Table of contents
- Introduction
- How to use tls-crypt-v2
Introduction
About 5 years ago, OpenVPN 2.4 introduced the new --tls-crypt option, which according to the documentation:
Encrypts (and authenticates) control channel packets:
- provides more privacy by hiding the certificate used for the TLS connection
- makes it harder to identify OpenVPN traffic as such
- provides "poor-man's" post-quantum security, against attackers who will never know the pre-shared key (i.e. no forward secrecy)
It basically added encryption on top of the older --tls-auth feature, which only authenticated control channel packets to provide some basic DoS and TLS stack protection at the application level.
According to the OpenVPN manual, the control channel is a TLS session used to exchange cipher and HMAC keys to protect the data channel, which is where your traffic actually gets encrypted.
The main problem with both --tls-auth and --tls-crypt is that every client uses the same key.
In our setup, that key has to be publicly known, since we don't have any kind of members-only section on our website where we can share that key privately. But even if we did, there's no way to tell if a client plans to use that key maliciously or not (I.e., to create a fingerprint so the traffic can be blocked by DPI firewalls, or to bypass the TLS stack protection, or to bypass the DoS protection, etc.)
That problem is solved by --tls-crypt-v2, which was introduced in OpenVPN 2.5.0
The techie specs for it are here.
In short, it's all the same benefits of --tls-crypt, except each client gets their own unique key.
In our setup, clients can regenerate this unique key whenever they want.
The page for generating a key is at https://cryptostorm.is/tlscryptv2
Just click the Refresh button on that page to get a new key, or refresh the page in your browser.
If you're connected to the VPN, you can also access the same page at http://10.31.33.7/tlscryptv2
For widget users
If you're running the latest version of the widget, it'll use tls-crypt-v2 if it sees a tcv2.key file in the folder:
C:\Program Files (x86)\Cryptostorm Client\user\
To create that file, go to https://cryptostorm.is/tlscryptv2 and copy everything between (and including):
-----BEGIN OpenVPN tls-crypt-v2 client key-----
And:
-----END OpenVPN tls-crypt-v2 client key-----
Next, open up Notepad or whichever text editor you use and paste the key.
If you're using Notepad++ in Administrator mode, you can skip the next step and just save the key directly to:
C:\Program Files (x86)\Cryptostorm Client\user\tcv2.key
Otherwise, you would save this file to your Desktop or Downloads folder, anywhere you can write to. Save it as tcv2.key
Next, navigate to whichever folder you saved it to, then copy the tcv2.key file.
Then, navigate to the folder:
C:\Program Files (x86)\Cryptostorm Client\user\
and paste the file. You should get a prompt saying you need Administrator permission to copy to this folder, just click the Continue button.
That's it, just select a server and click the Connect button to connect like you normally would.
The widget will tell OpenVPN to use tls-crypt-v2.
This works for both TCP and UDP, and on any port (1-29999), so you can change those if needed.
It also works on the Ed25519 and Ed448 instances, if you want to change that under Options 
Security TLS cipher.
It doesn't work on RSA, but the widget stopped using those instances many versions ago. If they're still available to you, then you really should upgrade to the latest widget.
For everyone else
If you're using OpenVPN GUI in Windows, or OpenVPN on Linux/Mac/Android, basically anything that isn't the Windows widget, then you'll need to edit your OpenVPN config file to use tls-crypt-v2.
Keep in mind that this will NOT work on our RSA OpenVPN configs.
But it does work on both the UDP and TCP configs, and on any port (1-29999).
So any of the configs from https://cryptostorm.is/configs/ecc/ (including ed25519 and ed448) will work.
First, go to https://cryptostorm.is/tlscryptv2 to get a new tls-crypt-v2 key.
Copy everything between (and including):
-----BEGIN OpenVPN tls-crypt-v2 client key-----
And:
-----END OpenVPN tls-crypt-v2 client key-----
Next, open up any of your ECC OpenVPN configs in a text editor and find the line:
<tls-crypt>
and remove that, and the lines after it, all the way until (and including):
</tls-crypt>
In their place, first type in the line:
<tls-crypt-v2>
Then paste in that key you copied earlier, then on a line after that, type in:
</tls-crypt-v2>
So the final result should look something like:
<tls-crypt-v2>
-----BEGIN OpenVPN tls-crypt-v2 client key----- trXi8NJ6YLGktXDTLuROqyT4CeRb7iJvjPyj78dkfXqBqTvMNBh1uDKUSTwMu/HH OmN/+BeoCJ3+yxGFN+Z/X3fsMl2kC/pdds07vBiBUEKpnRvenZd/GJ1QEv00fF2u YhQmcwbXHEFasNXNYJg/j9FQuJoSM2moCGF/THcEMVvdOyYongSKtFThtRUcWxhB WmLwAhgXdbc5LhjQgyssYdYSqMkku9CzTzpWNJyKC54E98eZEn5G1xSYtssSENW4 3kwmuzHTEfYHiZyOyXhyNFhJzWC0qzflAzxaYGFGX9NIsMq+hX0FXFHXwkbchlld CTQ4uZ9eZcGMsna/PimYzMt4Uw9xk2RxCFvlpmzX5cO9+/BxH1s5gWWmReAVBR7i 7mT5kKGToU7pt3RhACn/pVjxa6aQzuy5t6U5lgB6Us8uDNBvCcri9m+2JykOzvMz 7pJ7BoDA+GUjs6om3WTKJjgQQHKYyvG+sitas9VjD7xMvke8jOKc+qS4WuW/CD9T RXFn2ogKdTPML1hxTGnuQxUuvJXGywxmXRbbLZ+OKM1VsgoYPnM1b5Dp4tJtDYKA nhKGDHl5+HwUS263cieJYpBup5T4J350sUvTf+KWqQgayTbVxuG25WzvXGifXHY9 STAfKw1UfuOqjM/FamzWqD4oi3524+VIKIiOjsB0zVjC7rNJXJbv7TzZeyjBkr6G Yj4+MqhTJOCG3efqfGYTf+UG55NNeDvdJwEr -----END OpenVPN tls-crypt-v2 client key-----
</tls-crypt-v2>
That's it, just connect like you normally would with this OpenVPN config
(`openvpn --config whatever.ovpn`, etc.).
If you want to generate a new tls-crypt-v2 key, just repeat these steps.
For those of you on Linux (who aren't afraid of the Terminal), you could technically automate all of this so that you get a new key each time you connect. To make things easier, the page at https://cryptostorm.is/tlscryptv2 will show you just the key, without the HTML, if it sees your user agent as curl or wget.
So something like this would work:
wget -O tcv2.key https://cryptostorm.is/tlscryptv2
openvpn --config whatever.ovpn --tls-crypt-v2 tcv2.key