In light of recent news of NSA breaches of VPNs ...

perazim

In light of recent news of NSA breaches of VPNs, does anybody know if Openvpn is one of the VPNs that have been hacked?

Pattern_Juggled

OpenVPN relies largely on TLS - in particular, for all control channel operations.

It's known that the NSA has targeted TLS (most people call it SSL) with a massive campaign of spending over a number of years. Which likely means they've weaponized some of the mostly-hypothetical attacks on certain flavours of TLS (Lucky 13, BEAST, CRIME, and all the rest) and perhaps built entirely new ones.

So the question is: does a given setup of OpenVPN rely on TLS underpinnings that are relatively hardened/robust against NSA-level adversaries and their (assumed) attack capabilities? Which is to say: how does one deploy TLS in a secure manner, knowing what we now know?

It's possible to do it wrong, certainly. I'd say it's also possible to deploy TLS "right" so long as one forces 1.2, and some addition tweaks. But the vast majority of TLS sessions out there on the net aren't 1.2 - and I'd suspect that's the same of TLS sessions underlying OpenVPN sessions... although I have no data to back up that hunch.

Cheers,

~ pj

henning_g

Well, not to sound paranoid, but I don't trust your assessment Pattern. Relating to the following document:

http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=1&

.. and what is said therin, I'd rather go back to older underpinnings. What I gather from this article is, that the NSA is lobbying the IT industries towards promoting methods of encryption that they know they can hack. So perhaps trait but true is the way to go? Or am I perhaps thinking too simple?