Maintaining data protection and privacy should be a priority both personally and professionally, but in today's digital world, it can be hard to do so. One of the best ways to ensure an individual's and an organization's security is through a virtual private network (VPN). In this guide, we'll explain what a VPN is, how it works and how to check if it is encrypted.
What is VPN encryption?
VPN encryption is a network that gives a user or an organization protection by making sure the network activity is known only to the user and provider. It keeps all of the information – such as emails, documents, financial statements, login credentials and software files – that is shared through the network secure from prying eyes or bad actors on your network. By using a VPN, you protect your sensitive data from cybercriminals, even when you're using your personal router or public Wi-Fi.
The network operates by converting data on your device from a readable format to an encoded and unreadable format through an algorithm. This encoded information can be decoded only with the right decryption key, found in your VPN. Any bad actors who attempt to hack this information will find it unreadable, as they are not a part of the VPN.
As the name suggests, a VPN is virtual, meaning it can be accessed within an organization's building or remotely. As such, VPNs have become increasingly popular during the pandemic as businesses have looked for a way to provide the same degree of security available in the office to employees working from home.
How does VPN encryption work?
When you use a router at home, it provides you with personal security when you're connected. A VPN works similarly, but it protects you via a different method: You run a VPN client that connects to a VPN server, which, in turn, encrypts all the data when you are connected to the server.
Here's how it works: You or your employees log in to the VPN client through a personal or company device, such as a laptop or tablet. You can access the VPN client through any internet server.
From there, the data from the device being used on the VPN client is encrypted through a VPN tunnel and sent to the VPN server. The server hides your IP address and location, giving you protection from advertisers, government agencies and cybercriminals. That data is seamlessly sent back to your device while you use it. Despite being accessed over the open internet, the VPN server encrypts all your data through VPN protocols while you are logged in to the client.
Encryption algorithm types
There are two main types of VPN encryption: symmetric encryption and asymmetric encryption.
Symmetric encryption
Symmetric encryption is when a VPN uses a single cryptographic key to both encrypt and decrypt the incoming data. This is a straightforward, linear process, as it uses only a single key for decryption. The simplicity of this method means it is significantly faster than asymmetric encryption, uses less computing power and doesn't reduce your internet speed. It is often the preferred option when there is a large amount of data to be encrypted through a VPN.
There are different types of symmetric key algorithms used for this process. Here are some of the most popular ones:
- DES symmetric encryption algorithm
- 3DES symmetric encryption algorithm
- AES symmetric encryption algorithm
Asymmetric encryption
Unlike symmetric encryption keys, asymmetric encryption uses multiple keys for the encryption and decryption of data on a VPN. This encryption uses a public key and a private key, which is why asymmetric encryption is commonly known as public key cryptography. If a user or organization wants to communicate with a multitude of people securely, it would be impractical to use different keys for each person. When someone uses a public key, their data is encrypted and can be decrypted only through the private key.
The greatest benefit of asymmetric encryption is the superior security it provides to multiple users. Anyone with the public key can access the VPN. However, only the private key can decrypt the data. This is beneficial for organizations with vast quantities of emails or client information.
There are two main types of asymmetric encryption:
- RSA asymmetric encryption algorithm
- ECC asymmetric encryption algorithm
What are VPN encryption ciphers?
VPN encryption ciphers are the algorithms used in both encryption and decryption. The more keys a cipher has, the more complex it is and, therefore, the harder it is to break its encryption. Put simply, a cipher encrypts data by substituting letters and numbers through well-defined steps that can be repeated and decrypted. Here are the main types of VPN ciphers that providers use:
- Blowfish: This is typically a 128-bit key cipher, although it can range from 32 to 448 bits. Though it's secure, some users worry about its reliability. It is most commonly used in OpenVPN, an open-source VPN encryption protocol.
- Twofish: The successor to the Blowfish cipher, Twofish uses a 128-bit block size, compared with 64 bits for Blowfish. Many users prefer the security of Twofish to that of Blowfish.
- AES: AES ciphers have 128-bit, 192-bit and 256-bit keys that are popular in part because of their National Institute of Standards and Technology (NIST) certification. This is the cipher that the U.S. government uses.
- Camellia: Many users find the Camellia cipher comparable to AES because of its speed and support of 128-bit, 192-bit and 256-bit keys. The downside is that this cipher is not NIST certified.
- 3DES: Also known as the triple DES cipher, this is essentially the Data Encryption Standard being used three times. It's slower than Blowfish and supports a maximum of 168-bit keys. This cipher has been retired and is currently being phased out, with its use being prohibited after 2023.
- MPPE: The Microsoft Point-to-Point Encryption (MPPE) cipher is used for Point-to-Point Tunneling Protocol (PPTP) connections and dial-up connections. It supports 40-bit, 56-bit and 128-bit keys.
