OpenVPN Support Forum

On the server config file you must set
auth RSA-SHA256

On the client side you must set
auth SHA256

...and then the it works fine (tested on v2.4.0).

P.D.: You can use tls-auth if you want

On the server config file you must set the RSA- equivalent used on the client.conf On the client side you must set ...and it's working fine (tested on v2.4.0).

I don't know why SHAxxx doesn't work in the server side, if you check the digest availability in the server side, you can see both SHA256 and RSA-SHA256:
The following message digests are available for use with
OpenVPN. A message digest is used in conjunction with
the HMAC function, to authenticate received packets.
You can specify a message digest as parameter to
the --auth option.

MD5 128 bit digest size
RSA-MD5 128 bit digest size
SHA 160 bit digest size
RSA-SHA 160 bit digest size
SHA1 160 bit digest size
RSA-SHA1 160 bit digest size
DSA-SHA 160 bit digest size
DSA-SHA1-old 160 bit digest size
MDC2 128 bit digest size
RSA-MDC2 128 bit digest size
DSA-SHA1 160 bit digest size
RSA-SHA1-2 160 bit digest size
DSA 160 bit digest size
RIPEMD160 160 bit digest size
RSA-RIPEMD160 160 bit digest size
MD4 128 bit digest size
RSA-MD4 128 bit digest size
ecdsa-with-SHA1 160 bit digest size
RSA-SHA256 256 bit digest size
RSA-SHA384 384 bit digest size
RSA-SHA512 512 bit digest size
RSA-SHA224 224 bit digest size
SHA256 256 bit digest size
SHA384 384 bit digest size
SHA512 512 bit digest size
SHA224 224 bit digest size
whirlpool 512 bit digest size

alvarosedano wrote:On the server config file you must set
auth RSA-SHA256

On the client side you must set
auth SHA256

...and then the it works fine (tested on v2.4.0).

• This is not true ..

The result of such a configuration is:

Can you please give us the full server config? The client side also must be apreciated.

TinCanTech wrote:

alvarosedano wrote:On the server config file you must set
auth RSA-SHA256

On the client side you must set
auth SHA256

...and then the it works fine (tested on v2.4.0).

• This is not true ..

The result of such a configuration is:

Code: Select all

TLS Error: cannot locate HMAC in incoming packet ..

alvarosedano wrote:Can you please give us the full server config? The client side also must be apreciated.

• If you want to try to prove something which is not true then the onus is on you to submit your proof.

Infact, it turns out that I am wrong

When used for --auth the RSA element is not utilized,
only the SHA function is used as the HMAC for packets.

So, provided the bit lengths (256 / 512) are the same on server & client
then you can mix and match --auth RSA-SHAxxx with --auth SHAxxx.

eg:

• View OriginalServer

  auth RSA-SHA512
  will work with
  View OriginalClient

  auth SHA512
  etc.