Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test.

It gives you the option of OpenVPN and provides a guide for Ubuntu.

Part of the guide involves downloading a certificate and its private key. You download it over SSL but the certificate isn't unique to you the user. Anybody can go to that page and download both halves of the key.

This question really comes from not understanding how OpenVPN uses TLS but...
How is the connection secure if a malicious party knows the encryption details and keys?

(Can somebody add the openvpn tag to this? That seems like it should be a valid tag here.)

share|improve this question

I've just been talking with the IPredator guys on IRC and it's quite interesting. I've made some incorrect assumptions.

As part of the installation process you add their CA. That's fair enough. So the whole connection happens through RSA (or similar) public-key encryption.

The key-pair is just an additional TLS encryption layer for authentication. They freely admit it offers no additional security for users but it does mean that anybody trying to connect needs that pair of keys. Requiring them has meant a sharp drop in connection-style DDoSes.

So it is still secure. The key-pair is just some additional security-through-obscurity.

share|improve this answer

The TA keyfile from the guide is a static key used to authenticate all traffic between the VPN server and the client. This allows either party to discard all traffic not authenticated by that specific key.

On top of that, each session will use an exchanged session key (through Diffie-Hellman or similar methods) to encrypt to traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.