IKEv2 vs OpenVPN

[gtierrezandres]

Is there a reason why Sun would prefer IKEv2 vs OpenVPN? I did some research and it seemed like OpenVPN was the most secure VPN protocol out there

[ghost]

Hey! 👋

That's a very good question, actually!
I read this comparison of VPN protocols and started to be skeptical about the choice of IKEv2 as well...

Leaked NSA presentations indicate that IKE could be exploited in an unknown manner to decrypt IPSec traffic.

Also:

IKEv2 is easier to block than OpenVPN due to its reliance on fixed protocols and ports.

IPSec IKEv2 is indeed faster than OpenVPN, but Wireguard is supposedly even faster.
So my question would actually be: why not Wireguard? 😉

[sunknudsen]

Hey guys, great questions! I will answer thoroughly once I'm done with some research, but short answer is native support on iOS and macOS.

[gtierrezandres]

I think the reason why Wireguard is not widely used yet is because it is relatively knew and there might be some vulnerabilities with it (I'm not too familiar with how it works under the hood). But the community seems to be optimistic about it and it might be the go to VPN protocol in the future.

And along with what Sun added, I found out that you have to download a third party app, OpenVPN Connect, in order to use it on iOS, but we don't need it for macOS, since it can be done through the terminal. Although, this might be less user friendly.

Overall, my end goal was to use the most secure protocol since I don't really care how technical it could get. And it seemed like OpenVPN was the best option but since I am new to cybersecurity I wanted to get a second opinion :)

[ghost]

I think the reason why Wireguard is not widely used yet is because it is relatively knew and there might be some vulnerabilities with it

I disagree. But I acknowledge the fact that some people are more reluctant to use relatively new alternatives to well-established solutions than the others (case of AES vs ChaCha, or OpenVPN vs Wireguard).

I would say that it's a pretty mature protocol by now and it's widely used by commercial VPN providers. Also, it's now a module inside Linux and BSD kernels.
Moreover, it uses well established crypto primitives (Curve25519, ChaCha20, Poly1305, BLAKE2s).

Less lines of code => less space to make mistakes and less code to review during audits.
OpenVPN is 400,000 lines of code, IPSec 600,000 and Wireguard... 4,000

Here is some more information about Wireguard's formal verification: https://www.wireguard.com/formal-verification/

[ghost]

Perhaps IKev2 ,is more integrated in apple hardware.And this protocol is already in apple hardware for a long time:matured.
But when there is a Wireguard kernel extension for BSD ,perhaps thinks are changing.