Hi, On 15/12/16 16:53, Sebastian Rubenstein wrote: > Hi, > > There are many criteria to judge if a VPN provider is good, reliable, > trustworthy, etc.. and in this thread I am focusing on just the technical > criteria. And thanks to Steffan for helping me to understand better what they > are to be considered. > > In addition to the ones listed below, what other keywords should I look for > in config files and client-side log of when my machine is connecting to the > VPN server? > > 1. tls-client (for Perfect Forward Secrecy) > > 2. remote-cert-tls server > > 3. cipher AES-256-CBC > > 4. auth SHA512 or auth SHA256 > > 5. tls-auth > > 6. key-directing 1 > > 7. Private key is at least RSA-4096 > > options 1 and 2 are normally always set - 'client' implies 'tls-client' - you can add 'remote-cert-tls server' yourself and if your VPN does not come up (i.e. the server fails this test) then I'd *not* trust the server or the VPN provider - cipher+auth = AES-256 + SHA256 is nice but other options can also be valid - tls-auth + key-direction is nice but it adds a false sense of security: as discussed earlier, tls-auth is based on a pre-shared secret amongst *ALL* VPN clients - this means that anybody that subscribed to that particular VPN provider at some point the past probably has that tls-auth key file. You can also bet that security services (FBI, NSA etc) will have that tls-auth key already. The only extra benefit of having the tls-auth file is that it prevents some DDoS flooding attacks, mostly against the *server*. - a private key size of 4096 does not mean anything. What is more important is that the CA certificate used to sign the client and server certs is 4096 bits (or EC based) and that the remaining certs (intermediate, server, client) are at least 2048 bit in strength; Increasing the strenght beyond that is useless for now (RSA 2048 has not been broken yet) and it will only slow things down.
JM2CW, JJK ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
