Discussion:
[Openvpn-users] What is OpenVPN's Logical Workflow?
Mahmoud Khonji
2009-10-22 17:48:44 UTC
Permalink
Hello folks,


The OpenVPN on-line documentation is not as clear as I need, about its use
of Diffie-Hellman. So before I read its C source files, I would highly
appreciate if someone explains it.

It's obvious that DH allows the exchange of a shared key between two parties
over an insecure network. I clearly see how this fits in IPSec IKE Phase 1.

However, when it comes to OpenVPN, with different authentications
mechanisms, the justification of DH becomes blued, at least for me.

I know using DH is a single command followed by dhparam file generated by
OpenSSL or easy-rsa. DH's math is one of the simplest. My OpenVPN running
peacefully. However my reasoning behind this question is knowing the exact
logical flow, so that I can secure my network more effectively.

Consider this example:

-

Client and Server both have Certificates and their corresponding Private
Keys are securely placed.
-

Logically, they would 1st authenticate each other, via exchanging their
X.509 certs, and verifying each against the CA's public X.509 cert. Is there
any step before this step that I'm missing?
-

Once identities are verified, they would need to agree on set of shared
keys to use for HMAC send/receive and encryption/decryption (user data).
-

Values used for HMAC send/receive and decrypt/encrypt are generated
randomly via OpenSSL's RAND_byte function.
-

Random values above, are exchanged over a TLS connection using their
corresponding X.509 certs and private keys.
-

Once required keys are exchanged, we can start encrypting/decrypting hmac
send/receive.

So where is DH in this process? Issue is, commenting out "dh" command in the
configuration file, leads into config parsing errors:
***@servcer# cat openvpn.log
Options error: You must define DH file (--dh)
Use --help for more information.
--
Regards,
Mahmoud Khonji
Davide Brini
2009-10-22 18:27:51 UTC
Permalink
Post by Mahmoud Khonji
So where is DH in this process? Issue is, commenting out "dh" command in
Options error: You must define DH file (--dh)
Use --help for more information.
OpenVPN uses TLS for key exchange. There's nothing OpenVPN-specific in that,
TLS is a standard protocol. See here:

http://tools.ietf.org/html/rfc5246#section-8.1.2

"Note: Diffie-Hellman parameters are specified by the server and may be either
ephemeral or contained within the server's certificate."

This is why the "dh" option is required only when you're in tls-server mode.

If the DH parameters are not included in the certificate (which I suppose is
the case with OpenVPN), the server sends a separate ServerKeyExchange message
after sending its certificate.
--
D.
David Sommerseth
2009-10-22 19:27:03 UTC
Permalink
Post by Davide Brini
Post by Mahmoud Khonji
So where is DH in this process? Issue is, commenting out "dh" command in
Options error: You must define DH file (--dh)
Use --help for more information.
OpenVPN uses TLS for key exchange. There's nothing OpenVPN-specific in that,
http://tools.ietf.org/html/rfc5246#section-8.1.2
"Note: Diffie-Hellman parameters are specified by the server and may be either
ephemeral or contained within the server's certificate."
This is why the "dh" option is required only when you're in tls-server mode.
If the DH parameters are not included in the certificate (which I suppose is
the case with OpenVPN), the server sends a separate ServerKeyExchange message
after sending its certificate.
I've been reading "SSL and TLS; Designing and building secure systems"
by Eric Rescorla lately. And if I haven't misunderstood it completely,
the DH parameters is only used with DSS certificates, as DH can only be
used for key agreement while DSS can only be used for key signing. So,
as far as I've understood, it is used during the encryption key exchange
between server and client when DSS certificates are involved.

If you do not have the DH file generated, I believe this key is
regenerated on-the-fly when needed, which then gives a DSS ephemeral
usage - comparable to RSA ephemeral keys. This of course gives a bit
higher overhead in CPU time as the DH data is generated.

I can recommend the "SSL and TLS" book, which really describes these
details pretty nicely.


kind regards,

David Sommerseth
Mahmoud Khonji
2009-10-29 18:56:16 UTC
Permalink
Never read that book, however Davide Brini seems right and matching TLS1.2
specs. It's true that DSA doesn't have its own key agreement (thus requires
DH instead). It's also true that RSA has its own key agreement method
(unlike DSA), however RSA can also use DH for key agreement instead,
depending on the chiper suit used. (See Appindex A.5 in RFC5246).

So it seems that openvpn doesn't use RSA's key agreement, and DH instead. DH
prime number in a file to save time/cpu, and since prime is public either
way, then having it statically in a file won't hurt security. Nis.ce.

Thanks.

On Thu, Oct 22, 2009 at 11:27 PM, David Sommerseth <
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Post by Davide Brini
Post by Mahmoud Khonji
So where is DH in this process? Issue is, commenting out "dh" command in
Options error: You must define DH file (--dh)
Use --help for more information.
OpenVPN uses TLS for key exchange. There's nothing OpenVPN-specific in
that,
Post by Davide Brini
http://tools.ietf.org/html/rfc5246#section-8.1.2
"Note: Diffie-Hellman parameters are specified by the server and may be
either
Post by Davide Brini
ephemeral or contained within the server's certificate."
This is why the "dh" option is required only when you're in tls-server
mode.
Post by Davide Brini
If the DH parameters are not included in the certificate (which I suppose
is
Post by Davide Brini
the case with OpenVPN), the server sends a separate ServerKeyExchange
message
Post by Davide Brini
after sending its certificate.
I've been reading "SSL and TLS; Designing and building secure systems"
by Eric Rescorla lately. And if I haven't misunderstood it completely,
the DH parameters is only used with DSS certificates, as DH can only be
used for key agreement while DSS can only be used for key signing. So,
as far as I've understood, it is used during the encryption key exchange
between server and client when DSS certificates are involved.
If you do not have the DH file generated, I believe this key is
regenerated on-the-fly when needed, which then gives a DSS ephemeral
usage - comparable to RSA ephemeral keys. This of course gives a bit
higher overhead in CPU time as the DH data is generated.
I can recommend the "SSL and TLS" book, which really describes these
details pretty nicely.
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkrgsgUACgkQDC186MBRfrpLNACfWq+cjQnHx6wTniDPanMYpsW9
sdMAnjemO69Yt3sCx0EJHxkW8d+Jc7NV
=wyM1
-----END PGP SIGNATURE-----
--
Regards,
Mahmoud Khonji
Loading...