SSL VPN – OpenVPN 2.4 TLS-Crypt vs Elliptic Curve

openvpnsslvpn

  1. If I understand correctly from OpenVPN 2.4 manual, if one is using ECDH TLS cipher suites then they can set dh none. This will have same security level (or better) as using dh key, is this a correct assumption?

  2. About the tls-auth, the manual says "Use –tls-crypt instead if you want to use the key file to not only authenticate, but also encrypt the TLS control channel.".

Currently I do NOT have tls-auth or tls-crypt setup in configuration but in logs I see

Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 521 bit EC, curve: secp521r1

Does that mean that tls-crypt option is NOT necessary if elliptic curve is used? or what additional security does tls-crypt add if control channel is already encrypted even without this option? and does it make any difference if one is using UDP or TCP?

Thanks!

Best Answer

  1. ECDH and DH are both variants of the Diffie-Hellman key exchange and require an abelian group with computationally complex division. However:

    • Generating good finite fields for the DH algorithm is relatively easy (though time consuming), so OpenVPN asks you to do it with openssl dhparam and provide the result with dh <filename>. This way you don't use the predefined groups that might be subject to the Logjam attack, which is within NSA budget. However, factorization in finite fields is a well understood subject, so DH is slower than ECDH with a comparable level of security.

    • Generating good elliptic curves is difficult, so you must use the predefined ones and there is no ecdh <filename> option. As for the dh option, you can use dh none with elliptic curves. Division on an elliptic curve is not very well developed, so to have a similar level of security as DH nowadays you need smaller curves.

  2. Even without the tls-auth or tls-crypt options, your data will always be encrypted. The TLS protocol encrypts data with a key obtained in a key exchange, as in the previous point. These options control what to do with the 4 packets of the TLS Handshake:

    Usually (as in the HTTPS protocol) they are unencrypted since the peers don't have any prior knowledge of each other. But with OpenVPN you have an advantage: you can configure on the server and all authorized clients a common symmetric key, which will sign or encrypt these 4 packets.

    This will allow the server to drop all not signed ClientHello messages, before even allocating resources for the computationally heavy TLS protocol. Hence, it will more easily survive a DDoS attack, where an attacker initiates thousands of connections at once.

    Using tls-auth is similar to configuring a common WEP key on a Wi-Fi network, together with a per-client WPA-Enterprise authentication. The main difference is that WEP encryption is heavily broken, whereas HMAC signatures or AES encryption isn't. Therefore you won't be able to reproduce the aforementioned configuration on a Wi-Fi network (it is not supported by software).

  3. The UDP vs TCP choice is a no brainer: use UDP whenever possible. TCP guarantees that all emitted IP packets will not be lost and will arrive in the order they were sent.

    This sounds nice, but your VPN tunnel will also transport inner TCP connections. If a packet is lost, both the OpenVPN client and the program that established the inner TCP connection will start retransmitting. However the retransmitted packets from the inner connection will arrive to their destination after those retransmitted by OpenVPN were delivered. This causes unnecessary network traffic.

Edit: A comparison between the strength of DH and ECDH is available e.g. on Keylength.com:

  • the required size of the DH group is in the column Discrete Logarithm Group,

  • the size of an elliptic curve with equivalent strength is in the column Elliptic Curve,

For example the following configuration for elliptic curves:

ecdh-curve prime256v1

is equivalent to generating DH parameters with openssl dhparam -out /etc/openvpn/dh.pem 3072 and using:

dh /etc/openvpn/dh.pem

The values provided by the NIST Recommendations correspond roughly to OpenSSL security levels. The default security level is level 1, which means a minimum of 2048 bits for the DH groups and 224 bits for elliptic curves. You can increase it using the tls-cipher option (cf. OpenSSL documentation for the format). E.g. setting:

tls-cipher DEFAULT:@SECLEVEL=4

will cause OpenVPN connections to fail, until you adjust the two settings above to the required group sizes (7680 for DH and 384 for ECDH).

Related Topic