ExpressVPN has announced that it has made its protocol implementation open source. Lightway, designed to achieve minimal connection setup time while maintaining a high level of security and reliability. The code is written in C and distributed under the GPLv2 license. The implementation is very compact, compressed into two thousand lines of code. Support for the following platforms is declared: Linux, Windows, macOSIOS, Android, routers (Asus, Netgear, Linksys), and browsers. The build requires the Earthly and Ceedling build systems. The implementation is packaged as a library that can be used to integrate client and server functions. VPN into your applications.
The code utilizes ready-made, proven cryptographic functions provided by the wolfSSL library, which is already used in solutions that have received FIPS 140-2 certification. In normal mode, the protocol uses UDP for data transfer and DTLS to create an encrypted communication channel. As an option, to ensure operation on unreliable or UDP-limited networks, server A more reliable, but slower, streaming mode is provided, allowing data to be transferred over TCP and TLSv1.3.
Tests conducted by ExpressVPN have shown that compared to older protocols (ExpressVPN supports L2TP/IPSec, OpenVPN, IKEv2, PPTP, WireGuard and SSTP, but it does not specify what exactly the comparison was made with), the transition to Lightway Reduced connection setup time by an average of 2.5 times (in more than half of cases, the communication channel is established in less than a second). The new protocol also made it possible to reduce connection drops by 40% in unreliable mobile networks with poor connection quality.
The development of the reference implementation of the protocol will be carried out on GitHub with the opportunity to participate in the development of community representatives (to transfer changes, you need to sign a CLA agreement on the transfer of property rights to the code). Other VPN providers are also invited to cooperate, which can use the proposed protocol without restrictions.
The security of the implementation is confirmed by the result of an independent audit performed by Cure53, which at one time audited NTPsec, SecureDrop, Cryptocat, F-Droid and Dovecot. The audit covered the verification of source codes and included tests to identify possible vulnerabilities (issues related to cryptography were not considered). In general, the quality of the code was rated as high, but, nevertheless, the review revealed three vulnerabilities that can lead to a denial of service, and one vulnerability that allows the protocol to be used as a traffic amplifier during DDoS attacks. These problems have already been fixed, and the comments made on improving the code have been taken into account. The audit also drew attention to known vulnerabilities and issues in the third-party components involved, such as libdnet, WolfSSL, Unity, Libuv, and lua-crypt. Most of the issues are minor, with the exception of MITM in WolfSSL (CVE-2021-3336).
Source: opennet.ru
