TLSauth

TLSauth, commonly written as tls-auth, is a feature associated with OpenVPN that adds an extra layer of authentication to the TLS handshake. It relies on a static pre-shared key (the ta.key) to generate an HMAC that is applied to TLS handshake messages, helping to validate peers before the TLS handshake proceeds. The same ta.key must be loaded on both server and client sides and kept secret to prevent impersonation. The key is typically created with a command such as openvpn --genkey --secret ta.key and then distributed securely to all participating nodes.

In operation, the ta.key is used to compute an HMAC over the initial handshake packets. If the peer cannot provide the correct HMAC, the connection attempt is dropped before the TLS negotiation completes. This mechanism helps mitigate denial-of-service and certain spoofing attacks, particularly on UDP transports, by filtering out invalid handshake attempts early in the connection process. The configuration also uses a key-direction setting (often denoted 0 or 1) to specify the traffic direction to which the HMAC applies, providing an additional layer of protection against misrouted or spoofed packets.

Security considerations and relationship to other technologies: tls-auth does not itself encrypt VPN traffic or the TLS control channel; it simply authenticates the handshake. It is a complementary measure to other VPN security controls. In modern OpenVPN deployments, tls-crypt is often preferred because it both authenticates and encrypts the TLS control channel, offering stronger protection. Nevertheless, tls-auth remains a widely used option for adding handshake authentication, especially in setups that rely on pre-shared secrets.

See also: OpenVPN, TLS handshake, TLS-crypt, VPN security.