Freedome VPN encryption

Hi,

 

just wanted to ask which cipher suite is used for the encryption of the VPN.

 

Best regards,

Cryptoman

Best Answer

  • PaiviPaivi Posts: 80
    Accepted Answer

    An update: This response concerns our Freedome clients for Android only.

     

    Hello,

     

    I'm sorry for the delay with our response. It has just been a busy week with some sick leaves, no intention to hide the information.

     

    Control channel: TLS, 2048 bit RSA auth, typically AES256+SHA1 HMAC but depends on client capabilities
    Data channel: Blowfish with 128-bit key + SHA1 HMAC

     

    For data channel we're about to switch to AES-128 instead of Blowfish.

     

    Best regards,

    Päivi, Freedome product manager

Answers

  • CryptomanCryptoman Posts: 7

    Hi again,

     

    I noticed that the User psillanp has asked some questions a few days ago which have still not been answered yet (technical specs).

     

    Is the information about the used cipher suite in Freedome really that mega-classified and ultra-top-secret?!

     

    I believe that users would feel much more comfortable with Freedome if you would reveal at least the used cipher suite (as there are a lot of weak cipher suites available, e.g. RC4)...

     

    Cheers,

    Cryptoman

  • NikKNikK Posts: 931

    I'm curious too and I've searched Knowledge Base and everywhere else without luck. My guess is because Freedome is quite a new product everything isn't updated in the KB (yet).

     

    As a comparison they have a detailed description in the KB of the encryption for the Password Manager "F-Secure Key", so I don't think they intend to keep it a secret:

    http://community.f-secure.com/t5/F-Secure-Key-KB/F-Secure-Key-data-encryption-in/ta-p/36851

    mahdiameri
  • CryptomanCryptoman Posts: 7

    Come on, no official info from the F-Secure staff?

  • CryptomanCryptoman Posts: 7

    Thank you for your response, Paivi Smiley Happy

     

    Is there a plan when AES-128 will exactly be ready for the data channel?

  • PaiviPaivi Posts: 80

    We're getting ready for the migration, support for AES is already deployed on our gateways. Migration likely happens in June.

  • CryptomanCryptoman Posts: 7

    Hi Paivi,

     

    just wanted to ask if the migration from Blowfish to AES for the data channel has been completed.

     

    Best regards,

    Cryptoman

  • HessuHHessuH Posts: 24

    @Cryptoman wrote:

     

    just wanted to ask if the migration from Blowfish to AES for the data channel has been completed.

     

    New gateway sites deployed recently (Canada, Spain, Netherlands, Italy) already use AES for data encryption from the beginning. We'll also have a new US East Coast site set up soon, with the new VPN parameters.

     

    We're still waiting for a bit more of the old Android clients to get upgraded to support a smooth transition to the new crypto settings on the existing older sites. We found an issue where the client did not figure out the new settings quickly enough on a site which switched VPN parameters, and was left in an unhappy state for quite a while. An updated Android client has already been released a while back, but it takes time before a good percentage of users have upgraded.

     

    Clients which are able to use UDP for the VPN connection are easy, since we support old and new parameter sets on different UDP ports to support the old clients through a transition period, but many clients behind various firewalls are only able to make a VPN connection on TCP port 443, and we'll just have to switch that one to the new parameters at some point.

  • ValhallaValhalla Posts: 9

    Will there be possible to customize the Freedome encryption settings like you can in openvpn software for windows?

     

    Im looking for maximum security similar to these settings:

     

    Data encryption: AES-256

    Data authentication: SHA256

    Handshake: RSA-4096

  • ChrissyChrissy Posts: 439

    Hi Valhalla!

     

    I was just informed by the Freedome team that there is no possibility to customize Freedome encryption settings at the moment. There are no known plans for it in the future, but we will keep it in consideration.

     

    Cheers!

    // Chrissy

  • HessuHHessuH Posts: 24

    AES encryption has recently been enabled for the old sites, too. It took a while, since we wanted to wait for a good percentage of Android clients to be updated to support a smooth transition to the new configuration.

     

    Current Freedome encryption parameters, as of 2014-10-24, for Android:

     

    Control channel: TLS, 2048 bit RSA auth, typically AES256+SHA1 HMAC but depends on client capabilities
    Data channel: AES-128 + SHA1 HMAC
     
    For iOS / IPSEC:

     

    AES-256 + SHA1 HMAC

     

    Chrissy
  • Hi HessuH,

    thank you for the new information, but
    when will the insecure SHA1 be replaced?

    Best regards,
    Cryptoman
  • HessuHHessuH Posts: 24

    @Cryptoman wrote:
    thank you for the new information, but
    when will the insecure SHA1 be replaced?

    Hi,

     

    Actually, SHA1 is not insecure when used for HMAC. The collision resistance of SHA-1 is not good any more, but when using the hash function for HMAC, collision resistance is not required (google around for "sha1 hmac security" for more info). Thus, we do not plan to change the HMAC, since it'd increase the overhead (size of transmitted data) a bit.

     

    We do have some SHA1 signatures in some certificates still in use. There it is more of an issue, and we plan to roll to new certificates within the next 6 months or so (requires clients to be updated).

  • TheoGTheoG Posts: 5

    @HessuH wrote:

    AES encryption has recently been enabled for the old sites, too. It took a while, since we wanted to wait for a good percentage of Android clients to be updated to support a smooth transition to the new configuration.

     

    Current Freedome encryption parameters, as of 2014-10-24, for Android:

     

    Control channel: TLS, 2048 bit RSA auth, typically AES256+SHA1 HMAC but depends on client capabilities
    Data channel: AES-128 + SHA1 HMAC
     
    For iOS / IPSEC:

     

    AES-256 + SHA1 HMAC

     


    Can you confirm which encryption suite freedome supports under Windows?

  • Hello thanks Very good VPN Freedom VPN would thinks 👑 🌷 👑 🎆 🎇
This discussion has been closed.