在我的 TLS 启用 OpenVPN 配置中，我想使用 提供的额外安全性tls-auth。好消息是，它按预期工作。但是，我对可选key-direction参数（作为选项的第二个参数tls-auth或作为key-direction选项）有疑问。
配置参数在手册页中的描述如下（版本 2.3.x，相关片段）：
--tls-auth file [direction]
Add an additional layer of HMAC authentication on top of the TLS control
channel to protect against DoS attacks.
In a nutshell, --tls-auth enables a kind of "HMAC firewall" on OpenVPN's
TCP/UDP port, where TLS control channel packets bearing an incorrect HMAC
signature can be dropped immediately without response.
file (required) is a key file which can be in one of two formats:
(1) An OpenVPN static key file generated by --genkey (required if direc‐
tion parameter is used).
(2) A freeform passphrase file. In this case the HMAC key will be derived
by taking a secure hash of this file, similar to the md5sum(1) or
sha1sum(1) commands.
OpenVPN will first try format (1), and if the file fails to parse as a
static key file, format (2) will be used.
See the --secret option for more information on the optional direction
parameter.
... (snip)
--secret file [direction]
Enable Static Key encryption mode (non-TLS). Use pre-shared secret file
which was generated with --genkey.
The optional direction parameter enables the use of 4 distinct keys (HMAC-
send, cipher-encrypt, HMAC-receive, cipher-decrypt), so that each data
flow direction has a different set of HMAC and cipher keys. This has a
number of desirable security properties including eliminating certain
kinds of DoS and message replay attacks.
When the direction parameter is omitted, 2 keys are used bidirectionally,
one for HMAC and the other for encryption/decryption.
The direction parameter should always be complementary on either side of
the connection, i.e. one side should use "0" and the other should use "1",
or both sides should omit it altogether.
The direction parameter requires that file contains a 2048 bit key. While
pre-1.5 versions of OpenVPN generate 1024 bit key files, any version of
OpenVPN which supports the direction parameter, will also support 2048 bit
key file generation using the --genkey option.
... (snip)
--key-direction
Alternative way of specifying the optional direction parameter for the
--tls-auth and --secret options. Useful when using inline files (See sec‐
tion on inline files).
请注意，我没有使用静态密钥加密模式，而只是显示--secret手册页片段，因为它是--tls-auth描述所建议的。
我不明白这里的解释。指定方向（0 表示服务器，1 表示客户端）是否会提高安全性，或者如果省略，安全性是否会提高？
答案1
（此答案特定于 tls-auth 密钥的 key-direction 的使用。对于静态密钥模式，请总是使用键方向。
在每个方向上使用不同的密钥的优点是，来自一个对等点的数据包永远不会被中间人攻击者重放回该对等点。当然，底层的 TLS 和 OpenVPN 协议应该永远不会接受这样的数据包，但 tls-auth 的目标是提供（一些）保护，防止协议或实现中的错误导致底层机制失败。