Slashdot Mirror

← Back to Stories (view on slashdot.org)

Dutch Government Officially Trusts OpenVPN-NL

Posted by timothy on from the goot-to-goeh dept.

First time accepted submitter joost.bijl writes "Yesterday the Dutch government took a step to further improve the adoption of Open Source in its ranks. It has officialy approved a modified version of the open source VPN software OpenVPN for use on the governmental level 'Departementaal Vertrouwelijk' (Restricted). The release is called OpenVPN-NL and is fully open-source and available for use. The software has undergone a security evaluation by the Dutch government's national communications security agency (NLNCSA). The major change is the removal of OpenSSL as the cryptographic core of OpenVPN-NL. Instead, the Dutch government opted to include the smaller, better readable and documented open source library PolarSSL to provide the cryptographic and SSL/TLS functionality. The Dutch IT Security company Fox-IT worked together with both OpenVPN and PolarSSL communities and modified the stock software to support the government evaluation process. In total 8000 lines of code and 4000 lines of documentation were checked in to the OpenVPN trunk."

5 of 53 comments (clear)

  1. Re:Why should we trust openssl? by El_Muerte_TDS · · Score: 4, Informative

    OpenSSL only goes up to TLS1.0, which contains some vulnerabilities. (Note sure if these issue affect OpenVPN). PolarSSL (which is created by a Dutch company, which might be the reason that was chosen) supports up to TLS1.1.
    Why they didn't go for the more feature complete and mature GnuTLS would be an interesting question.

    http://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations

  2. Re:Awesome by habalux · · Score: 5, Informative

    OpenVPN 2.3 does support IPv6 in tun mode, even point-to-multipoint. It still needs an IPv4 pool though but you can just ignore it and go IPv6 only.

    http://www.greenie.net/ipv6/openvpn.html

  3. Re:Awesome by MightyMartian · · Score: 4, Informative

    Yes, that is a pain. I thought they were supposed to be setting up the Windows service so that a non-admin client could control the VPN via the service to write the routing table, which seems to be the big stumbling block for OpenVPN under the UAC.

    --
    The world's burning. Moped Jesus spotted on I50. Details at 11.
  4. Re:Why should we trust openssl? by jhaar · · Score: 5, Informative

    you don't know what you're talking about. Openvpn was never affected by the "renegotiation bug" as it doesn't use SSL for that component. As it runs over UDP and TCP, it had to come up with its own way of doing that - hence no problem.

    That in combination with HMAC authentication makes it basically immune from that issue anyway...

  5. Re:diff by testie_nl · · Score: 5, Informative

    Here the guy claiming to be the maintainer :) Just to make some thing clear.. I used to work at Fox-IT for a long time. Fox-IT did a number of code additions to improve interoperability with OpenVPN and donated that code to the PolarSSL code base.