OpenVPN tls-crypt-v2: abin da maɓallin abokin ciniki da naɗaɗɗen blob suke yi
Furofayil na tls-crypt-v2 yana ɗauke da maɓallin sarrafawa na abokin ciniki da naɗaɗɗen kwafi wanda uwar garke kaɗai zai iya buɗewa. Ka ware kowane abu da kowane mataki na janyewa.
Liƙa furofayil na tls-crypt-v2 a cikin tikitin tallafi yana kama da mara lahani har sai ka ƙididdige abin da fayil ɗin ya ƙunsa. Maɓallin tashar sarrafawa na abokin ciniki yana kusa da wani rufaffen kwafi na wannan maɓalli, kuma abu na uku, maɓallin naɗawa, bai taɓa barin uwar garken da ke karɓa ba. Waɗannan ukun suna amsa tambayoyi daban-daban game da riƙe, rabawa da janyewa. Raba su yana warware yawancin muhawara kan manufa kafin su fara.
Abin da furofayil ɗin ke ƙunsa a zahiri
Rabin abokin ciniki na tls-crypt-v2 maɓalli ne da naɗaɗɗen kwafinsa. Abokin ciniki yana amfani da maɓallin fili don kariyar tashar sarrafawa kuma yana ba da naɗaɗɗen kwafin ga uwar garke yayin saitin, don haka uwar garke tana dawo da wannan maɓalli ba tare da ajiye kwafin rubutu bayyananne ga kowane abokin ciniki ba. Maɓallin naɗawa ne ke sa wannan dawo da shi ya yiwu kuma yana gefen karɓa kaɗai. Duk abin da ke ƙasa ya biyo daga inda waɗannan abubuwa uku suke.
| Object | Where it lives | What can open it | What a leak costs |
|---|---|---|---|
| Server wrapping key | accepting servers only | the unwrap step inside the server | every wrapped copy issued to that group becomes readable |
| Wrapped client key | inside the client profile | the server wrapping key | it names a client and exposes its metadata, but not the key inside |
| Client control key | inside the client profile, usable as-is | the client that owns it | someone can open handshakes as that client until the server refuses the key |
Karanta teburin ta hanyar riƙe maimakon ta suna kuma sakamakon zai bayyana. Rashin maɓallin naɗawa shine abin da ya fi tsada, domin babu wani abu a cikin furofayil da zai sake gina shi kuma dawo da gaskiya shine sake fitar da rukunin. Furofayil da ya ɓalle ya fi arha amma ya fi yawa, tunda mutane suna liƙa furofayil a cikin tikiti suna ganin naɗaɗɗen kwafin ya sa fayil ɗin ya zama lafiyayye don rabawa. Gazawar biyun suna buƙatar amsoshi daban-daban, wanda shine dalilin ware abubuwan.
Me ya sa naɗaɗɗen kwafin ba shine duka labarin ba
Furofayil yana ɗauke da kayan aikin abokin ciniki mai amfani tare da naɗaɗɗen takwaransa, don haka kare kwafin ga uwar garke bai ce komai game da kare fayil ɗin ba. Blob ɗin yana da aminci a aika kuma ba shi da aminci a wallafa. Bayanan da ke cikinsa suna ganuwa ga duk wanda ya karɓi blob ɗin, har da duk wanda zai karanta tikitin da aka liƙa shi a ciki daga baya.
Ɗauki furofayil a matsayin takardar shaidar shiga maimakon misalin saiti. Fayil da ya ɓalle yana ba mai shi ainihin abokin ciniki mai aiki har uwar garke ta daina karɓar wannan ainihi, kuma naɗawa ba ta yin komai game da wannan taga. Fitar da furofayil ɗaya ga kowane abokin ciniki domin janyewa ta kasance shawarar fayil ɗaya, kuma yi ajiyar maɓallin naɗawa daban da saitin uwar garke da yake buɗewa. Babu ɗaya daga cikin ɗabi'un da zai gyara furofayil da aka lalata, amma duka biyu suna ƙayyade yadda sauri za a kama na gaba.
Inda ƙugiyar tabbatarwa take a cikin musayar hannu
Ƙugiyar tabbatarwa tana gudana kafin a buɗe tarin TLS, kuma aikinta shine duba bayanan da ke cikin naɗaɗɗen blob. Tana karɓar waɗannan bayanan tare da ƙaramin yanayi da aka rubuta, kuma tana da ƙasa da abin aiki da shi fiye da ƙugiyar tabbatar da ainihi. Tsammanin tana iya ganin sunayen masu amfani, yanayin zaman ko masu canjin ƙari shine hanyar da aka saba rubuta wannan ƙugiya da mugu. Karanta sashin littafin jagora na ƙugiyar da kanta maimakon aron tsammani daga wata ƙugiya.
