VPN client feature request for upcoming versions of software

OpenVPNOpenVPN
in Feedback
Of course as stated before in the feedback portion of the forum which can be found here: https://www.privateinternetaccess.com/forum/discussion/21479/add-more-encryption-options-to-the-advanced-settings

I would like to see more Advanced encryption options included in the advanced settings, as technology gets more advanced we need to combat that increasingly change with more advanced encryption algorithms. Of course there's evidence that shows that AES can't even be cracked by the NSA in real time but computers are getting faster and more powerful. https://nadim.computer/2015/02/01/nsa-aes.html  We have no idea when they are you going to gain the technical capability to break AES whether it be tomorrow for 10 years into the future. I believe private Internet access needs to stay ahead of the game and add more encryption options that are Non-NIST based. Getting ahead of the game now will prevent them from having to do so in the future.
 
I would also like the user to have the ability to send data traffic through two VPN servers instead of one, This process is called double hopping and I believe this can help people remain more secure and private online. Sure this feature will slow down your connection speed but I think it would be worth it for the extra security that it would provide.

Thanks!

Comments

  • OmniNegroOmniNegro
    The NSA cannot crack 128 bit encryption of any usable sort. AES is actually weaker as a cipher than Blowfish, because the main design choice for AES was for it to be usable on limited mobile devices.

    But you can use 256 bit AES. If it is ever possible to crack it, that will be so far into the future that the Earth will not even be a distant memory of the galaxy. For 128 bit AES, the complexity is enough that a few years ago, it would take every computer ever made working together a billion, billion years to manage to crack one key. And remember that with anything binary, adding one single bit doubles the possible combinations, so 256 is not twice as much work, it is a number so large I cannot type it here without exceeding the message length.

    And the energy cost to brute force a key would be more than all energy present in the entire Solar system, even if you could convert all matter into energy with zero loss by some magical means.

    Some people likely think I am spewing bullshit. Please look into it.
    http://www.eetimes.com/document.asp?doc_id=1279619

    If your entire Internet history was recorded, and all computers were a million times more potent than they are, it would still not be possible to crack more than a few keys in your lifetime, and the key changes every single hour per Diffee Hellman Key Exchanges.

    So I think you can relax a whole lot. You are quite free to think otherwise though. Good day.
  • OpenVPNOpenVPN
    OmniNegro said:
    The NSA cannot crack 128 bit encryption of any usable sort. AES is actually weaker as a cipher than Blowfish, because the main design choice for AES was for it to be usable on limited mobile devices.

    But you can use 256 bit AES. If it is ever possible to crack it, that will be so far into the future that the Earth will not even be a distant memory of the galaxy. For 128 bit AES, the complexity is enough that a few years ago, it would take every computer ever made working together a billion, billion years to manage to crack one key. And remember that with anything binary, adding one single bit doubles the possible combinations, so 256 is not twice as much work, it is a number so large I cannot type it here without exceeding the message length.

    And the energy cost to brute force a key would be more than all energy present in the entire Solar system, even if you could convert all matter into energy with zero loss by some magical means.

    Some people likely think I am spewing bullshit. Please look into it.
    http://www.eetimes.com/document.asp?doc_id=1279619

    If your entire Internet history was recorded, and all computers were a million times more potent than they are, it would still not be possible to crack more than a few keys in your lifetime, and the key changes every single hour per Diffee Hellman Key Exchanges.

    So I think you can relax a whole lot. You are quite free to think otherwise though. Good day.
    Yes I am very aware that this article exists, I read it when they first upgraded their encryption. Computing technology is ever advancing and someday whether it be an intelligent agency or university someone Will be successful in building a quantum computer I suspect maybe next 10 to 12 years. If the government could crack AES encryption nothing is safe, That's why I believe Banks and other big businesses should go ahead and make the move to Non-NIST encryption to prepare for any future computing advancement. Camellia Is a new algorithm that was created in 2000, I believe that adapting to this algorithm with all key sizes will prepare private Internet access for the unforeseeable future.
  • OmniNegroOmniNegro
    Quantum computers can at best reduce the options by half. But even half the complexity is a billion years of work or more for a single key. And so far, no one has actually made a working quantum computer. I think we will invent time machines first. (Meaning I do not think it will ever happen.)

    I like Camellia. But why not use it with Tiger hashing if you wanted to go down that route?

    The thing to remember about encryption is that if you take for instance AES and change any single part of the output in a predictable way, then no-one looking for AES would be able to decrypt it even with the correct password.

    You do not need absolutely perfect encryption, you only need something that is not so common.

