On Tue, 08 Jul 2008 15:59:53 +0100, Invisible wrote:

> Invisible wrote:
> 
>> It appears the report was written by somebody other than the author.
>> But then, comments like "OpenVPN seems to be using SSL" make me
>> suspicious. As does the fact that SSL and TLS both run over TCP, yet
>> OpenVPN seems to be using UPD. That looks like a big enough deviation
>> from the standard that I'm left wondering how many design decisions
>> have been made with potential security implications.
>> 
>> It's not like OpenVPN just calls the OpenSSH crypto library to do its
>> bidding; it looks like a complete new implementation.
> 
> Wikipedia claims OpenVPN uses the OpenSSL library.

http://openvpn.net/index.php/documentation/manuals/openvpn-21.html - 
under "Description":

"OpenVPN is tightly bound to the OpenSSL library, and derives much of its 
crypto capabilities from it."

> http://en.wikipedia.org/wiki/OpenVPN
> 
> Still unclear how it runs SSL over UDP...

From the above quote, it maybe doesn't, but instead uses the crypto from 
openSSL.

Jim

Post a reply to this message