OpenVPN与Android 2.3.x - 安全问题 -- 2.3-gingerbread 领域 和 security 领域 和 encryption 领域 和 openvpn 领域 android 相关 的问题

I need to use my Android 2.3.x phone to access an OpenVPN server. I have CM 7 with built in support for OpenVPN and tun. My main concern is that I don't know where to put the keys in. If my phone gets in the wrong hands, I'm leaving the keys out in the open and I can't have that.

If I had an ICS phone, I'd have full file system encryption and I'd be safe(r). So is there an alternative or some technique I'm not aware of that can store the certificates and the key securely on the phone?

If you maintain the OpenVPN server, you can generate keys that require a password to be used. The technique is described at http://openvpn.net/index.php/open-source/documentation/howto.html#pki.

Scroll to the section titled Generate certificates & keys for 3 clients. You will want to use the build-key-pass script to generate a password-protected key. This will prevent your key from being used maliciously if your phone falls into the wrong hands, though I am not entirely sure if CM 7's OpenVPN implementation supports it.

If you don't have the ability to use build-key-pass to generate and register your own keys, then there is really no practical way to ensure the safety of your key without full-device encryption.

OK, I've jumped the gun here and asked a question without trying things out first. The solution is simple and very secure. First, you create a PKCS12 combo-key on the server that combines the server certificate, the client certificate and key with openssl pkcs12 -export -in android.cer -inkey android.key -certfile ca.crt -name android -out certs.p12. During that you hafta issue a decrypt password. You're perfectly safe transferring that combo-key to the SD card. Next, you import that in the Android secure storage and then you can delete the PKCS12 key.

After that, you're good to go, the keys are in a password protected vault and thus inaccessible to anyone else. It goes without saying that you need to protect your phone with a unlock password.

OK, I've jumped the gun here and asked a question without trying things out first. The solution is simple and very secure. First, you create a PKCS12 combo-key on the server that combines the server certificate, the client certificate and key with openssl pkcs12 -export -in android.cer -inkey android.key -certfile ca.crt -name android -out certs.p12. During that you hafta issue a decrypt password. You're perfectly safe transferring that combo-key to the SD card. Next, you import that in the Android secure storage and then you can delete the PKCS12 key.

After that, you're good to go, the keys are in a password protected vault and thus inaccessible to anyone else. It goes without saying that you need to protect your phone with a unlock password.