tlscrypt

Tlscrypt is a method implemented in OpenVPN to protect the TLS control channel by encrypting the TLS handshake with a pre-shared key. It aims to reduce TLS fingerprinting and make VPN traffic harder to analyze by observers.

Mechanism: A single static secret key file is shared between the server and all clients. During the TLS handshake, OpenVPN uses this key to encrypt the handshake messages. This means an eavesdropper cannot easily determine the TLS version, cipher suite, certificate, or other handshake metadata. After the handshake finishes, data transmission remains protected by the TLS session as usual.

Relation to tls-auth: tls-crypt is complementary to tls-auth. While tls-auth adds a static HMAC to the TLS handshake to help prevent certain abuse, tls-crypt encrypts the handshake control channel itself, improving privacy against fingerprinting. Because it uses a pre-shared key, it requires secure distribution and rotation like other symmetric secrets.

Configuration: The key is generated once and distributed to all server and client endpoints. In OpenVPN, the tls-crypt directive is used with the key file (often named tls-crypt.key). The same key must be available on every client and the server. It can be enabled without altering the existing TLS certificates.

Security considerations: Relying on a single static key provides no forward secrecy and creates a single point of compromise if the key is leaked. For improved security, rotate keys regularly and protect the key file.