Does OpenVPN 2.4.8 support TLS 1.3 and the 25519 curve

banjo

Hello all

Simple questions:

Does the server code support TLS 1.3
Does the Client GUI support TLS 1.3
Does the server code support the 25519 curve
Does the Client GUI support the 25519 curve

For NO answers, any idea WHEN
For YES answers, could you point me in the direction of documentation as to HOW

I ask because there are various contradictory opinions out in the ether as to whether these are supported or not. If I issue a show-curves command against the server, I do not see any 25519 curves displayed. If I specify tls-version-min 1.3 in the client configuration, I get a parameter error message in the log.

Server: OpenVPN 2.4.8 - Debian Buster
SSL : OpenSSL 1.1.1d 10 Sept 2019
Client: OpenVPN 11.14.0.0 - Windows 10

regards, Banjo

TiTex

you can check with openvpn --version what crypto library is openvpn compiled with
if the crypto library supports it , openvpn supports it

for me this is library versions: OpenSSL 1.1.1

which supports all of the above

banjo

TiTex wrote you can check with openvpn --version what crypto library is openvpn compiled with
if the crypto library supports it , openvpn supports it

for me this is library versions: OpenSSL 1.1.1

which supports all of the above

Hi TiTex

Server 2.4.8 / 1.1.1d
Client 2.4.8/1.1.0l

Assuming what you say is true, it would seem that the OpenVPN developers have enabled these capabilities in the server and then disabled them in the client. Why would they do such a thing ?

TiTex

i don't know how and why they decide to build it with one library version or another so i can't answer your question

banjo

Right. I'm going to break this topic into two and I will start with Curve 25519 support. The general consensus is that if the SSL subsystem supports it, then OpenVPN will too. A --show-curves provides no evidence of support for curve 25519. However, ...

==> From the Server log:

OpenVPN 2.4.8 i686-pc-linux-gnu [SSL (OpenSSL)] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Dec 23 2019
library versions: OpenSSL 1.1.1d  10 Sep 2019

==> Specifying an "incorrect" curve (x25519) in the config gets detected:

Failed to use supplied curve (UNDEF), using secp384r1 instead.

==> Providing a "potentially valid" curve (X25519 or ED25519) cannot be used for some reason or other:

Failed to use supplied curve (ED25519), using secp384r1 instead.

So, it seems that the basis for support is there but for some reason, the server can/will not use the curve. My first inclination would be user error. So here are the explicit questions regarding the 25519 curve:

Does OpenVPN V2.4.8 support the 25519 curve
If YES, how does one specify that in the config file

I assume that the OpenVPN developers read this forum too. Surely there must be a developer that can answer this pretty basic question.

TinCanTech

Openvpn does not support Edwards Curves, at this time.

banjo

Thanks TCT - going to request that they are supported.

At this stage, I woiuld close this topic as Resolved, but I cannot see any way of doing it.