Dutch Government Officially Trusts OpenVPN-NL

First time accepted submitter joost.bijl writes "Yesterday the Dutch government took a step to further improve the adoption of Open Source in its ranks. It has officialy approved a modified version of the open source VPN software OpenVPN for use on the governmental level 'Departementaal Vertrouwelijk' (Restricted). The release is called OpenVPN-NL and is fully open-source and available for use. The software has undergone a security evaluation by the Dutch government's national communications security agency (NLNCSA). The major change is the removal of OpenSSL as the cryptographic core of OpenVPN-NL. Instead, the Dutch government opted to include the smaller, better readable and documented open source library PolarSSL to provide the cryptographic and SSL/TLS functionality. The Dutch IT Security company Fox-IT worked together with both OpenVPN and PolarSSL communities and modified the stock software to support the government evaluation process. In total 8000 lines of code and 4000 lines of documentation were checked in to the OpenVPN trunk."

Comments

Re:Awesome

[habalux]

OpenVPN 2.3 does support IPv6 in tun mode, even point-to-multipoint. It still needs an IPv4 pool though but you can just ignore it and go IPv6 only.

http://www.greenie.net/ipv6/openvpn.html

Re:Why should we trust openssl?

[jhaar]

you don't know what you're talking about. Openvpn was never affected by the "renegotiation bug" as it doesn't use SSL for that component. As it runs over UDP and TCP, it had to come up with its own way of doing that - hence no problem.

That in combination with HMAC authentication makes it basically immune from that issue anyway...

Re:diff

[testie_nl]

Here the guy claiming to be the maintainer :) Just to make some thing clear.. I used to work at Fox-IT for a long time. Fox-IT did a number of code additions to improve interoperability with OpenVPN and donated that code to the PolarSSL code base.