- RSA: RSA is an algorithm that can also be used for secure online communications. However, it is not commonly used by VPN providers, because it is relatively slow and no longer considered safe.
What is an encryption handshake?
A VPN encryption handshake is automatic communication between two devices. It is how the VPN client and the VPN server establish their encryption keys for communication. The process of the "handshake" between the client and the server generates the encryption keys, decides which VPN protocol is used and selects the appropriate cryptographic algorithm. After that, they authenticate each other through their digital certifications.
What is HMAC authentication?
Hash-based message authentication code (HMAC) authentication is a type of code that executes a cryptographic hash function on data that is to be authenticated. An HMAC can help ensure integrity and let the user know if the data has been changed.
What are the different VPN protocols?
To secure the connection between two devices on a VPN, a VPN protocol is established. VPN providers use different protocols to establish a secure connection. Here are the most commonly used VPN protocols:
- Point-to-Point Tunneling Protocol (PPTP): While this protocol runs at a high speed, it also has poor security, even going so far as being cracked by the National Security Agency.
- IPsec: This is a secure network protocol suite that is used to encrypt data packets sent over an IP network. In addition to having high-security features, the protocol can encrypt information without notifying the endpoint application.
- Layer 2 Tunneling Protocol (L2TP/IPsec): L2TP does not provide any encryption on its own, which is why it is commonly paired with IPsec. The fusion of the two protocols is highly secure.
- SSTP: Secure Socket Tunneling Protocol was developed by Microsoft to secure online data and traffic in a way that is safer for Windows operating systems than PPTP or L2TP/IPsec.
- IKEv2: A fast and responsive protocol, Internet Key Exchange version 2 handles traffic by establishing the security association within an application suite.
- SoftEther: This is a newer VPN protocol that has become popular with users for its speed, security and stability.
- WireGuard: Another new, popular and open-source VPN protocol, WireGuard uses only a single cryptographic suite, giving it fewer security holes.
Why it's important to regularly check your VPN's encryption
The benefit of using a VPN is that it encrypts all your data and information. However, there can potentially be flaws in these systems. Ciphers can be decrypted by hackers or the NSA, and systems can fail. If your organization uses a VPN, it's important to regularly check if it is encrypted. Ask your IT support to run frequent checks to make sure the systems are operational.
Sometimes, there is a bug in the system, or the VPN software was poorly written. In addition to conducting tests, make sure your IPv4 address has not changed and that the location matches the VPN server's location.
When you are using a new VPN provider or updated software, the VPN may show an active connection while the logs show a failed connection. This discrepancy can lead to unwanted access to your VPN without your awareness.
Some VPN providers don't encrypt data when it is in transit to the VPN server, making that information vulnerable. And often, some of these apps, most frequently free VPN providers, don't encrypt data at all. The main reason for having a VPN is to secure your organization's data, so you need to make sure your VPN is encrypting your data as advertised.
"The many free VPNs out there might get the basic requirements that a home user is looking for, hiding their geolocation and providing the ability to encrypt their network traffic," said Heather Paunet, senior vice president of products at Untangle Inc. "However, they may be based on older technologies that are not as secure. PPTP, for example, is an older VPN protocol that is not considered as secure as newer protocols."
Paunet said some free VPNs cap the amount of data and/or devices that are covered, which can limit your business's ability to serve customers and clients.
"Think of it as an investment in protecting your business's critical information," Paunet added. "Make sure your choice has all the features you need."
How to check if a VPN is encrypted
There are two primary and free options to verify your VPN's encryption: GlassWire and Wireshark. Here are the steps to check if your VPN is encrypted through each option:
Steps to check with Wireshark
- Start your VPN.
- Open Wireshark.
- Choose Wi-Fi or Ethernet to record; then start recording.
- Pick a packet where "Protocol" is "OpenVPN."
- Choose an OpenVPN packet, and click "Follow … UDP/TCP stream.
- Check the full stream to ensure it's encrypted.
Steps to check with GlassWire
- Open GlassWire.
- Connect to the VPN.
- Download a file or watch a video.
- Go to Usage on the GlassWire screen.
- Click Apps from the left-side menu.
- Find the VPN you're using, and verify the status.
Should I use Wireshark or GlassWire?
Because both Wireshark and GlassWire are free, it may seem like they can be used interchangeably and have similar features. However, that's not the case. GlassWire is easier and more straightforward. It requires less supervision and time, but it is not 100% guaranteed to be accurate.
Wireshark, on the other hand, is longer and more complicated, as it involves inspecting actual transferred packets. While this method is harder and more time-consuming, it can verify your encryption with 100% accuracy. If you need this certainty, Wireshark may be a better option.