Me ya sa AES-256 ba ya bayyana tsarin ɓoye bayanai na VPN
Tsari yana cika ayyuka huɗu: babban ɓoyewa, amincin bayanai, kafa maɓalli da tabbatar da abokin hanya. Sunan sirri yana rufe ɗaya daga cikinsu, a wani mataki.
Ka tambaya wace ɓoyewa VPN ke amfani da ita, amsar takan zo da kalma ɗaya: AES-256, ko ChaCha20, ko wataƙila WireGuard. Wannan amsar tana ambaton sashe ɗaya na mataki ɗaya, yayin da abin da ke kare haɗin da gaske shi ne tarin algorithms waɗanda ke cika ayyuka huɗu daban-daban. Rikita sashe da tsari shi ne kuskure mafi yawa a waɗannan tattaunawa, kuma yana haifar da kwatance da ba za a iya warware su ba.
Ayyuka huɗu cikin haɗi ɗaya
Babban ɓoyewa yana mai da rubutu bayyananne zuwa rubutun sirri don tashar bayanai, kuma ana fitar da maɓallinsa maimakon a watsa shi. Kariyar aminci tana gano canji, wanda aiki ne daban ko da tsari ɗaya yana yin duka biyu. Kafa maɓalli yana samar da kayan zirga-zirga na gama gari, kuma tabbatar da abokin hanya yana yanke shawara wanene a wancan gefen. Idan ɗaya ya ɓace, haɗin ba shi da tsaro, komai ƙarfin sauran ɓangaren.
Wasu ƙira suna haɗa ayyuka biyu cikin ɗaya. AES-GCM da ChaCha20-Poly1305 tsarin ɓoye ne da aka tabbatar, saboda haka sirri da aminci suna zuwa tare; AES-CBC ba haka ba ne, kuma yana buƙatar lambar tabbatar da saƙo daban da maɓallinta. Saboda haka karanta shawara a matsayin buhun lambobi masu zaman kansu yana karanta waɗanda aka ƙera a matsayin nau’i-nau’i ba daidai ba.
Ayyukan kuma suna kan matakai daban-daban, shi ya sa kalma ɗaya na iya nufin abubuwa daban-daban a kayayyaki biyu. Ɓoyewar toshe a cikin ESP da ɓoyewar toshe a cikin TLS abu ɗaya ne na asali a tattaunawa daban-daban da buƙatu daban-daban. Saboda haka ambaton abin asali ba tare da yanayinsa da matakinsa ba na iya zama mafi muni fiye da rashin ambaton komai.
Me ya sa sunan sirri kusan ba ya faɗin komai
Ɗauki kalmar AES-256 da muhimmanci na ɗan lokaci: tana nuna ɓoyewar toshe da girman maɓalli. Ba ta faɗin komai game da yanayin aiki, ko an samar da aminci, yadda aka kafa maɓallai ko yadda aka tabbatar da abokin hanyar. Kayayyaki biyu na iya tallata AES-256 kuma su bambanta a kowane fanni, ciki har da ɗaya da yanayi mara tabbaci da wani da yanayin AEAD da musayar maɓalli na zamani.
TLS 1.3 ya kawo wannan rabuwa cikin ma’auni, wanda gyara ne mai amfani ga duk wanda ya koyi tsohon kalmomi. Ƙungiyoyin sirrinsa suna ambaton AEAD da hash kawai, yayin da ƙungiyoyin musayar maɓalli da algorithms na sa hannu ake tattaunawa a matsayin sigogi daban. Saboda haka ba za a kwatanta sunan ƙungiyar TLS 1.3 da sunan ƙungiyar TLS 1.2 a kan daidaito ba, ko da duka biyu suna bayyana a fili ɗaya na fayil ɗin saiti. Mai bincike da ke kwatanta igiyoyin biyu kai tsaye yana yanke shawara da ka’idar ba ta goyi baya. Karanta ƙungiyar da aka tattauna da sigogin sa hannu kuma, in ba haka ba kwatancen bai cika ba.
