Tsohon P12 ya kasa a OpenSSL 3: kalmar sirri mara daidai ko sifar tsohuwar?

Akwatin shigarwa yana ɗaukar kalmar sirrinku, yana juyawa na ɗan lokaci, sannan ya ce ba zai iya karanta kunshin ba. Babu wani abu a cikin wannan saƙon da zai gaya muku ko kun yi kuskuren rubuta kalmar sirrin ko kuma an rufe fayil ɗin da sifar da abokin ciniki baya bayarwa kuma. Waɗannan gazawa ne daban-daban da gyare-gyare daban-daban, kuma zaɓi mara kyau yana kaiwa ga saukar da sigar abokin ciniki wanda kawai ke jinkirta shawarar. Kallon matakin da abokin ciniki ya tsaya a kai yana raba su cikin kusan minti ɗaya.

Abin da ke faruwa tsakanin akwatin tattaunawa da jerin takaddun shaida

.p12 fayil ɗin kwantena ne, ba takardar shaida ba. A ciki akwai jaka ɗaya ko fiye na takaddun shaida da jaka ta maɓallin sirri da aka ɓoye da maɓalli da aka samu daga kalmar sirrinku, tare da duba amincin da ake kira MAC a kan dukan fayil ɗin. Buɗe shi yana nufin tabbatar da wannan MAC, kwance ɓoyewar jaka ta maɓalli, da daidaita takardar shaida da maɓallin da ke fitowa daga gare ta.

Matsalar kalmar sirri tana zuwa a matakin MAC. Matsalar sifar tana zuwa daga baya, lokacin da za a buɗe jaka ta maɓalli kuma ginin da ke yin haka ba shi da wani aiwatarwa na algorithm ɗin da aka ambata a fayil ɗin.

Halin na biyu ya zama ruwan dare a tsarin yau saboda OpenSSL 3 ya matsar da ƙungiyar tsoffin algorithm zuwa mai bayarwa na legacy na zaɓi. Kunshin da OpenSSL 1.x ke fitarwa yawanci suna rufe takaddun shaida da RC2 mai bit 40 da maɓallin sirri da Triple DES mai maɓalli uku. Ginin OpenSSL 3 na asali har yanzu yana tabbatar da MAC da daidai kalmar sirrinku sannan ya kasa a jaka, don haka kalmar sirrin ba ta taɓa zama mara daidai ba kuma sake rubuta ta ba ya canza komai.

Karanta kwantena ba tare da rubuta maɓalli waje ba

Ka nemi ginin OpenSSL a na'urarka da ya nazarci fayil ɗin kuma ya karanta inda ya daina. Dubawa ba tare da fayil ɗin fitarwa ba yana barin maɓallin a ɓoye a faifai, kuma wannan shine kawai dalilin da ya sa wannan matakin ya kasance lafiya a kan mai masaukin da ake rabawa.

openssl pkcs12 -in vpn-identity.p12 -info -noout

A kan tsohon kunshin da daidai kalmar sirri wannan yana buga halayen jaka sannan ya tsaya da digital envelope routines::unsupported. Da kalmar sirri mara daidai za ku sami Mac verify error: invalid password? kafin a karanta kowace jaka. Saƙonnin biyu suna nuni zuwa gaɓar saɓani, kuma wannan shine ainihin bayanin da abokin ciniki ya ɓoye.

Idan gazawar ita ce ta algorithm da ba a tallafa wa ba, sake gudanar da umarnin nan da -legacy aka ƙara ba tare da canza wani abu ba. Wannan alamar tana loda mai bayarwa na legacy don wannan tsari ɗaya kawai. Ba ya sa abokin cinikin VPN ya nazarci tsofaffin kunshin, ba ya taɓa manufofin crypto na tsarin gaba ɗaya, kuma ma'auni ne ba gyara ba, domin fayil ɗin dole ne a maye gurbinsa.

Wace kuskure ke nufin wane mataki

Wani ɗan gajeren tebur yana raba sakamakon uku, kuma kalmomin sun fi muhimmanci fiye da inda akwatin tattaunawa ya bayyana.

