Private Internet Access (PIA) uses OpenVPN to create an encrypted VPN tunnel. OpenVPN supports multiple encryption options.
You can choose between two OpenVPN data encryption settings. The default setting is suitable for most users. Advanced users can change it if needed.
Recommended OpenVPN Encryption Settings
The default recommended protection settings are:
- Data encryption: AES-128-GCM
- Data authentication: GCM
- Handshake encryption: RSA-4096
These settings provide a good balance between privacy, security, and performance. AES-128-GCM uses strong encryption and is usually faster than AES-256-GCM, especially on older devices, mobile devices, or routers with limited processing power.
You can also use the maximum encryption settings:
The maximum protection settings are:
- Data encryption: AES-256-GCM
- Data authentication: GCM
- Handshake encryption: RSA-4096
The maximum settings increase the encryption key size used for your VPN connection, but they may also reduce your connection speed or use more device resources.
For most users, the recommended settings are the better default choice. Use the maximum settings if you prefer the highest available OpenVPN encryption option and don’t mind a possible speed decrease.
The sections below explain each setting in more detail: data encryption, data authentication, and handshake encryption.
Data Encryption
Data encryption is the cipher OpenVPN uses to encrypt and decrypt VPN traffic. PIA OpenVPN connections use AES encryption.
- AES-128-GCM: Offers faster performance with lower processing overhead.
- AES-256-GCM: Offers stronger encryption with higher processing overhead.
Data Authentication
While not an encryption method, data authentication helps verify that transmitted data hasn’t been changed in transit. When you use a GCM encryption cipher, authentication is included as part of GCM.
GCM (Galois/Counter Mode):
- Designed for block ciphers with a 128-bit block size
- Provides high performance on modern hardware
Handshake Encryption
Handshake encryption establishes the VPN connection and helps verify that you're connecting to a legitimate PIA server.
PIA uses TLS 1.3 for connection establishment, RSA-4096 for OpenVPN handshake encryption, and certificates use SHA-512 for signing.
RSA-4096 includes:
- 4096-bit Diffie-Hellman key exchange.
- 4096-bit RSA certificate for server verification.