Hello,
thank you for clarification, however I would like to point out the
--key-direction is not only used with --tls-auth but also with --secret
option.
On 11 October 2017 at 18:29, David Sommerseth <
[email protected]> wrote:
> On 11/10/17 10:05, Yevgeny Kosarzhevsky wrote:
> > Hello,
> >
> > what is going to replace key-direction in future versions?
> > Or will use use direction 2 by default without any alternatives?
> >
> --key-direction is not on the list of deprecated features [1].
>
> That said, only --tls-auth uses that option, but the --key-direction can
> also be provided via the --tls-auth as well.
>
> The --tls-crypt option will handle the --key-direction automatically and
> does not depend on that at all.
>
> [1] <https://community.openvpn.net/openvpn/wiki/DeprecatedOptions>
>
>
> On the other hand, *--key-method* is deprecated and will be removed.
> This feature is not providing any advantage at all, and was basically
> added around the time OpenVPN 2.0 arrived (maybe even older?), to
> support the very first versions of OpenVPN. Since we do not support any
> OpenVPN version older than v2.3 (v2.2 and v2.1 may occasionally get some
> security backports to the git tree, but no official releases are made),
> this option provides no useful feature - in fact, it can in many aspects
> weaken the tunnel security by using --key-method 1. The default unless
> --key-method is provided is 2. And it will stay like that for the
> foreseeable future. If that needs to be improved later on, we will most
> likely try to negotiate that automatically and not depend on a
> configuration option.
>
> If you (or anyone else, for that matter) are using --key-method 1 today,
> get rid of it NOW. Don't wait. You should not use the --key-method
> option at all.
>
>
> --
> kind regards,
>
> David Sommerseth
> OpenVPN, Inc
>
>
>
--
Regards,
Yevgeny
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
