For this recipe, we use the secret.key file from the previous recipe. Install OpenVPN 2.0 or higher on two computers. Make sure that the computers are connected over a network. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Windows XP SP3 and OpenVPN 2.1.1.

On the client side, we will find the same keys but the 'Encrypt' and 'Decrypt' keys have been reversed:

… Static Encrypt: 
Cipher 'BF-CBC' initialized with 128 bit key
… Static Encrypt: 
CIPHER KEY: 8cf9abdd 371392b1 14b51523 25302c99
… Static Encrypt: 
Using 160 bit message hash 'SHA1' for HMAC authentication
… Static Encrypt: 
HMAC KEY: 39e06d8e 20c0d3c6 0f63b3e7 d94f35af bd744b27
… Static Decrypt: 
Cipher 'BF-CBC' initialized with 128 bit key
… Static Decrypt: 
CIPHER KEY: 80797ddc 547fbdef 79eb353f 2a1f3d1f
… Static Decrypt: 
Using 160 bit message hash 'SHA1' for HMAC authentication
… Static Decrypt: 
HMAC KEY: c752f254 cc4ac230 83bd8daf 6141e73d 844764d8

If you look at the keys carefully, you can see that each one of them is mirrored on the client and the server side.

OpenVPN derives all keys from the static.key file, provided that there is enough entropy (randomness) in the file to reliably generate four keys. All keys generated using the following will have enough entropy:

$ openvpn –-genkey –-secret secret.key

An OpenVPN static key file is 2048 bits in size. The Cipher keys are each 128 bits, whereas the HMAC keys are 160 bits each, for a total of 776 bits. This allows OpenVPN to easily generate four random keys from the static key file, even if a cipher is chosen that requires a larger initialization key.

The same secret key files are used in a client/server setup when the following parameter is used: tls-auth ta.key.