I\'m not clearly understand technologies behind OpenVPN, so I have a question ab

Question

I'm not clearly understand technologies behind OpenVPN, so I have a question about OpenVPN security:

What if I have client.p12 (PKCS#12) file and this file was leaked (with export password) to some evil person. Additionally this person can dump my encrypted VPN traffic (which was secured with leaked client.p12 file).

Does this means that dumps of my traffic can be decrypted or hacked with MITM?

Or it's not possible due the fact that server key wasn't compromised and this evil person can only authorize on server as me?

Explanation / Answer

OpenVPN relies on SSL/TLS for establishing the session secret values, with certificates on both client and server (this is documented here). To do a successful Man-in-the-Middle attack, the attacker must impersonate both the client and the server: the attacker must pose as a fake client, when talking to the server, and as a fake server, when talking to the client.

If the attacker stole the client private key, then he can impersonate the client, but this does not give him the power to impersonate the server.

Moreover, since the client-side key in SSL/TLS is used only for a signature, but is not used to actually impact the generation of the secret key used thereafter to encrypt the data, knowing the client private key does not give to the attacker the power to decrypt exchanges between the client and the server (the same would not necessarily be true if the attacker had stolen the server's private key, not the client's -- depending on whether the SSL/TLS layer negotiates a "DHE" or a "plain RSA" cipher suite).

Summary: to the best of our current knowledge (and assuming that OpenVPN's protocol, beyond SSL, is not weak in some way), an attacker who stole the private key (.p12 file with password) of a client can only impersonate that client, but not run a full MitM, or impersonate the server, or eavesdrop on exchanges between the client and the server.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.