Mac IKEv2 ECDSA: wane nau'in takardar shaida ya shafi abokin ciniki?
A Mac, ECDSA256 a cikin saitunan IKEv2 yana bayanin takardar shaidar asali ta gida, ba ƙofa ko sa hannun mai bayarwa ba. Karanta kowace rawa kafin zaɓi.
A macOS, zaɓin ECDSA a saitin abokin ciniki na IKEv2 yana amsa tambaya mai ƙunci: wace takarda ce ke tabbatar da asalin Mac. Ba ya bayanin takardar shaidar ƙofa, sa hannun da ya bayar da takardar abokin ciniki, ko shawarar ɓoyewa don rami. Ɗaukar waɗannan rawar huɗu a matsayin tambaya ɗaya ta dacewa shi ne hanyar da ake zargin saitin gida daidai da rashin daidaituwa daga bangaren uwar garke. Shawarar ƙarama ce, amma hujjojin da ake amfani da su wajen yanke ta dole su kasance daidai.
Filin yana ambaton takarda ɗaya: asalin gida
Network Extension API na Apple yana bayyana nau'in takarda don shaidar abokin ciniki, ciki har da NEVPNIKEv2CertificateType.ECDSA256, wanda aka rubuta a matsayin nau'in takardar ECDSA p-256. Siffar tana aiki ga takardar da aka bayar ta identityReference ko identityData.
Wannan yana nufin shawarar ta shafi takardar da Mac ke gabatarwa, tare da maɓallin sirri da ke tare da ita. Zaɓi nau'in da ya dace da maɓallin jama'a na wannan takardar ganye kuma ka bayar da asalin ta hanyar da aka goyi baya. Idan Mac ba shi da maɓallin sirri mai amfani don asalin, zaɓin nau'in ba zai iya ceto haɗin ba.
Furofayiloli da aka sarrafa suna yanke wannan shawara ta CertificateType na kayan IKEv2, tare da nuni ga takarda kamar PayloadCertificateUUID. Waɗannan filayen suna da sharuɗɗa da tsari don sigar OS da ake nufi; ƙimar nau'i tsirara da aka kwafa cikin furofayil ba za a iya shigar da ita ba, kuma taga saituna watakila ba ta nuna kowane zaɓi na API. Duba sharuɗɗan kayan don wannan sigar kafin turawa.
Yanke shawara bisa rawa, ba bisa alamar takardar ba
Karanta filin da za ka canza ka tambaya wace takarda yake nuni zuwa gare ta. Alamomi a cikin mai duba takardu suna haɗa jigo, mai bayarwa da algabar sa hannu, kuma ɗaya ne kawai daga cikinsu ya shafi zaɓin asalin abokin ciniki.
| What you inspected | What it controls | Does it choose the Mac certificate type? |
|---|---|---|
| Client leaf public key | The identity the Mac presents | Yes, this is the field's subject |
| Issuer signature algorithm | How the client certificate was signed | No |
| Gateway certificate | What the Mac validates as the peer | No, check it separately |
| IKE and ESP proposals | Algorithms for the tunnel | No, separate proposal settings |
Idan mai duba takardu ya nuna sa hannun ECDSA daga CA, wannan yana bayanin maɓallin sa hannu na mai bayarwa. Maɓallin abokin ciniki da kansa na iya kasancewa RSA har yanzu, kuma filin nau'in ya kamata ya bi maɓallin abokin ciniki maimakon layin sa hannu. Wannan rikicewar ɗaya tana bayanin rahotanni da yawa na "an saita ECDSA amma haɗin yana kasawa". Kwatanta nau'in maɓalli a cikin ganyen da nau'in da aka zaɓa a cikin furofayil kafin ka canza komai.
Shawarar tana sauƙaƙawa da zarar an gano ganyen: ECDSA256 don maɓallin abokin ciniki p-256, wani nau'in da aka goyi baya don wani maɓalli daban. Idan takardar abokin ciniki da maɓallinta ba su dace ba, gyara wannan biyun kafin ka canza furofayil ɗin VPN.
Takardar shaidar ƙofa shawara ce daban
Ƙofar tana gabatar da nata takardar kuma Mac yana tabbatar da ita a kan anka na amincewa da sunan da ake tsammani. Ko wannan takardar tana amfani da ECDSA, RSA ko wani nau'in maɓalli, siffa ce ta uwar garke, ba ta saitin asalin abokin ciniki ba.
Tallafin gida ga takardar abokin ciniki ta ECDSA baya tabbatar da cewa kowace takardar ƙofa, lanƙwasa ko tsarin tabbatar da uwar garke zai yi aiki tare. Duba asalin uwar garke, sarkarta da hanyar tabbatarwa ta IKE a matsayin shigarwar daban, kuma gwada da furofayil ɗin da za a tura da gaske.
Idan takardar ƙofa ce matsalar, alamar tana fitowa ne a lokacin tabbatar da abokin gaba maimakon a zaɓin asali. Karanta matakin kasawa kafin ka canza nau'in abokin ciniki, domin kasawar amincewa da rashin daidaituwar maɓallin abokin ciniki ba su da magani ɗaya.
Sa hannun mai bayarwa da rukunin yarjejeniyar maɓalli ba nau'in abokin ciniki ba ne
X.509 yana ajiye maɓallin jama'a na jigo da sa hannun mai bayarwa a filaye daban. Bayanin maɓallin jama'a na jigo yana bayanin maɓallin da ke cikin takardar; algabar sa hannu tana bayanin maɓallin CA da aikin sa hannu. Na farko ne kawai ya dace da saitin nau'in takarda.
Shawarwarin IKE da Child SA wata gada ce. Nau'in takardar ECDSA ba zaɓin ɓoyewar ESP ba ne, kuma canza rukunin yarjejeniyar maɓalli ba ya zaɓar nau'in takarda. Furofayil na iya samun shawarwari masu inganci da kuskuren nau'in asali, ko daidaitaccen nau'in asali da shawarar da abokin gaba ya ƙi.
Ka riƙe layukan uku daban a cikin rikodin canji: takardar asali da maɓalli, shigarwar amincewar ƙofa, da algabar shawarwari. Haɗa su cikin rubutu ɗaya na "saitunan crypto" yana sa kasawa ta gaba ba za a iya danganta ta ba.
Tabbatar da shawarar da filayen da ka saita
Duba asalin da furofayil ɗin yake nuni zuwa gare shi da gaske, sannan tabbatar cewa takardar a wannan nuni tana da maɓallin jama'a da ake tsammani da maɓallin sirri mai amfani. Nau'in da ake nunawa a UI, takardar da aka nuni zuwa gare ta da maɓallin da ke na'urar dole su dace.
Bayan haka tabbatar da shigarwar ƙofa: sunan uwar garke da ake tsammani, ankar amincewa da hanyar tabbatarwa ta IKE. A ƙarshe, haɗa ka karanta inda musafaha ya tsaya. Kasawa kafin musayar asali tana nuni daga wannan saitin; kasawa a tabbatar da abokin gaba tana nuni zuwa bangaren ƙofa.
Rubuta nau'in da aka zaɓa, nuni zuwa asali da jigon takardar ƙofa a cikin bayanan turawa. Sabuntawar furofayil na gaba na iya canza kowane ɗaya daga cikinsu, kuma ƙimomi uku masu suna ana kwatanta su da sauri fiye da hoton allon panel ɗin saituna.