Why does OpenVPN use two channels and not just TLS?

Question

This question elaborates that OpenVPN uses two channels to transfer data.

It first sets up a TLS connection (called control channel) and uses that to transfer a symmetric key and some other control data. It then sets up another channel (data channel) and starts transferring the actual data encrypted using the key.

Why the second channel? Why not simple transferring all data using TLS?

score 3 · Accepted Answer · answered Nov 30 '17 at 08:13

3

There's some truth in the other answers, but the primary reason is different: because OpenVPN was designed as IP-over-UDP, while TLS runs over TCP. Futhermore, the initial versions of OpenVPN did not have key exchange at all, but already had their own (better designed than TLS) data channel protocol. So when TLS was added, it made sense to stick to that for the data channel.

(Nowadays there's DTLS that runs over UDP, but that didn't exist when the OpenVPN protocol was created.)

answered Nov 30 '17 at 08:13

Steffan Karger

395
2
4

That's what I thought that it is a legacy thing. Thank you – tsusanka Nov 30 '17 at 10:44
1

Not just legacy, also because the openvpn data channel is optimized for openvpn's needs. – Steffan Karger Nov 30 '17 at 10:51
1

This is a much better answer than mine. I did not know OpenVPN came before DTLS! – forest Dec 01 '17 at 05:05

score 2 · Answer 2 · answered Nov 28 '17 at 11:33

OpenVPN is not designed only for one type of key exchange. There are multiple types of key exchange supported by OpenVPN. Rather than creating a new protocol for every single type, the developers use a single protocol, the data channel, and allows different features to provide the key using their own protocols, such as TLS. Additionally, this allows features such as --tls-auth to be used to provide security features which plain TLS does not provide (in this case, authentication before TLS even comes into play, as a second line of defense).

The OpenVPN documentation explains the two default types of key exchange, static keys and TLS.

Hm, I understand. Is it actually common to use other protocols to provide the key? It seems as a little bit as a theoretical option — tsusanka, Nov 28 '17 at 12:00

Why does OpenVPN use two channels and not just TLS?

2 Answers2