在啟用 TLS 的 OpenVPN 設定中，我想使用tls-auth.好消息是，它按預期工作。但是，我對可選key-direction參數（作為tls-auth選項的第二個參數或作為key-direction選項）有疑問。
設定參數在線上說明頁中描述如下（版本 2.3.x，相關片段）：
--tls-auth file [direction]
Add an additional layer of HMAC authentication on top of the TLS control
channel to protect against DoS attacks.
In a nutshell, --tls-auth enables a kind of "HMAC firewall" on OpenVPN's
TCP/UDP port, where TLS control channel packets bearing an incorrect HMAC
signature can be dropped immediately without response.
file (required) is a key file which can be in one of two formats:
(1) An OpenVPN static key file generated by --genkey (required if direc‐
tion parameter is used).
(2) A freeform passphrase file. In this case the HMAC key will be derived
by taking a secure hash of this file, similar to the md5sum(1) or
sha1sum(1) commands.
OpenVPN will first try format (1), and if the file fails to parse as a
static key file, format (2) will be used.
See the --secret option for more information on the optional direction
parameter.
... (snip)
--secret file [direction]
Enable Static Key encryption mode (non-TLS). Use pre-shared secret file
which was generated with --genkey.
The optional direction parameter enables the use of 4 distinct keys (HMAC-
send, cipher-encrypt, HMAC-receive, cipher-decrypt), so that each data
flow direction has a different set of HMAC and cipher keys. This has a
number of desirable security properties including eliminating certain
kinds of DoS and message replay attacks.
When the direction parameter is omitted, 2 keys are used bidirectionally,
one for HMAC and the other for encryption/decryption.
The direction parameter should always be complementary on either side of
the connection, i.e. one side should use "0" and the other should use "1",
or both sides should omit it altogether.
The direction parameter requires that file contains a 2048 bit key. While
pre-1.5 versions of OpenVPN generate 1024 bit key files, any version of
OpenVPN which supports the direction parameter, will also support 2048 bit
key file generation using the --genkey option.
... (snip)
--key-direction
Alternative way of specifying the optional direction parameter for the
--tls-auth and --secret options. Useful when using inline files (See sec‐
tion on inline files).
請注意，我沒有使用靜態金鑰加密模式，而僅顯示線上說明--secret頁片段，因為描述中建議了它--tls-auth。
我無法理解這裡的解釋。指定方向（0 表示伺服器，1 表示客戶端）時，安全性是否會提高，如果省略，安全性是否會提高？
答案1
（此答案特定於 tls-auth 金鑰的金鑰方向的使用。對於靜態金鑰模式，請總是使用鍵方向。
為每個方向使用不同金鑰的優點是，來自一個對等點的資料包永遠不會被中間人攻擊者重播回該對等點。當然是底層的 TLS 和 OpenVPN 協定應該從不接受此類資料包，但 tls-auth 的目標是提供（某些）保護，防止協定或實作中導致底層機制失敗的錯誤。