An audit of software, not of a service
Provider marketing often says a VPN uses “audited” OpenVPN. This article summarises what the Open Source Technology Improvement Fund (OSTIF) published about the 2017 audit of OpenVPN: its post announcing the audit, dated 25 January 2017, its results post, dated 11 May 2017, and its category page for OpenVPN. OSTIF organised the audit, which its post says was funded by a coalition of 33 companies and individual donors, and the posts are its own summaries, with the full reports hosted separately. The audits concern the software of the time and do not assess any VPN provider’s servers, apps or logging. This article is general information, not security advice.
Scope and timing (audit of OpenVPN 2.4.0)
OSTIF said the audit would be carried out by QuarksLab engineers Gabriel Campana and Jean-Baptiste Bedrune from 15 February 2017, with 90 man-days of work over about 45 days and results expected by 7 April 2017. The results post says OpenVPN 2.4.0, the NDIS6 TAP driver for Windows, the Windows GUI and Linux versions were evaluated. It notes that this release included new features, including control channel encryption.
What QuarksLab found (audit of OpenVPN 2.4.0)
OSTIF reports that QuarksLab found one critical or high vulnerability, CVE-2017-7478, one medium vulnerability, CVE-2017-7479, and five low or informational vulnerabilities or concerns. The public disclosure coincided with OpenVPN 2.4.2, which OSTIF says fixed all of the high-priority concerns. The fixes listed include:
- correction of a pre-authentication denial-of-service flaw, in which an attacker could crash any OpenVPN client or server without credentials or keys;
- correction of an authenticated denial-of-service flaw affecting AEAD cipher modes through exhaustion of the packet counter;
- correction of certificate handling issues in mbedtls;
- correction of usernames and passwords not being properly erased;
- correction of service handling in the OpenVPN GUI; and
- improved protocol documentation and updated user documentation.
Null pointer dereferences were judged low severity and not exploitable, with the fix reserved for a future release. OSTIF also lists positive confirmations: that OpenVPN uses the random-number functions of OpenSSL and mbedTLS correctly, that it uses a non-standard but cryptographically sound custom algorithm for non-critical random values, and that it contains some legacy code for unsupported OpenSSL versions.
The second review (cryptography)
OSTIF says a separate review was performed by Dr Matthew Green at Cryptography Engineering, paid for by Private Internet Access, a VPN provider. Cryptography Engineering focused on the cryptography and made recommendations. OSTIF records that OpenVPN 2.4 and later negotiate ciphers and default to AES-256-GCM, that a serious warning is issued when the options –cipher none or –auth none are used, that some options were slated for deprecation, and that users are warned about combining compression with streamed data from 2.4.3. It also records disagreement: the OpenVPN team objected to the wording “total loss of privacy” for a TLS auth IV collision issue disagreed with the recommendation on –script-security 3, found no issues in its –tls-verify implementation, and said –reneg-bytes must stay for compatibility.
Later findings
OSTIF’s category page records that in October 2017 researcher Guido Vranken received OSTIF’s first bug bounty payout, USD 5,000, for fuzzing OpenVPN 2.4.2 and finding a variety of memory-safety and error-handling flaws that were disclosed responsibly and integrated into OpenVPN. The page shows that scrutiny continued after the audit and that the audited version was not the end of the fixes.
What the audits do and do not show
OSTIF’s own conclusion is that OpenVPN is much safer after the audits and is generally well written with strong adherence to security practices. That is OSTIF’s judgement about the software, and a coalition of companies and donors funded the work. The audits were of a specific 2017 release. They say nothing about later versions, about how a provider configures OpenVPN, about server hardware or about whether a provider keeps logs. This site’s article on VPN no-logs policies and independent audits covers how to read claims about provider-level audits, and its comparison of VPN protocols explains where OpenVPN sits among the options.
Questions to ask about an “audited” claim
A claim that a service uses audited software prompts several checks: which version was audited and when, who commissioned and who performed the work, what the scope covered, whether findings were fixed, and whether the report is public. The 2017 OpenVPN work published its synopsis, its funding coalition and its findings, which makes it a useful reference for what an informative audit disclosure looks like. Formal-verification claims for WireGuard, a different protocol, are discussed in the site’s article on WireGuard’s own documentation.
Common questions
Did the audit find serious problems? OSTIF reports one critical or high and one medium vulnerability, both fixed in 2.4.2, alongside five lower-severity items.
Does an OpenVPN audit prove a VPN service is safe? No. It concerned one software release in 2017 and not any provider’s service.
Who paid for the second review? OSTIF says Private Internet Access paid for the Cryptography Engineering review.
The bottom line
The 2017 OSTIF and QuarksLab audit of OpenVPN 2.4.0 reported one critical or high, one medium and five low or informational findings, with fixes in 2.4.2, and a separate cryptography review paid for by a VPN provider made further recommendations. Both concerned one release from 2017, so a provider’s claim to use “audited OpenVPN” says little without the version, scope and date.