Hi All. I've got a question about how to configure a server (openVPN 2.4.9) to use a certain set of cipher suites. My scenario is a site-to-site setup between two devices/systems. Listing the supported suites for TLS 1.3 (or 1.2) that should be legal to use with the tls-ciphersuites directive: > openvpn --show-tls I see that the cipersuites I'd like to use are listed: TLS-PSK-WITH-AES-128-CBC-SHA256 TLS-PSK-WITH-AES-256-CBC-SHA384 TLS-PSK-WITH-AES-128-GCM-SHA256 TLS-PSK-WITH-AES-256-GCM-SHA384 These are described in [url=https://tools.ietf.org/html/rfc4279]RFC 4279[/url] and [url=https://tools.ietf.org/html/rfc5487]RFC 5487[/url] These suites work by sending a Key ID when establishing a TLS connection, and tests whether both ends are using the same key (after local retrieval on their respective sides). From this [url=https://forums.openvpn.net/viewtopic.php?f=22&t=27541#p82761]post[/url], I understand the difference between the control packets vs the data packets. If you write a client and server using these suites (either with openssl or mbedtls), you need to register a callback that performs the (respective) key lookup from the Key ID sent over the wire. Is this supported in openvpn? If so, how do you configure it?

[quote=TinCanTech post_id=97023 time=1611088041 user_id=37053] [quote=Wor post_id=97016 time=1611083148 user_id=52678] If you write a client and server using these suites (either with openssl or mbedtls), [b]you need to register a callback that performs the (respective) key lookup from the Key ID sent over the wire[/b]. Is this supported in openvpn? If so, how do you configure it? [/quote]What ever [i]callbacks[/i] are required, they are part of the source and [b]not configurable within Openvpn[/b]. [/quote]Whatever it is you are trying to do, it is not a configurable option. I suspect a case of [b][i]The XY Problem[/i][/b].

[quote=TinCanTech post_id=97025 time=1611088965 user_id=37053]Whatever it is you are trying to do, it is not a configurable option. I suspect a case of [b][i]The XY Problem[/i][/b]. [/quote] What I need to do is use the above mentioned ciphersuites to encrypt data over any kind of VPN (or other site to site tunnel). I understand what you mean by the XY problem, but I'm implementing a new type of PSK deployment system that requires the above functionality of sending Key IDs, as opposed to having pre-set, or pre-distributed single keys (don't ask how we do this, it's secret. ;) ). I assumed that when OpenVPN claimed it supported all cypher suites in the OpenSSL lib that there could be a way. Maybe I'm conflating "ciphers" with something else. [url]https://en.wikipedia.org/wiki/OpenVPN[/url] [quote]Encryption OpenVPN uses the OpenSSL library to provide encryption of both the data and control channels. It lets OpenSSL do all the encryption and authentication work,[b] [i][u][size=120]allowing OpenVPN to use all the ciphers available in the OpenSSL package[/size][/u][/i][/b]. It can also use the HMAC packet authentication feature to add an additional layer of security to the connection (referred to as an "HMAC Firewall" by the creator). It can also use hardware acceleration to get better encryption performance.[14][15] Support for mbed TLS is available starting from version 2.3.[16] [/quote] OpenVPN is awesome. I wish there was a way. Thanks for your help.

[quote=Wor post_id=97026 time=1611092884 user_id=52678] I'm implementing a new type of PSK deployment system that requires the above functionality of [i]sending Key IDs, as opposed to having pre-set, or pre-distributed single keys[/i] [/quote]This does not [i]sound like[/i] something Openvpn would be able to do. If you have technical details that you can clearly explain then you could contact the developers on their mailing list and ask there.

tls-ciphersuites directive with openssl/mbedssl

Wor

Hi All.

I've got a question about how to configure a server (openVPN 2.4.9) to use a certain set of cipher suites.

My scenario is a site-to-site setup between two devices/systems.

Listing the supported suites for TLS 1.3 (or 1.2) that should be legal to use with the tls-ciphersuites directive:

> openvpn --show-tls

I see that the cipersuites I'd like to use are listed:

TLS-PSK-WITH-AES-128-CBC-SHA256
TLS-PSK-WITH-AES-256-CBC-SHA384
TLS-PSK-WITH-AES-128-GCM-SHA256
TLS-PSK-WITH-AES-256-GCM-SHA384

These are described in RFC 4279 and RFC 5487

These suites work by sending a Key ID when establishing a TLS connection, and tests whether both ends are using the same key (after local retrieval on their respective sides).

From this post, I understand the difference between the control packets vs the data packets.

If you write a client and server using these suites (either with openssl or mbedtls), you need to register a callback that performs the (respective) key lookup from the Key ID sent over the wire.

Is this supported in openvpn? If so, how do you configure it?

TinCanTech

What happened top your first post ?

Pippin

It was deleted on request:

Don't know what happened, but this got posted before I finished editing. Pls delete.

Probably the edit time out expired.

TinCanTech

Pippin wrote It was deleted on request

OK.

Well, from the other post we learned that the SSL Library in use was mbedTLS.

mbedTLS in OpenVPN does not support cipher suites. That includes version 2.4 and 2.5

Wor wrote If you write a client and server using these suites (either with openssl or mbedtls), you need to register a callback that performs the (respective) key lookup from the Key ID sent over the wire.

Is this supported in openvpn? If so, how do you configure it?

What ever callbacks are required, they are part of the source and not configurable within Openvpn.

Wor

For my needs, I can use either mbedtls or openssl. Both support the above suites.

Is it possible with OpenSSL?

TinCanTech

TinCanTech wrote
Wor wrote If you write a client and server using these suites (either with openssl or mbedtls), you need to register a callback that performs the (respective) key lookup from the Key ID sent over the wire.

Is this supported in openvpn? If so, how do you configure it?
What ever callbacks are required, they are part of the source and not configurable within Openvpn.

Whatever it is you are trying to do, it is not a configurable option.

I suspect a case of The XY Problem.

Wor

TinCanTech wroteWhatever it is you are trying to do, it is not a configurable option.

I suspect a case of The XY Problem.

What I need to do is use the above mentioned ciphersuites to encrypt data over any kind of VPN (or other site to site tunnel).

I understand what you mean by the XY problem, but I'm implementing a new type of PSK deployment system that requires the above functionality of sending Key IDs, as opposed to having pre-set, or pre-distributed single keys (don't ask how we do this, it's secret. 😉 ).

I assumed that when OpenVPN claimed it supported all cypher suites in the OpenSSL lib that there could be a way. Maybe I'm conflating "ciphers" with something else.

https://en.wikipedia.org/wiki/OpenVPN

Encryption

OpenVPN uses the OpenSSL library to provide encryption of both the data and control channels. It lets OpenSSL do all the encryption and authentication work, allowing OpenVPN to use all the ciphers available in the OpenSSL package. It can also use the HMAC packet authentication feature to add an additional layer of security to the connection (referred to as an "HMAC Firewall" by the creator). It can also use hardware acceleration to get better encryption performance.[14][15] Support for mbed TLS is available starting from version 2.3.[16]

OpenVPN is awesome. I wish there was a way.

Thanks for your help.

TinCanTech

Wor wrote I'm implementing a new type of PSK deployment system that requires the above functionality of sending Key IDs, as opposed to having pre-set, or pre-distributed single keys

This does not sound like something Openvpn would be able to do.

If you have technical details that you can clearly explain then you could contact the developers on their mailing list and ask there.

Wor

Not a bad idea. I'll do that.

Cheers