replay-persist with tls-crypt on server

Akleiklopsklobulus

Hallo togehter!

I recognized following behaviour on OpenVPN in server-mode:
When I use the following options:

tls-crypt ta_key.key
replay-persist replay_persist

there is no replay_persist-file generated. Even if I generate an empty one, the size remains zero.
On client side everything works fine.
The connection itself works without problems.

My Question:
Is replay persist only for client side or is there a server-side bug?

TinCanTech

Akleiklopsklobulus wroteThe connection itself works without problems

And ..

Akleiklopsklobulus wroteOpenVPN in server-mode:
When I use the following options:

tls-crypt ta_key.key

we assume openvpn 2.4 server and client ..

Akleiklopsklobulus wroteOpenVPN in server-mode:
When I use the following options:

tls-crypt ta_key.key
replay-persist replay_persist

there is no replay_persist-file generated

--tls-crypt supercedes --tls-auth and so --tls-auth related options may be disabled.

Akleiklopsklobulus

TinCanTech wrotewe assume openvpn 2.4 server and client ..

Absolutely correct - else tls-crypt won't work

--tls-crypt supercedes --tls-auth and so --tls-auth related options may be disabled.

This is, why I tested it.
And in this test, only the client seems to use replay persist. At least the client creates a replay-persist file and writes data into it.

As I understood, the difference between tls-auth and tls-crypt is the encryption of the TLS control channel. This doesn't imply an option against replay attacks. Correct me, if I am wrong.

TinCanTech

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Akleiklopsklobulus

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

TinCanTech wroteI am sure you have read the manual for these options.

Akleiklopsklobulus wroteYou are damn right

Quoth the Raven wroteThis option only makes sense when replay protection is enabled (the default) and you are using either --secret (shared-secret key mode) or TLS mode with --tls-auth

TinCanTech wrote--tls-crypt supercedes --tls-auth and so --tls-auth related options may be disabled

The tip of the iceberg ..

Akleiklopsklobulus

TinCanTech wroteThe tip of the iceberg ..

Seems so ..
If there are some new information, I'll post it
😉