Encryption Plugin Comparison Update

Should you have problems with the DSM plugin, here's the place to look for help or report issues.

Encryption Plugin Comparison Update

Postby adzm » 2009-08-04 22:09

Encryption Plugin Comparison Update
All DSM Encryption Plugins

General information
  • ARC4/RC4 is significantly faster (hundreds of times) than AES, but CPU speed is not much of a factor for newer computers. Still, this should be considered when dealing with large terminal server environments or low-spec machines
  • The Microsoft Crypto API provides a slightly faster implementation of ARC4 as compared to OpenSSL, although the difference is negligible
  • ARC4 is a stream cipher, and AES emulates that behavior via OFB mode. This allows the encrypted data to remain the same size as the original data
  • ARC4 == Alleged RC4, since the official RC4 algorithm is secret
  • All plugins assume Windows 2000 at minimum
  • Although all plugins are Windows-only, the OpenSSL implementations should be relatively simple to be implemented on other platforms

Plugins arranged by last update date (as far as I know)


SecureVNC
  • No pre-shared key or password required; simply secures communication from outside observers using key exchange.
  • The standard, built-in VNC password mechanism can be used to authorize access
  • Optional client authorization keys can also securely authenticate access
  • Provides passphrase override for UltraVNC
  • Other UltraVNC authentication methods can be used as well, such as mslogon
  • No setup required; can be used from any viewer simply by including the plugin. Server can optionally pre-generate the RSA key, otherwise it will be automatically generated
  • OpenSSL 0.9.8o
  • 32-bit and 64-bit Windows
  • Threadsafe uvnc >=1.0.8.x (supports multiple viewers on a server)
  • Up to 3072-bit RSA public key cryptography
  • Symmetric key encryption using AES, AES-CFB, 3AES-CFB, ARC4, Blowfish, IDEA, CAST5
  • AES recommended cipher; however per industry recommendations, intial 3072 bytes of ARC4 keystream (if used) are discarded
  • Known to work properly
  • Actively developed
  • Created by Adam D. Walling aka adzm (http://adamwalling.com/SecureVNC)

AESV3PluginMT
  • Uses pre-shared key and/or password.
  • Setup requires distribution of pre-shared key (if used) and/or the password (if used).
  • OpenSSL 0.9.8k (latest stable version; migration to OpenSSL 1.0.0 planned when officially marked stable, probably later in 2009)
  • 32-bit Windows only (64-bit may be created by merging changes from SecureVNC if enough interest, but developer recommends SecureVNC instead. If you have tried SecureVNC but still want this 64-bit, please let me know via PM)
  • Threadsafe (supports multiple viewers on a server)
  • 128-bit AES symmetric key encryption with salt (IV is ignored by OpenSSL but kept for attempted (but unsuccessful) backwards compatibility with AESV2Plugin)
  • Known to work properly
  • Developer recommending SecureVNC; however, major bugs will be fixed
  • Created by Adam D. Walling aka adzm (http://adamwalling.com/DSMPlugin) based off of AESV2Plugin created by Sean E. Covel (http://msrc4plugin.home.comcast.net/~msrc4plugin/index.html)

ARC4V4PluginMT
  • Uses pre-shared key and/or password.
  • Setup requires distribution of pre-shared key (if used) and/or the password (if used).
  • OpenSSL 0.9.8k
  • 32-bit Windows only (64-bit may be created by merging changes from SecureVNC if enough interest, but developer recommends SecureVNC instead. If you have tried SecureVNC but still want this 64-bit, please let me know via PM)
  • Threadsafe (supports multiple viewers on a server)
  • 128-bit ARC4 symmetric key encryption with salt (IV is ignored by OpenSSL but kept for attempted (but unsuccessful) backwards compatibility with ARC4Plugin/MSRC4Plugin)
  • Beginning of keystream is not discarded; theoretically, this can leak information regarding the key
  • Known to work properly
  • Developer recommending SecureVNC; however, major bugs will be fixed
  • Created by Adam D. Walling aka adzm (http://adamwalling.com/DSMPlugin) based off of AESV2Plugin created by Sean E. Covel (http://msrc4plugin.home.comcast.net/~msrc4plugin/index.html)

MSRC4Plugin
[1.2.2 publicly available on website, 1.2.4 available with UltraVNC]
[redge: MSRC4 1.2.2 not compatible vista as user mode and config button crash winvnc]
  • Uses pre-shared key and/or password.
  • Setup requires distribution of pre-shared key (if used) and/or the password (if used).
  • Microsoft Crypto API
  • 32-bit Windows only (64-bit may be in beta but not publicly available (?))
  • Not threadsafe (only one viewer on a server)
  • 40-, 56-, or 128-bit (depends on OS and patch level) ARC4 symmetric key encryption, supposedly with unique IV (uncertain if mscrypto actually uses the IV; in OpenSSL, it is ignored.) Salt was removed due to issues with Windows 2000 compatibilty.
  • Beginning of keystream is not discarded; theoretically, this can leak information regarding the key
  • Known to work properly, although sometimes runs into issues due to Microsoft Crypto API issues
  • May still be actively developed (?)
  • Created by Sean E. Covel (http://msrc4plugin.home.comcast.net/~msrc4plugin/index.html)