WireGuard yana ɗaukar hanyar sabanin haka kuma yana kawar da tattaunawa kusan gaba ɗaya: ka’idar tana ƙayyade tsarin algorithms na dindindin, saboda haka aiwatarwa biyu suna aiki tare ko a’a. Wannan zaɓi ne na ƙira mai halatta, kuma yana nufin tambayar wace ƙungiya WireGuard ke tattaunawa ba ta da amsar da ta cancanci kwatance. Idan kana bincikensa, karanta ƙayyadaddun sau ɗaya sannan ka binciki kula da maɓalli a kusa da shi maimakon tattaunawa.
Mataki ne ke ƙayyade kalmomi
Aiwatar da IPsec yana tattaunawa sau biyu: shawara ta IKE don tashar sarrafawa da canjin ESP don bayanai, kuma duka biyu na iya bambanta bisa halatta. Karanta na farko da ɗauka cewa yana bayyana na biyu shi ne tushen ruɗani na yau da kullum a lokacin bincike, domin fayil ɗin saiti yana ambaton duka biyu kuma abin sha’awa shi ne na biyu.
| Layer | What is negotiated there | What it does not cover |
|---|---|---|
| IKE proposal | Algorithms and groups for the control channel that builds the tunnel | The algorithms protecting the data itself |
| ESP transform | Encryption and integrity for tunneled packets | Peer identity, which authentication already settled |
| TLS handshake | AEAD and hash, plus separately negotiated groups and signatures | Routing, authorization or retention policy |
| WireGuard | Nothing; the algorithm set is fixed by the protocol | Everything above the cryptographic arrangement |
Sunan da ke samuwa a ɗakin karatu ɗaya ba a aiwatar da shi kai tsaye don wata hanyar bayanai ba. Saboda haka maganar cewa kayanmu na goyon bayan AES-256 ta fi rauni fiye da yadda take ji, kuma shi ya sa ake warware matsalar haɗin gwiwa ta hanyar nemo haɗin da ake kiyayewa maimakon kunna kowane tsohon algorithm a ɓangarori biyu.
Ƙayyadaddun TLS 1.3 shi ne misali mafi bayyana a buga na rabuwar, domin yana bayyana ƙungiyar a matsayin nau’i biyu kuma yana motsa sauran zuwa tattaunawarsa. Da zarar an san wannan siffa, shawarar IPsec da tsarin WireGuard guda ɗaya mai dindindin ana karanta su a matsayin bambance-bambancen ra’ayi ɗaya.
Karanta sakamakon tattaunawa, sannan ka tsaya
Shawarar da aka saita ba hujja ba ce ga abin da ɓangarori biyu suka zaɓa. Zaman da ke raye yana ɗauke da amsar, kuma kowane aiwatarwa na yau da kullum na iya ba da rahoto ba tare da kama fakiti ba.
openssl s_client -connect vpn.example.net:443 -brief
ipsec statusall
wg showA cikin fitarwa karanta algorithms da aka zaɓa maimakon jerin da aka bayar. Idan amsar ta fi rauni fiye da yadda manufar ta yi niyya, gyaran yana cikin saitin shawarar a wani ɓangare, kuma rashin daidaituwa a aiwatarwa na zamani yakan bayyana a matsayin tattaunawa da ta kasa maimakon raguwa a hankali.
Sannan ka tuna abin da ƙungiyar ba ta rufe. Hanyoyi, izinin aikace-aikace, rikodi da adanawa shawarwari ne daban da nasu bita, kuma tsarin sirri mai jituwa ba ya faɗin komai game da su. Tattaunawar sirri ta cancanci, amma tana amsa tambaya mafi ƙunci fiye da wadda yawancin mutane suke yi da gaske.
Ka riƙe kalmomin daidai kuma hujja za ta gajarta. Tsari shi ne tarin ayyuka a wani mataki, sirri sashe ɗaya ne, kuma sakamakon tattaunawa shi ne kawai abin da ke bayyana haɗin da kake da shi da gaske. Duk sauran a cikin kwatancen ado ne.