TLS-Crypt

[windclimb]

Hello. Please add support of tls-crypt. It would be so helpful for some countries with restricted internet.

[dsommers]

This is being worked on and there have been quite some progress in this area. The new code needed will also need to go through a proper code review before we can make it public.

[Germs2004]

+1. And not just some countries, but many private businesses and organizations block OpenVPN too.

[dsommers]

There have been a considerable amount of work put into this, and it is moving forward. But we are holding back a bit as we do want to also support a newer and more advanced TLS crypt version (named tls-crypt-v2). This work is being done both in the OpenVPN 3 code base as well as the OpenVPN 2 code base. There are still a few details which needs to be ironed out for the v2, but things are definitely taking shape.

The core difference between tls-crypt-v1 and tls-crypt-v2 is that each client can get its own independent static key. The v1 approach is pretty much an encrypted variant of --tls-auth, where all clients also share the same static key. We believe independent keys can help resolve some potential issues tls-crypt-v1 have in regards to possible DoS attack vectors and some IV collision possibilities. The latter one is getting important if you have many active users. If an IV collision attack is mounted and successful, it will not cause any "bigger" issue than reducing --tls-crypt to the same level as --tls-auth. But since we can avoid this with an improved TLS crypt implementation, we want to do that first. See the OpenVPN 2 man page for more details on the security considerations regarding --tls-crypt.

[windclimb]

But 'old' tls-crypt is better than nothing. It's hard to use the Internet without tls-crypt because some countries are blocking tls-auth. And it's hard to wait for tls-crypt-v2, too.

[dsommers]

We have the needed code for that in the this core library already (commit 74c5f4f). But it will not hit any OpenVPN Connect clients until we have tls-crypt-v2 in place, as we need to ensure both v1 and v2 will work fine and behave as it will in OpenVPN v2.4 clients. And also be fully compliant against OpenVPN 2.4 servers. These things needs to take the time it takes; there is a lot of reviewing and testing required until we are fully ready to release it.

If you have urgent issues now getting to the open Internet, consider using the PrivateTunnel service which also should have some workarounds for that.

[windclimb]

Thank you very much for the new OpenVPN Connect with tls-crypt support! Can you please do the same for iOS?

[ordex]

It's planned for the next iOS release and it should happen not too far in the future. Stay tuned!

[windclimb]

iOS 11.1 just has been released. Or you are waiting for iOS 11.2?

[schwabe]

He means the iOS app release not ios release itself.

[windclimb]

Oh sorry. Thank you very much!

[windclimb]

The iOS app has been updated but tls-crypt doesn't work on it.

[ordex]

There has been no update for the iOS app yet. Not sure where you have seen it?

[windclimb]

https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8

Category: Utilities
Updated: Nov 03, 2017
Version: 1.1.1

[ordex]

Oh I see. To be honest I have no idea why it says it was updated.
v1.1.1 is exactly the same version that has been out for a year at least.
Something must have been changed internally to the AppStore and Apple has updated the date.

[windclimb]

When are you going to update it? Without tls-crypt we are dying :'-(

[ordex]

It's in the works and will be released soon. I know tls-crypt can be important, but I am interested to learning what makes it so crucial to you.

[windclimb]

It's so critical for me because of our DPI. It knows the difference between tls-auth and https, for example. It's so hard to bypass our DPI so tls-crypt is the best solution. I think you haven't ever been in the countries with the restricted Internet connection :-)

[ordex]

eheh I have and honestly tls-crypt is not a real solution for this as it will take just days before the DPI will learn about it too.
tls-crypt does not hide the OpenVPN protocol per se.

Imho you should better look into techniques aimed to provide protocol obfuscation, if that's the problem you are trying to solve.

[windclimb]

Is there any better solution for iOS? Tls-crypt is not the panacea but it can make life easier.

[ordex]

Honestly I don't know.
I know providers like PrivateTunnel use some mechanism to ensure they can pass through annoying DPIs, but can't say if that will work in your case or not.

[windclimb]

Hello. Is there any news about the new iOS app?

[dsommers]

No.

[ordex]

Hello there,
we are starting our beta program for the next iOS release of OpenVPN Connect which includes the tls-crypt feature.

Anybody willing to join the program can write an email to ios@openvpn.net mentioning "OpenVPN Connect iOS: joining beta program" in the subject. Don't forget that we need a valid Apple ID to add you to the testers group.

More details about the program will be made publicly available soon, but enrolment can already start ;)

Thanks!

[ordex]

tls-crypt is available in master and in both OpenVPN Connect clients for Android and iOS.