Couldn’t the government use Deep Packet Inspection to view the communication between you and the VPN server when you connect to it by acting as a man in the middle? such as the websites you are visiting and the information you are sending. Why not, if not?
7 Likes
No, since the protocol prevents MITM by requiring the server’s public key to be accessible before joining, anybody attempting to MITM will be unable to obtain the server’s private key and will thus be unable to decrypt communications or transmit legitimate packets.
6 Likes
Does every connection result in a different public key? For what reason, then, might MITM not create a list of VPN-Servers and obtain their certificates while establishing VPN connections independently beforehand?
The ISP may still detect attempts to connect to a VPN server and observe the protocol being used, correct?
6 Likes
Find out more about key exchange. The designers of this crap make sure that the real encryption key used by the two sides is hidden from anybody recording the entire discussion.
In WireGuard, the responder’s public key is sent in a message from the initiator to the responder. This message can be converted into the encryption key; only the responder can read it. This is converted into the encryption key on both sides. The encryption key could not be obtained even if the entire discussion was recorded.
5 Likes
Down my rabbit hole 
5 Likes
With the exception of really poor key/config distribution, they are unable to MTM, but they can quickly identify and disable the majority of VPN protocols using DPI. For instance, Egypt presently prohibits VPNs in this manner.
In certain situations, you can get around such limitations by utilizing more obfuscated protocols (like shadowsocks), but more arcane techniques are needed to get past China’s massive firewall.
2 Likes
The private key is unique to the server; without it, spoofing or decrypting is not possible. To put it extremely simply, a public key functions similarly to a padlock for senders, but the private key is always with the recipient.
2 Likes
The first connection may be examined and, for instance, actively probed in dictatorships; nevertheless, SSL traffic is somewhat impenetrable (believe me, this is just a math issue), but it can be observed for some abstract patterns that resemble human shadows. Although you are unable to identify the shadow’s dropper, you may infer that it is mostly human. In the same way, packets may partially identify HTTP but not the content. There are techniques to block those views. For instance, xray-reality may be used to partially simulate traffic; it’s similar to donning a parrot costume for a shadow play.
Public key cryptography prevents the government from MITMing. In essence, the server has the private key, and your computer has the public key of the server it wishes to trust. Only a person with the matching private key may decrypt data that has been transmitted across a VPN tunnel.
Deep packet inspection is more accurately defined as the process of analyzing an encrypted tunnel’s protocol characteristics to determine what kind of data it is carrying. Therefore, even if they cannot view your data, the government may use DPI to determine that you are using a VPN.
It is actually simpler. A docker image for xray-reality exists, and it functions well.