tls-crypt-v2

[Dadadadadaa 0]

OpenVPN 2.5 introduced tls-crypt-v2, which has client specific tls-crypt keys instead of a pre-shared group key that is in tls-crypt-v1. Compromise of only 1 client or server would leak the key and thus make the tls-crypt layer useless against anyone obtaining the key. For public VPN providers bypassing the tls-crypt layer is even easier, one could just subscribe to the VPN service to get the key, but with the unique keys in v2, that problem is solved.
https://github.com/OpenVPN/openvpn/blob/master/doc/tls-crypt-v2.txt

Will AirVPN implement tls-crypt-v2?

[Staff 8644]

@Dadadadadaa

Hello!

No doubts, it will be even more useful against flood. Anyway nothing changes for the customers under a security point of view, obviously, as the key is needed as TLS pre-auth (so OpenVPN can shut down immediately, before checking client certificate, and mitigate flood) and for TLS mode (so PFS etc. become possible), nothing else.

Kind regards
 

[Dadadadadaa 0]

12 minutes ago, Staff said:

@Dadadadadaa

Hello!

No doubts, it will be even more useful against flood. Anyway nothing changes for the customers under a security point of view, obviously, as the key is needed as TLS pre-auth (so OpenVPN can shut down immediately, before checking client certificate, and mitigate flood) and for TLS mode (so PFS etc. become possible), nothing else.

Kind regards
 

Thanks for your quick reply! I was under the impression that tls-crypt also helps against VPN blocking/censorship because it hides the OpenVPN protocol signature during the TLS handshake. Edited ... by Dadadadadaa

[Staff 8644]

@Dadadadadaa

Yes, that's correct.

Kind regards
 

[Dadadadadaa 0]

On 1/11/2021 at 10:14 AM, Staff said:

@Dadadadadaa

Yes, that's correct.

Kind regards
 

Ah thanks!