Hi list, openvpn v2 now defaults to key-method 2, which means that the key exchange now takes place over the tls channel rather then encrypted with the private key of the user. As a result of this the private key of the user is no longer required. The additional security that the passphase provides is no longer there. Anyone who has a copy of the public key can now setup a session. I think this is somewhat of an integrity exposure. Is this working as designed?
Thanks, Jan Jaeger. _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com
