2

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't understand what stops someone with that kind of access from being able to just copy the same packets that are sent to the user during login and "clone" all the traffic sent during the VPN session. I know there's all that key exchange stuff that goes on, and while I don't understand it I still don't see why it wouldn't also be available to someone with sufficient access to the traffic.

Hopefully someone can clarify this for me.

Thanks.

Improve this question
1
  • 1
    The same situation is found in SSL/TLS communication. Similar technologies are used for both. You need to read about Diffie Hellman key exchange and public/private key encryption.
    – Neil Smithline
    Commented Feb 29, 2016 at 3:06

1 Answer 1

Reset to default
1

It depends on how your VPN organised. Genrally, Asymmetric Cryptography is used for such cases (the same is used for TLS (https://), for example)

Here are 2 examples. They are simplified heavily, just to show main idea.

  • Server may have private and public keys. One may use public key to encrypt anything, but only private key may be used to decrypt it. Example of algorythm that allows such public/private key is RSA. Server sends you public key and some random number. You encrypt this random number and your password with this key and send it back. Only server may read it since only server owns private key. Then, I connect to server. Server sends me different random number, so I can't simply reuse your packet.

  • Diffie–Hellman key exchange algorythm may be used by client and server to find some shared key. There is some math, so you may check description here: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Besides Diffie–Hellman you should also read about Rivest-Shamir-Adleman (RSA) and Digital Signature Algorithm (DSA).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .