Return to Answer

• Static keys - Normally, OpenVPN establishes a TLS connection with the remote server to exchange temporary session keys which are then used to encrypt the VPN protocol. This key exchange gives away that OpenVPN is being used. Static keys are pre-shared keys that are stored on both the client and server. If they are delivered securely to both sides, then that key can be used directly to encrypt the VPN traffic without any key exchange. Unfortunately, static keys necessarily mean you will lose the cryptographic property of forward secrecy.

• Obfsproxy - Developed by the Tor Project, obfsproxy is a type of pluggable transport that transparently obfuscates traffic using a variety of methods. It is designed specifically to make it difficult to identify the protocol being used in order to hamper automatic blocking. While originally designed specifically for Tor, obfsproxy can be used with OpenVPN.

• Static keys - Normally, OpenVPN establishes a TLS connection with the remote server to exchange temporary session keys which are then used to encrypt the VPN protocol. This key exchange gives away that OpenVPN is being used. Static keys are pre-shared keys that are stored on both the client and server. If they are delivered securely to both sides, then that key can be used directly to encrypt the VPN traffic without any key exchange. To use static keys without losing forward secrecy, you have to enable tls-crypt.

• Obfsproxy - Developed by the Tor Project, obfsproxy is a type of pluggable transport that transparently obfuscates traffic using a variety of methods. It is designed specifically to make it difficult to identify the protocol being used in order to hamper automatic blocking. While originally designed specifically for Tor, obfsproxy can be used with OpenVPN.

The OpenVPN protocol makes no attempt to hide its presence. The protocol itself is briefly described at the end of the documentation. Note that, even if you manage to obfuscate the protocol itself, it is possible for your ISP to determine that you are using a VPN using traffic fingerprinting. Not to mention, the fact that you are using some sort of tunnel can be inferred from the behavior of only connecting with an encrypted protocol to a single IP address for all of your internet activity.

The OpenVPN protocol makes no attempt to hide its presence. The protocol itself is briefly described at the end of the documentation. Note that, even if you manage to obfuscate the protocol itself, it is possible for your ISP to determine that you are using a VPN using traffic fingerprinting. Not to mention, the fact that you are using some sort of tunnel can be inferred from the behavior of only connecting with an encrypted protocol to a single IP address for all of your internet activity.

##Traffic obfuscation

##Threat modeling

Traffic obfuscation

Threat modeling