    AES is a big target. And as such, it is the most likely to be successfully attacked. But so far no one has ever managed to find a real weakness in it.
  • OpenVPNOpenVPN
    OmniNegro said:
    Quantum computers can at best reduce the options by half. But even half the complexity is a billion years of work or more for a single key. And so far, no one has actually made a working quantum computer. I think we will invent time machines first. (Meaning I do not think it will ever happen.)

    I like Camellia. But why not use it with Tiger hashing if you wanted to go down that route?

    The thing to remember about encryption is that if you take for instance AES and change any single part of the output in a predictable way, then no-one looking for AES would be able to decrypt it even with the correct password.

    You do not need absolutely perfect encryption, you only need something that is not so common.

    AES is a big target. And as such, it is the most likely to be successfully attacked. But so far no one has ever managed to find a real weakness in it.
    Tiger is a strong cryptographic hash function, I actually considered it when writing my first post but it only has a maximum strength of 160. I would rather go with the cryptographic hash function whirlpool it was also created in 2000 and has stood strong and true against cryptographic analysis from cryptographers from all over the world. If OpenVPN supported it I would also suggest adding Serpent with key sizes (128-bit, 192-bit, 256-bit) but as of now OpenVPN does not support Serpent although I hope they will consider adding support for Serpent in the future. In some cases Serpent is stronger than AES and has had more crypto analysis then AES.

    If Private Internet Access would add Serpent, Tiger, and Whirlpool to the encryption cyber suite in the advanced settings, I believe that it will put them above and beyond the competition for years to come. The NSA is currently developing a quantum computer and they believed they will have it ready within 10 to 12 years.




    Yes Tiger is an older hash cryptographic cipher, but as far as we know there are no weaknesses in it as of yet. Why wait to upgrade the encryption algorithms when you can update them now and save you the trouble of having to do it later when we discover that one or more of the encryption algorithms in use today have been broken? I am an online security advocate, I believe that everything we do should be encrypted regardless of if we are doing anything wrong or not. Encryption is everything in society today, People use encryption every single day and don't even know it and of course I believe that the ability to choose your own encryption is a must for all virtual private network providers.

    I believe they should add those secure ciphers that way they will be ready for the unforeseeable future that is yet to come because the threats of the Internet are not going to get better they're going to get worse. We need to do everything we possibly can to make sure that we are secure for the future.

    The only way we can have privacy is through an encryption.

    https://en.wikipedia.org/wiki/Serpent_(cipher)
    https://en.wikipedia.org/wiki/Tiger_(cryptography)
    https://en.wikipedia.org/wiki/Whirlpool_(cryptography)
    https://en.wikipedia.org/wiki/Camellia_(cipher)

    Those ciphers would be a great addition to the Private Internet Access Cipher Suite. I've been with private Internet access for almost 4 years now and The one thing I love about their service is the approach to privacy and security.

    Privacy is one of our fundamental rights and privacy is for everyone. Privacy is not negotiable it is a basic human right.




    Virtual private networks are essential to our online security, Without encryption nothing would be safe.

  • OmniNegroOmniNegro
    edited May 2016
    I do not buy the nonsense spread by the NSA. Until someone can demonstrate not only a quantum computer, but also demonstrate that it does what it is proposed to do. And if one is ever made, then I expect normal PCs will be phased out in favor of using quantum PCs. And at that point, all ciphers we rely on will have to be redesigned for the quantum processor.

    But back to something other than fiction. Serpent is a great algorithm. It did not focus on reducing the overhead on the system like AES. Instead it focused on making it as secure as possible.

    Another more simplified way to look at it is that while AES 128, 192, and 256 respectively use 10, 12, or 14 rounds to complete, Serpent at the same bit depths uses 32 rounds. (Yes, 32 regardless of the bit depth.) So Serpent is a hell of a lot more work to attempt to break by any means, and if a quantum computer were to suddenly appear, it would at best leave 16 rounds of Serpent whereas AES would have either 5, 6, or 7 rounds to break.

    But since Tiger and Serpent were made by the same team, I would think they would be a natural fit for one another. I suspect it would be impossible to make a 320 bit version of Tiger, but why would we need that to authenticate a packet is correct and has not been tampered with? (We already use SHA-160 or SHA2-256, along with HMAC to form a hash of no less than 512 bits for each and every packet.)

    And just because I can, allow me to correct the links to the Wikipedia articles for you. Here they are in the order you had, along with several more. Threefish is of particular interest to me. 256, 512, and 1024 bits. 512 and 1024 are overkill to an extreme, but if a QC ever exists, they will make it work for a place in this world.
    Serpent
    Tiger
    Whirlpool
    Camellia
    AES
    HMAC
    Threefish
    Skein

    *Edit* Shame on me for forgetting Skein.
Sign In or Register to comment.