A Behind-The-Scenes Look At Underlying VPN TechnologyMay 9, 2018
We know that VPNs protect our confidential data when browsing the internet and connecting to unfamiliar services, but how do they accomplish this? What is the underlying technology that makes it all work? In this post we’ll examine the SSL and TLS protocols, as well as summarize how encryption bit strength helps improve VPN security.
Secure Sockets Layer (SSL)
SSL was the internet’s first foray into encrypted communication channels. Introduced by Netscape in February of 1995, SSL 2.0 was a good first effort at protecting users while online. (SSL 1.0 contained so many security flaws that it was never actually publicly released.) However, less than a year later, SSL 3.0 came on the scene in 1996 and remained in use all the way through 2014 when it was discovered that SSL 3.0 was susceptible to the infamous POODLE attack. This attack was effective at cracking all block ciphers used in SSL, and as a result of this serious vulnerability, SSL 3.0 was formally prohibited from use in June 2015 by RFC publication 7568. SSL 3.0 was used by VPN providers who valued profits over security, as it was very easy to maintain SSL rather than overhauling their infrastructure to implement TLS.
Transport Layer Security (TLS)
Introduced in January of 1999, TLS 1.0 was advertised as an upgrade from SSL 3.0, and indeed, had a noticeable advantage over SSL. TLS 1.0 included an option to downgrade a connection to SSL 3.0 for legacy devices. Even though it’s almost two decades old, TLS 1.0 is still in widespread use today, though it has seen two significant revisions in versions 1.2 and 1.3. Due to several vulnerabilities that have been discovered, the PCI Council recommends that all users and organizations migrate away from TLS 1.0 by June 30th of this year.
TLS 1.1 was defined by RFC 4346 in April of 2006, and offers marked benefits over version 1.0. Adding protection against cipher-block chaining attacks as well as changes to initialization vectors and the handling of padding errors, TLS 1.1 is a strong substitute for version 1.0, though is outdone by the current version 1.2.
TLS 1.2 is the current standard for secure online communication, and should be used by default unless significant reason exists to use an older version. The biggest improvements in version 1.2 are found in the encryption suite and algorithms used by the protocol, along with completely disabling compatibility with SSL protocols.
TLS 1.3 is an emerging protocol that is not publicly available at the time of this writing. Recently introduced in March of this year, version 1.3 removes support for weak encryption algorithms and integrates the use of a session hash for every communication, among many other improvements.
How Bit Strength Affects Encryption
You may have heard of 64, 128, 256, and even 512-bit encryption protocols that can be used in a VPN and other communication tools. The number of bits in an encryption protocol refers to the length of the key that is used to encrypt data. As the encryption key is the heart of any secure communication, it’s vitally important to prevent this key from being discovered. Similar to guessing a password, it’s much easier to crack a shorter encryption key than a long one. The bit value in an encryption algorithm refers to the length of the encryption key, meaning that a 128-bit algorithm will use a key that is 128 bits long, and so on. By increasing the length of the encryption key, higher bit values dramatically increase the difficulty of cracking the key, thus ensuring that your communication remains secure. At a minimum, your VPN provider should offer 128-bit encryption, with 256-bit or higher being preferable.
VPNs use a combination of technologies to keep your browsing data safe, but encryption is the most important piece. Knowing how encryption works, and the differences between the many types of algorithms available, will help you make an informed decision about the security tools you use.