1. Each VPN Gateway is assigned a 2048-bit RSA private key on installation using a cryptographically strong random number generator.
2. A secure tunnel is established between two VPN Gateways with strong authentication provided by Diffie-Hellman key exchange mechanisms.
3. Once a tunnel is established, all data traveling between the two VPN Gateways is compressed (optional) and encrypted using a predefined cipher, and sent across the Internet to the peer Gateway.
4. Key changes can be forced at regular intervals.

The available ciphers are:

• IDEA
• Blowfish
• Twofish
• DES
• 3DES
• SAFER SK128
• GOST
• RC2, RC4 and RC5