VPN Encryption

OpenVPN is the industry gold standard VPN protocol and we recommend you use it whenever you can. It’s the most secure and importantly is open-source, which means it’s completely transparent and continues to be been publicly tested and improved.

It’s very configurable and while it’s not supported natively by any platform, every VPN provider offers free apps that support it across most major platforms.

Importantly, OpenVPN works on both the UDP port and TCP 443 port, which is used by HTTPS traffic. This makes it tough to block as it’s hard to distinguish it from banking and e-commerce traffic using that port.

It also uses the OpenSSL library, which supports a range of ciphers.

OpenVPN encryption has two elements: data channel encryption and control channel encryption. Data channel encryption is what protects the information itself that’s been transmitted. Control channel encryption is what secures the connection between your device and the VPN server itself.

It’s important to be aware that some VPN services don’t use anywhere near the same level of encryption on both channels. Using weaker encryption on the data channel is a cheap shortcut to a faster connection as security comes at the expense of speed.

Unfortunately, a VPN is only as secure as its weakest element, so you should look for a VPN that’s as strong as possible in its encryption of both channels.

The Point-to-Point Tunneling Protocol (PPTP) is an outdated VPN protocol developed by a Microsoft-funded team for creating VPN over dial-up and bundled with Windows in 1999. It does have some positives: it’s compatible with pretty much everything, doesn’t need additional software and it’s very fast.

The major problem is that it’s proven to be insecure and is easy to crack. It’s also simple to block as it relies on the GRE protocol that’s easily firewalled.

Avoid using this protocol unless absolutely necessary to change your IP address for non-sensitive reasons.

Layer 2 Tunneling Protocol (LT2P) is a Microsoft-proprietary protocol that is typically implemented with the IPsec authentication as it doesn’t provide any encryption by itself. It’s usually used with the AES cipher.

The protocol uses a limited number of fixed ports, which makes it relatively easy to block.

In terms of speed, while its double encapsulation should make it slower than OpenVPN, it is actually theoretically faster because the encryption and decryption take place in the kernel and its supports multi-threading, which OpenVPN does not.

It has no known vulnerabilities when used with AES but there have been suggestions that it has been compromised by the NSA and was deliberately weakened during its creation.

The main problem though lies with VPN services that use pre-shared keys that can be downloaded from their websites. While these keys are only used to authenticate the connection with the VPN servers (the data itself remaining encrypted), it does open the door to potential hacks.
Despite these issues, LT2P/IPsec is a solid choice given that it’s supported natively by so many platforms as long as pre-shared keys are not used.

Secure Socket Tunneling Protocol (SSTP) is a Microsoft-owned proprietary protocol that’s based on SSL 3.0, meaning that like OpenVPN it can use TCP port 443.

Unlike OpenVPN though, SSTP is not transparent, which means it’s not possible to disprove suggestions of backdoors or other vulnerabilities. This risk far outweighs any benefits from its close integration with Windows.

Another red flag is that SSL 3.0 is vulnerable to a man-in-the-middle attack known as POODLE. It’s not confirmed whether SSTP is affected but it’s not worth the risk in our view, despite sharing benefits with OpenVPN.

Internet Key Exchange version 2 (IKEv2) is another closed standard, this time developed by Microsoft and Cisco. It’s natively supported by iOS, Windows 7 and later, and Blackberry.

There are open source versions developed for Linux, which don’t carry same the trust issues of the proprietary version.

On the plus side, it copes well with changing networks and is very good at reconnecting when users drop their internet connections making it particularly useful for mobile users.

It’s a shame that it’s closed source as IKEv2 is a very fast and secure protocol that’s particularly good for mobile users.

The Advanced Encryption Standard (AES) is a symmetric-key cipher established by the U.S. National Institute of Standards and Technology (NIST) in 2001. It’s become the gold standard in the VPN industry.

Its 128-bit block size means it can handle larger file sizes than other ciphers, such as Blowfish for example.

While AES-128 is still considered secure, AES-256 is generally preferred as it gives greater protection.

This is the default cipher used in OpenVPN (it can be configured to use other ciphers) and is typically Blowfish-128, although it theoretically ranges from 32 bits to 448 bits.

While generally secure, it does have some weaknesses that mean it really should only be used as back up to AES-256.

Camellia is very similar to AES, the main difference being that it is not certified by NIST, the US organization that created AES.

While there is an argument for using a cipher not associated with the US government, it’s rarely available in VPN software. Nor has it been as thoroughly tested as AES.