Rubutu kamar not enough data ko header too long ba ya cikin ɗaya daga cikin ƙungiyoyin biyu na farko. Matsalar tsari ce: fayil ɗin DER da aka sake masa suna zuwa .pem, kwafin da edita ya lalata ta hanyar sake rubuta ƙarshen layi, ko zazzagewa marar cikawa. Kwatanta checksum ɗin da wanda ya bayar ya aika kafin ka fara duba sifofi.

Ɗauki Mac verify error a matsayin hujja kan kalmar sirri kawai. Yana nufin MAC ɗin da aka lissafa daga abin da ka rubuta bai dace da ƙimar da aka adana ba, wanda ke faruwa da kuskuren bugawa, da kalmar sirri da aka adana daga shigarwa ta baya, ko da fayil ɗin da aka sake fitarwa a ƙarƙashin wata kalmar sirri. Ba ya faɗin komai game da ko algorithm ɗin ciki tsofaffi ne.

Gina kunshin da abokin ciniki zai iya buɗewa da gaske

Da zarar mai nazarin legacy ya tabbatar fayil ɗin yana lafiya, maganin dindindin shine maye gurbi wanda abokin ciniki mai manufa ke tallafa wa algorithm ɗinsa: AES-256-CBC don jaka na maɓalli da takaddun shaida, PBKDF2 tare da SHA-256 don samuwa, da SHA-256 don MAC. Mai kula da PKI naku zai iya fitar da hakan daga kayan maɓalli ɗaya, kuma takardar shaidar da ke ciki ta kasance wadda sabar ku suka riga suka amince da ita.

Lokacin da za ku canza a gida, nemi kayan aikin pkcs12 ya sake rufe jakar maimakon ya fara zubar da su. Ka ajiye duka kalmomin sirri biyu a wajen tarihin shell ɗinka ta hanyar karanta su daga fayil.

openssl pkcs12 -in vpn-identity.p12 -out vpn-identity-aes.p12 \
  -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg sha256 \
  -passin file:old.pass -passout file:new.pass

Canjin da ya yi nasara ba ya faɗin komai game da ƙarewa, amfanin maɓalli, daidaiton maɓallin sirri ko ko sabar ta amince da sarkar mai bayarwa. Sake marufi canjin sufuri ne, ba sabuntawa ba, kuma kowanne daga cikinsu har yanzu yana buƙatar nasa dubawa.

Ka tsallake duk wani girke-girke da ke rubuta maɓallin tsaka-tsaki marar kariya ko kalmar sirri ta fitarwa mara komai kawai saboda abokin ciniki ya karɓi fayil ɗin daga baya. Kunshin da ake iya karantawa da aka cire kariya sakamako ne mafi muni fiye da gazawar shigarwa da ka fara da ita.

Tabbatar cewa abokin ciniki ya shigo da fayil ɗin da ka gina

Bincike mai tsabta a tashar umarni yana tabbatar da kwantena yana da inganci. Ba ya tabbatar da abokin ciniki ya zaɓe shi, domin bayanan da suka rage na iya ci gaba da nuni ga tsohon fayil, kuma wasu abokan ciniki suna adana asalin da aka shigo da shi a ƙarƙashin sunan da ba ka zaɓa ba.

Buga asalin da kuke shirin shigowa da shi kuma kwatanta shi da abin da abokin ciniki ke nunawa a kallon takardar shaida.

openssl pkcs12 -in vpn-identity-aes.p12 -clcerts -nokeys -passin file:new.pass \
  | openssl x509 -noout -subject -dates -fingerprint -sha256

Cire tsohon shigarwar bayanan farko, sannan shigo da shi. Idan abokin ciniki yana rubuta batun ko sawun yatsa da ya loda, daidaita shi da layin da ke sama; idan yana nuna suna na abokantaka kawai, duba ranar ƙarewa maimakon haka, domin yana da wahala a rikita shi da wata takardar shaida daga mai bayarwa ɗaya.

Bayanin PKCS12 ya lissafa zaɓuɓɓukan mai bayarwa, kalmar sirri da fitarwa da aka yi amfani da su a nan. Manufar ita ce a ajiye mai bayarwa na legacy a wajen mahallin abokin ciniki: auna da shi, aika ba tare da shi ba, kuma bar maɓallin sirri a kariya a faifai.