auth RSA-SHA256 verses auth SHA256

[alvarosedano]

On the server config file you must set
auth RSA-SHA256

On the client side you must set
auth SHA256

...and then the it works fine (tested on v2.4.0).

P.D.: You can use tls-auth if you want

[alvarosedano]

On the server config file you must set the RSA- equivalent used on the client.conf

View Originalserver.conf

#Use only one of them
auth RSA-SHA256
;auth RSA-SHA384
;auth RSA-SHA512

On the client side you must set

View Originalclient.conf

#Use only one of them
auth SHA256
;auth SHA384
;auth SHA512

...and it's working fine (tested on v2.4.0).

I don't know why SHAxxx doesn't work in the server side, if you check the digest availability in the server side, you can see both SHA256 and RSA-SHA256:

Code: Select all

openvpn --show-digests

The following message digests are available for use with
OpenVPN. A message digest is used in conjunction with
the HMAC function, to authenticate received packets.
You can specify a message digest as parameter to
the --auth option.

MD5 128 bit digest size
RSA-MD5 128 bit digest size
SHA 160 bit digest size
RSA-SHA 160 bit digest size
SHA1 160 bit digest size
RSA-SHA1 160 bit digest size
DSA-SHA 160 bit digest size
DSA-SHA1-old 160 bit digest size
MDC2 128 bit digest size
RSA-MDC2 128 bit digest size
DSA-SHA1 160 bit digest size
RSA-SHA1-2 160 bit digest size
DSA 160 bit digest size
RIPEMD160 160 bit digest size
RSA-RIPEMD160 160 bit digest size
MD4 128 bit digest size
RSA-MD4 128 bit digest size
ecdsa-with-SHA1 160 bit digest size
RSA-SHA256 256 bit digest size
RSA-SHA384 384 bit digest size
RSA-SHA512 512 bit digest size
RSA-SHA224 224 bit digest size
SHA256 256 bit digest size
SHA384 384 bit digest size
SHA512 512 bit digest size
SHA224 224 bit digest size
whirlpool 512 bit digest size

[TinCanTech]

On the server config file you must set
auth RSA-SHA256

On the client side you must set
auth SHA256

...and then the it works fine (tested on v2.4.0).

• This is not true ..

The result of such a configuration is:

Code: Select all

TLS Error: cannot locate HMAC in incoming packet ..

[alvarosedano]

Can you please give us the full server config? The client side also must be apreciated.

[TinCanTech]

On the server config file you must set
auth RSA-SHA256

On the client side you must set
auth SHA256

...and then the it works fine (tested on v2.4.0).

• This is not true ..

The result of such a configuration is:

Code: Select all

TLS Error: cannot locate HMAC in incoming packet ..

Can you please give us the full server config? The client side also must be apreciated.

• If you want to try to prove something which is not true then the onus is on you to submit your proof.

[TinCanTech]

Infact, it turns out that I am wrong

When used for --auth the RSA element is not utilized,
only the SHA function is used as the HMAC for packets.

So, provided the bit lengths (256 / 512) are the same on server & client
then you can mix and match --auth RSA-SHAxxx with --auth SHAxxx.

eg:

• View OriginalServer

  auth RSA-SHA512
  will work with
  View OriginalClient

  auth SHA512
  etc.