Matsayin fita nata shine shawarar: sakamakon da ba sifili ba yana ƙin abokin ciniki kuma sakamakon sifili yana barin musayar hannu ta ci gaba. Don haka manufar dole ta faɗi abin da ke faruwa idan bayanai sun ɓace, ba a iya tantance su ko ba a tsammani su ba. Rubuta hanyar ƙin farko, sannan ka yanke shawarar waɗanne ƙima ne abin karɓa.
tls-crypt-v2 /etc/openvpn/server/tcv2-server.key
tls-crypt-v2-verify /etc/openvpn/server/verify-client-metadata.shWaɗannan layuka biyu su ne fagen manufa a uwar garke: ɗaya yana ambaton maɓallin naɗawa, ɗayan kuma yana ambaton shirin da ke yin hukunci kan kowane abokin ciniki. Duk abin da ke da ban sha'awa yana cikin rubutun, wanda ya cancanci sarrafa juzu'i da bita iri ɗaya da kowace ƙa'idar shiga.
Asusu, takardar shaida da maɓallin sarrafawa suna janyewa daban
Karɓar tashar sarrafawa da wuri ba tabbatar da ainihi ba ne, domin yana faruwa kafin duba ainihin TLS da kafin kowace izinin asusu. Kashe asusu, soke takardar shaida da ƙin maɓallin sarrafawa na abokin ciniki ayyuka uku ne da hanyoyi uku. Tsarin da ke yin ɗaya kawai daga cikinsu yana da gibi maimakon manufa. Daidaita ukun da gangan, kuma rubuta wane mataki ke amfani da wace iko.
Lokaci shine bambanci na biyu. Jerin karɓa da ya canza yana aiki ga sabbin musayar hannu, yayin da zaman da aka riga aka kafa ke ci gaba har wani abu ya ƙare su. Ƙidaya shigarwar cikin sabon jerin a matsayin hujjar cewa tsoffin zaman sun ƙare shine yadda abokin ciniki da aka cire ke kasancewa a haɗe na sa'o'i.
Hukumomin da ba a daidaita ba suna barin ramuka biyu da ake samun su cikin sauƙi a aikace. Ana iya kashe asusu yayin da maɓallin sarrafawarsa ke buɗe musayar hannu, kuma ana iya soke takardar shaida yayin da manufar bayanai ke karɓar wannan abokin ciniki. Duka biyu kuskure ɗaya ne a wurare daban-daban, domin ma'aikaci ya ɗauki jeri ɗaya a matsayin dukan iko. Ka ajiye jerin ukun gefe da gefe a lokacin cirewa kuma kuskuren yana bayyana.
Fitarwa da janyewar furofayil
Fitarwa shine rabin mai sauƙi: ƙirƙiri maɓallin abokin ciniki a gefen karɓa, ba da furofayil ɗin ga mai shi ɗaya daidai, riƙe kayan naɗawa a takura, kuma gudanar da shirin tabbatarwa ɗaya a kowace uwar garke mai karɓa. Shiga mai arha halin dukan rukuni ne, ba na sabuwar mashigar ba. Uwar garke ta biyu da tsohon rubutu ko sassauƙa tana zama hanyar da ta fi rauni a tsarin a ɓoye.
Janyewa tana buƙatar matakai ukun a cikin tsari da aka tsara. Ƙin abokin ciniki a cikin ƙugiyar tabbatarwa domin sabbin musayar hannu su kasa, soke takardarsa ta shaida idan ana amfani da PKI, kuma kashe asusun domin izini na gaba ya sami abin da zai ba da izini. Sannan ƙare zaman da tsohuwar karɓa ta yarda, tunda ba za su lura da ɗaya daga cikin ukun ba. Gwada jerin a kan abokin ciniki da za ka iya lalatawa.
Bayanan da ke cikin furofayil shigarwa ne ga wannan manufa, ba hujjar cewa an riga an sami kulawar shiga ba. Takardar ƙira ta OpenVPN 2.6 tana bayyana abubuwan da iyakar da suke ja, yayin da aiwatar da su ya rage ga ma'aikacin.