dmsg (D_TLS_DEBUG,"MY: session master key %s",format_hex(s->session->master_key,s->session->master_key_length,0,&gc));

          }
        if (NULL != s->session->cipher)
          {
            dmsg (D_TLS_DEBUG,"MY: key cipher name %s",s->session->cipher->name);
          }
        if (NULL != s->s3)
          {
            dmsg (D_TLS_DEBUG,"MY: Client Random %s",format_hex(s->s3->client_random,SSL3_RANDOM_SIZE,0,&gc));
            dmsg (D_TLS_DEBUG,"MY: Server Random %s",format_hex(s->s3->server_random,SSL3_RANDOM_SIZE,0,&gc));

          }
        if ((void *)&(s->s3->tmp))  // check the keyblock value.  it will exist only briefly but WILL be caught during one of the calls to write_ciphertext()
          {
            dmsg (D_TLS_DEBUG,"MY: key block %s",format_hex(s->s3->tmp.key_block,s->s3->tmp.key_block_length,0,&gc));
          }
      }
    gc_free(&gc);
}

And insert MyDebug in the following functions, after the ASSERT() logic: key_state_write_plaintext,key_state_write_ciphertext

salibemil

Hello,
I am embarking on a similar educational process of learning OpenVPN and cryptography. You stated in your May 23, 2014 that you had developed scripts that enabled you to manually decode most if not all the steps that OpenVPN takes in authentication, encryption and key exchange. I would appreciate it if you share these scripts or point to me where I may find them.
Thanks
Emil