[i]what if:[/i] [list]1. i start a PSK based tunnel using port 1193 on each host 2. generate a new PSK on one host 3. send the new PSK via the first tunnel 4. start a 2nd tunnel using port 1194 on each host and using the newly generated PSK 5. take down the 1st tunnel running over port 1193[/list] [i]how secure/safe would this be?[/i]

so every hour i could generate a new PSK[n+1], share it securely, and start a new tunnel. but ... [i]should i share PSK[n+1] over a temporary tunnel keyed with PSK1 or the existing tunnel keyed with PSK[n][/i]

Or do it right : [url=https://openvpn.net/index.php/open-source/documentation/howto.html#pki]Public Key Infrastructure[/url]

PSK and session key

Skaperen

what if:

1. i start a PSK based tunnel using port 1193 on each host
2. generate a new PSK on one host
3. send the new PSK via the first tunnel
4. start a 2nd tunnel using port 1194 on each host and using the newly generated PSK
5. take down the 1st tunnel running over port 1193

how secure/safe would this be?

Traffic

How did you share the first key ?

If Key#1 was shared over an insecure medium then the tunnel data is at risk.

Skaperen

assume PSK1 was shared by SSH well in advance much as one might do for a simple static tunnel. the idea is to get a different session key for each tunnel each time one is started. that way PSK1 has minimal exposure and if a key gets cracked it probably will be PSK2. my big concern is maintaining authentication.

Skaperen

so every hour i could generate a new PSK[n+1], share it securely, and start a new tunnel. but ... should i share PSK[n+1] over a temporary tunnel keyed with PSK1 or the existing tunnel keyed with PSK[n]

Traffic

Or do it right :
Public Key Infrastructure