AESV2Plugin
  • Uses pre-shared key and/or password.
  • Setup requires distribution of pre-shared key (if used) and/or the password (if used).
  • OpenSSL (version unknown)
  • 32-bit Windows only
  • Not threadsafe (only one viewer on a server)
  • 128-bit ARC4 symmetric key encryption with salt (IV is included but OpenSSL ignores it)
  • Beginning of keystream is not discarded; theoretically, this can leak information regarding the key
  • Several known crashes and bugs; not recommended
  • Not actively developed
  • Created by Sean E. Covel (http://msrc4plugin.home.comcast.net/~msrc4plugin/index.html)

ARC4Plugin
  • Uses pre-shared key and/or password.
  • Setup requires distribution of pre-shared key (if used) and/or the password (if used).
  • OpenSSL (version unknown)
  • 32-bit Windows only
  • Not threadsafe (only one viewer on a server)
  • 128-bit ARC4 symmetric key encryption with salt (IV is included but OpenSSL ignores it)
  • Beginning of keystream is not discarded; theoretically, this can leak information regarding the key
  • Several known crashes and bugs; not recommended
  • Not actively developed
  • Created by Sean E. Covel (http://msrc4plugin.home.comcast.net/~msrc4plugin/index.html)
Last edited by adzm on 2010-11-09 03:01, edited 4 times in total.
adzm
20
20
 
Posts: 63
Joined: 2009-04-29 18:59

Re: Encryption Plugin Comparison Update

Postby Cobra » 2009-08-05 12:14

adzm wrote:...since the official RC4 algorithm is secret...

That's why I don't like it and why I don't trust it... Therefore I still prefer the AES version. :wink:

...and yes, I have paranoia... :D

Regards,

Cobra
I know nothing except the fact of my ignorance. (Socrates 470 - 399 B.C.)
Cobra
20
20
 
Posts: 36
Joined: 2005-05-19 18:44

Re: Encryption Plugin Comparison Update

Postby itsmee » 2009-08-10 11:00

A similar level of paranoia here leads me to using AESV3PluginMT :)

In addition I like the added comfort of requiring a password AND a key, to be able to log on :)

Great work though adzm, VERY much appreciated :)
itsmee
 
Posts: 5
Joined: 2008-09-05 11:06

Re: Encryption Plugin Comparison Update

Postby MiG » 2009-08-11 06:36

BiG nice thx 4 all the hard work you've put into this, much appreciated :)
UltraVNC 1.0.8.2
OS: win 8.1,
using uvnc-x64 on WAN + LAN with SecureVNCPlugin64, experienced user
MiG
8
8
 
Posts: 20
Joined: 2004-10-23 12:18

Re: Encryption Plugin Comparison Update

Postby adzm » 2009-08-16 19:53

itsmee and other paranoid fellows may be interested in the upcoming version of SecureVNC, which is almost complete. The only real change is the addition of an optional 'pass-phrase' or supplemental password. In previous incarnations of the DSM plugins, the keyfile was hashed into a key rather than being used as a key itself, and the same process with the keyfile+password. Therefore the keyfile was, effectively, a 16-byte password.

However, the problem with this was that if you were elsewhere, you cannot access your secured VNC server without this keyfile, unless you are the kind of person who can easily remember 16 random bytes.

The new SecureVNC plugin allows the server to require a supplemental key as well. The user is prompted for a passphrase, which is hashed to create the supplemental key. The advantage is that it can be as long or complex as you desire, hence the 'passphrase' term. This is a lot easier to remember!

The proof-of-concept has already been created, but the usual delays include figuring out the user interface, configuration, backwards compatibility, and testing. But you'll know when it is out!

If you have any ideas or suggestions let me know!
Last edited by adzm on 2009-08-16 19:55, edited 1 time in total.
adzm
20
20
 
Posts: 63
Joined: 2009-04-29 18:59

Re: Encryption Plugin Comparison Update

Postby itsmee » 2009-08-19 11:37

Hi adzm,

Look forward to giving it a run around the block !! Thanks for all your hard work !!!
itsmee
 
Posts: 5
Joined: 2008-09-05 11:06


Return to DSM plugin

Who is online

Users browsing this forum: No registered users and 4 guests