PPTP is the only VPN protocol supported by some devices (for example, the Asus RT-AC66U WiFi router). If PPTP is configured to only use the most secure options, does its use present any security vulnerabilities?
The most secure configuration of PPTP is to exclusively use:
- MPPE-128 encryption (which uses RC4 encryption with a 128bit key)
- MS-CHAPv2 authentication (which uses SHA-1)
- strong passwords (minimum 128 bits of entropy)
I realize that RC4 and SHA-1 have weaknesses, but I am interested in practical impact. Are there known attacks or exploits that would succeed against a PPTP VPN with the above configuration?