VPN Protocols Compared Notes

This is an exhaustive source list/ citations for our VPN Protocols Compared article. If you have the time, feel free to browse around and learn about the various security features each protocol implements. Also, if you find a mistake, please do not hesitate to contact us.

Notes

1. Slowfruit.net
   
   • Implementations: OpenVPN (OpenVPN Project), OpenSSH (OpenBSD Project), L2TP/IPSec (xl2tpd + Libreswan), SSTP (Microsoft), SoftEther (Daiyuu Nobori, et al.), ScrambleSuit (Philipp Winter, et al., Tor Project), PPTP (Microsoft)
   • Protocol Support: Y = Supported, F = Planned (S1 = Stage 1, S2 = Stage 2), ? = Not Planned
2. OpenVPN / OpenVPN xor (OpenVPN Project, haggismn, clayface)
   • Client OS Support: OpenVPN client software required for all systems except Chrome OS., openvpn_xorpatch supports up to OpenVPN v2.3.4 by clayface, Patch: Fix for Iran and China users
   • Encryption Libraries: http://openvpn.net/index.php/open-source/333-what-is-openvpn.html, https://community.openvpn.net/openvpn/wiki/UsingPolarSSL
   • Ciphers: Output of openvpn --show-ciphers
   • Authentication Methods: Using alternative authentication methods
   • Security/ Trust: Known security vulnerabilities (2004-12-08), OpenVPN Security Overview
3. L2TP/IPSec (xl2tpd + Libreswan)
   • Client OS Support: All (except Linux) natively supported! Linux requires client software. (e.g. l2tp-ipsec-vpn)
   • Encryption Libraries: http://msdn.microsoft.com/en-us/library/aa380256.aspx
   • Ciphers: Supported algorithms and ciphers with libreswan
   • Authentication Methods: Which IKE Exchange Modules does libreswan support?
   • Security/ Trust: General IPSec RFC Reference
4. SSTP (Microsoft)
   • Client OS Support: Native on Windows 7+, Linux/ OS X users: sstp-client
   • Ciphers, Authentication Methods: Different VPN tunnel types in Windows, How SSTP based VPN connection works
   • Encryption Libraries: http://msdn.microsoft.com/en-us/library/aa380256.aspx
   • Security/ Trust: ?
5. SoftEther (Daiyuu Nobori, et al.)
   • Client OS Support: Requires installation of SoftEther client software
   • Ciphers, Encryption Libraries: Security and Reliability
   • Authentication Methods: User Authentication
   • Security/ Trust: ?
6. OpenSSH (OpenBSD Project)
   • Client OS Support: OS X and Linux support it natively. Other operating systems require client software: How to Tunnel Traffic
   • Encryption Libraries, Ciphers, Authentication Methods, Security/Trust: http://www.openssh.com/features.html, http://www.openssh.com/security.html, http://www.openbsd.org/crypto.html
7. ScrambleSuit
   • Client OS Support: ScrambleSuit's Python client is now bundled with the Tor Project's obfsproxy
   • Encryption Libraries: (see obfsproxy sourcecode)
   • Ciphers, Authentication Methods: ScrambleSuit: A Polymorphic Network Protocol to Circumvent Censorship (pdf) (Design Document)
   • Security/ Trust: ?
8. PPTP (Microsoft)
   • Client OS Support: Supported natively by Windows (95 to Windows 8), Android, iOS, OSX. Linux requires client software. Chrome OS does not support PPTP. http://technet.microsoft.com/en-us/library/cc783910%28v=WS.10%29.aspx
   • Encryption Libraries: http://msdn.microsoft.com/en-us/library/aa380256.aspx
   • Ciphers, Authentication Methods: http://technet.microsoft.com/en-us/library/cc958061.aspx
   • Security/ Trust: https://www.schneier.com/pptp.html, http://www.computerworld.com/article/2505117/, https://www.sans.org/security-resources/malwarefaq/pptp-vpn.php
9. As in the Great Firewall of China. See: http://lowendtalk.com/discussion/comment/471769/
10. Ciphers
    • RC4 (aka arcfour, ARC4): http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html, http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2868725-recommendation-to-disable-rc4.aspx
    • AES: https://dl.acm.org/citation.cfm?id=2149844, https://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html, https://www.schneier.com/blog/archives/2009/07/another_new_aes.html, http://eprint.iacr.org/2009/531, http://eprint.iacr.org/2010/337.pdf, http://research.microsoft.com/en-us/projects/cryptanalysis/aes.aspx
    • DES (aka 1DES): https://w2.eff.org/Privacy/Crypto/Crypto_misc/DESCracker/HTML/19980716_eff_des_faq.html
    • 3DES (aka Triple DES. TDEA): https://www.youtube.com/watch?v=lwOGcY3hEv4
    • Blowfish: http://cs.columbusstate.edu/cae-ia/StudentPapers/Y2010_TheFall/StudentPapers_CPSC6126/PaperGonzalezTom.pdf, http://www.iacr.org/archive/fse2007/45930168/45930168.pdf, https://www.schneier.com/blowfish.html