An Easy to Understand Intro to VPN Encryption

5 Reasons VPN Data Encryption Is Necessary

Here are the main reasons you should always make sure VPN encryption secures your online traffic:

1. First and foremost, VPN encryption keeps cybercriminals at bay when you use public WiFi. Those networks might be convenient, but they are dangerous too since they barely use any encryption, so anyone can monitor your data. 
2. Since encryption makes your traffic surveillance-proof, government agencies can no longer keep tabs on your online activities. Such a perk is invaluable if you happen to live in or travel through a country with an oppressive regime.
3. Advertisers won’t be able to create accurate profiles to spam you with targeted ads since they won’t manage to track what you do on the web. Also, your ISP will no longer be able to sell your browsing history to advertisers.
4. If you download torrents, your ISP won’t know you’re doing it. So, they won’t be able to terminate your service, or give out your data to copyright agencies.
5. VPN encryption will prevent your ISP from throttling your bandwidth since they won’t know what you’re doing on the Internet.

A Quick Overview of VPN Encryption Protocols

A VPN protocol is a set of rules and instructions VPN providers use to negotiate secure connections between a VPN client and a VPN server. VPN providers use multiple protocols, and most providers let users choose which protocol they want to use before connecting to a server.

Right now, it seems like OpenVPN, SoftEther, and IKEv2 are the most secure VPN encryption protocols. SSTP also offers decent security, but it’s not as trustworthy as the other ones since Microsoft developed it.

Here is a list of the VPN protocols you’re most likely to encounter when using a VPN service, and a short description of each one:

• OpenVPN - Highly secure, open-source, and can use multiple ciphers. However, OpenVPN’s design makes it likely to slow down speeds when it uses heavy encryption.
• SoftEther - Younger than OpenVPN, but it shares many of its characteristics. And while it offers top-notch security, it also provides decent speeds.
• IKEv2 - Not as flexible as OpenVPN and SoftEther, but offers decent security if the VPN provider uses the right cipher. Plus, IKEv2 is pretty fast.
• L2TP/IPSec - Relatively secure, though L2TP doesn’t offer any encryption on its own. Also, some online users claim the NSA cracked L2TP/IPSec, though there’s no proof to back that up. Other than that, L2TP/IPSec is also pretty fast at processing data.
• IPSec - Offers reliable security, but most providers don’t offer it as a standalone protocol. Instead, they normally pair up IPSec with IKEv2 and L2TP.
• WireGuard - A secure open-source protocol like OpenVPN and SoftEther. However, WireGuard is fairly new, and in the experimental phase. So, you can’t rely on it to offer stable encryption.
• SSTP - Offers a similar level of security like OpenVPN. However, Microsoft (a company that collaborated with the NSA) is the sole owner, and the protocol is not open-source.
• PPTP - The least secure protocol on the list. While PPTP offers high speeds, there’s proof the NSA managed to crack it.

Extra Info to Help You Better Understand VPN Encryption (Optional)

The info we offered above should give you a basic understanding of how VPN encryption works. But if you want to understand it even more, feel free to check out this section too.

Don’t worry - we’re gonna keep things as simple and to the point as possible.

VPN Encryption Keys

If you think of VPN encryption as a lock, the encryption key functions just like real-life keys - it locks and unlocks the encryption.

Encryption keys are just strings of bits. The longer the key, the stronger it is. So a 128-bit encryption key would obviously be much more powerful than a 64-bit key.

There are two types of keys - Public and Private. The Public Key encrypts your traffic, and only the Private Key can decrypt it. 

VPN Encryption Types

When talking about VPN encryption types, you’ll often see people mentioning Blowfish, AES, or Camilla.

Those are ciphers (also known as algorithms), and we’ll get to them in a bit. Encryption on its own, on the other hand, only fits into two categories:

Asymmetric Encryption

With asymmetric encryption, the Public and Private Keys are different. That offers more security, but it’s also risky. If you somehow lose the Private Key, you can no longer decrypt the data.

Symmetric Encryption

Symmetric encryption uses identical Public and Private Keys. Because of that, the encryption process goes faster.

VPN Encryption Algorithms

An encryption algorithm is the mathematical process that performs the encryption/decryption process.

Unlike encryption keys, algorithms can sometimes have weaknesses, which is why encryption keys accompany them. That’s why you always see the name of a VPN encryption algorithm accompanied by the length of the encryption key (like AES-256, for example).

Moving on, here’s a quick list of the main algorithms VPN providers use:

• AES
• Blowfish
• Twofish
• Camilla
• MPPE
• 3DES
• RSA 

As for the other algorithms, here’s what you should know:

• MPPE is not secure since PPTP connections use it, and we already mentioned how unsafe PPTP is. Not to mention MPPE is vulnerable to bit-flipping attacks.
• Blowfish can handle 128-bit keys, but its block sizes make it vulnerable to birthday attacks.
• 3DES is vulnerable to birthday attacks like Blowfish, but is much slower than Blowfish on top of that. What’s more, NIST made it clear 3DES will be retired, and nobody will be able to use it after 2023.

HMAC Authentication

HMAC authentication is a process that verifies and authenticates the data integrity of a message to make sure nobody tampered with it.

Basically, VPN providers use HMAC authentication to ensure no cybercriminals interfere with the data that goes between the VPN client and the VPN server.

You’ll normally see VPN providers using SHA-2 encryption for HMAC authentication. Some providers might use SHA-1, but it’s not as secure as SHA-2.

Perfect Forward Secrecy

Often abbreviated as PFS, it ensures that the data associated with a communication session between a VPN client and server remains safe even if cybercriminals manage to compromise a session’s Private Key.

Some VPN providers use PFS when the server and client authenticate each other, and when they initiate the tunneling process.

Not all providers do that, though, since they might not have clients and servers with PFS-enabled interfaces. Another reason some providers don’t offer PFS is because they don’t use protocols that work with it (like OpenVPN, SoftEther, or IKEv2).

Encryption Handshake

This is when the VPN client and the VPN server generate the encryption/decryption keys, agree which VPN protocol they will use, decide on a VPN encryption algorithm, and use digital certificates to authenticate each other.

Essentially, it’s called a “handshake” because the client and server “agree” on how to establish the connection.

VPN providers normally use the RSA algorithm for the handshake process, but they can also use ECDH or DH (less secure than ECDH) key agreement protocols.

Do VPNs Offer End-to-End Encryption?

Well, in theory, a VPN wouldn’t offer end-to-end encryption since the VPN server decrypts the encrypted traffic it receives from you before it forwards your requests to the web. End-to-end encryption would imply that you and only you can decrypt your data.

However, you can get security that’s similar to end-to-end encryption if you pick a VPN provider with a no-log policy. That way, all the data the server decrypts will be discarded, meaning you are the only one who has access to it.

Also, keep in mind that if you use a free VPN, you’ll definitely not get anything close to VPN end-to-end encryption. They don’t normally configure their VPN encryption standards correctly, so data leaks end up compromising your privacy. And if you’re very unlucky, you might not even get any encryption at all.

VPN Encryption - The Bottom Line

So what is VPN encryption?

Well, it’s how a VPN makes sure nobody can monitor what you do on the web. When it encrypts your traffic, it basically makes it indecipherable. Anyone who tries to snoop on it will just see gibberish.

There’s a lot that goes into making VPN encryption work (like authentication, PFS, handshake, algorithms, encryption keys, VPN encryption types, and protocols), so understanding it can be a bit tricky.

That’s why we welcome any questions you might have after you read the article. If you’d like to learn more about VPN encryption, don’t hesitate to get in touch with us.