0

Do we know exactly whether and for which parts of the packet confidentiality and integrity properties are guaranteed using SSTP VPN? Specifically confidentiality is enforced on the header of the original packet? Integrity is enforced on the header of the original packet? Is integrity enforced on the header of the encapsulating packet? Or since it is a windows protocol we simply do not have access to this type of information?

1

1 Answer 1

1

To cite from the public available protocol specification:

The following encapsulation operations occur on the client:

  • Application packets are encapsulated over any transport protocol (for example, TCP and UDP).
  • Transport layer packets are encapsulated over a network protocol (for example, IP).
  • Network layer packets are encapsulated over a PPP data-link layer.
  • PPP packets are encapsulated over SSTP.
  • SSTP Packets are encapsulated over SSL/TLS.
  • SSL/TLS records are encapsulated over TCP.
  • TCP packets are encapsulated over IP.
  • IP packets are sent over any data-link layer (such as Ethernet or PPP). For more information about PPP, see [RFC1661].

Thus it is basically an inner IP tunnel with some non-encrypting encapsulation (PPP, SSTP) which then is transferred using TLS. Thus all of IP and above (TCP, application protocols, application payloads) are protected against sniffing and modification using TLS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .