Wadanne fakitin OpenVPN ne digest na auth ke kariya?
Zaɓin auth yana rufe ƙasa da abin da bayanin martaba ke nunawa. Yi la'akari da tashar, yanayin AEAD da kariyar tashar sarrafawa kafin ka saita manufar digest.
Yawancin muhawara kan digest na OpenVPN suna farawa daga fakitin da bai dace ba. Karanta auth SHA256 a matsayin “karɓi abokan haɗin gwiwa da ke ba da SHA256 kawai” shine abu na farko da ya kamata ka manta. Zaɓin yana ambaton digest don takamaiman fakiti, kuma waɗanne fakiti ne ya dogara da tashar da kuma ko wannan tashar AEAD ce. Yi aiki da tambayoyi huɗu da ke ƙasa bisa tsari; kowanne yana taƙaita abin da saitin zai iya nufi a turaku.
Ambaci tashar da saitin zai kare
OpenVPN yana da tashar sarrafawa da ke ɗaukar zirga-zirgar musafaha na TLS da tashar bayanai da ke ɗaukar nauyin tunnel. Digest na auth yana da rawa a duka biyun, amma ba rawa ɗaya ba, kuma bayanin martaba ba kasafai yake bayyana bambancin ba. Rubuta wanne daga cikin biyun kake ƙoƙarin takurawa kafin ka taɓa fayil ɗin tsari.
Teburin da ke ƙasa shine taƙaitaccen yadda zaɓi ɗaya yake shiga kowane yanayi.
| Context | What the auth digest does |
|---|---|
| Data channel without AEAD | Selects the HMAC digest that authenticates each data packet |
| Data channel with AEAD, such as GCM | Unused for the data channel; the cipher authenticates its own packets |
| Control channel protected by tls-auth | Selects the HMAC digest for that protection, even when data is AEAD |
Tabbatar ko tashar bayanai AEAD ce kafin ka dogara da ita
Idan sifar bayanan da aka tattauna ita ce AES-GCM ko CHACHA20-POLY1305, tashar bayanai tana tabbatar da kanta kuma digest ɗin dabam ba ya yin aikin da ƙila kake tsammani. Dukansu gine-ginen AEAD ne, don haka ana samar da amincin ta aikin da yake ɓoye nauyin. Wannan ba raguwar matsayi ba ce, amma yana nufin manufar da aka tabbatar da ita a matsayin “kowane fakitin bayanai HMAC-SHA256 ne” ba daidai ba ce a zahiri a wannan tunnel. Tabbatar da ƙimar da aka tattauna a cikin log ɗin uwar garke ko fitarwar matsayin abokin ciniki kafin ka sake rubuta manufar.
Bincika sifar da aka tattauna da gaske maimakon jerin da ke cikin bayanin martaba, domin tattaunawa na iya sauka kan wani memba na saitin. data-ciphers AES-256-GCM:AES-128-GCM jerin tattaunawa ne, kuma duka shigarwar biyu AEAD ne, don haka babu ɗayansu da ke cinye digest na auth don kariyar nauyi.
Dauki kariyar tashar sarrafawa a matsayin shawara ta daban
tls-auth yana ƙara HMAC ga fakitin tashar sarrafawa kuma yana ɗaukar digest ɗinsa daga saitin auth, shi ya sa tunnel na AEAD zai iya kasancewa da digest mai ma'ana da aka saita. tls-crypt wani tsari ne na daban da kariyarsa ta tabbata, don haka kada ka ɗauka cewa yana gado kowace sifa ta tls-auth. Karanta takardun aikin da ka zaɓa maimakon canja zato a tsakaninsu.
Abokan haɗin gwiwa biyu dole su yarda kan tsarin da kan alkiblar maɓalli. Digest da ya dace amma fayil ɗin maɓalli da aka yi amfani da shi a alkibla marar kyau yana haifar da musafaha da ke kasawa saboda dalilan da saitin digest ba zai iya bayyana ba.
Ka ware auth daga tattaunawar sifa da takaddun shaida
Saituna uku ne ake haɗawa kullum: digest na auth, jerin sifofin bayanai da tsarin sa hannu na takardar shaida. Canza na farko baya sake bayar da takardar shaida, baya zaɓar digest ɗin sa hannunta kuma baya ƙirƙirar hanyar sunan mai amfani da kalmar sirri. Ma'anar zaɓuɓɓukan ka'ida a cikin tushen OpenVPN 2.6 suna bayyana kowanne a sashensa, wanda shine tunatarwa mai amfani cewa su abubuwa ne daban-daban.
Idan abokin haɗin gwiwa ya ƙi haɗi bayan canjin digest, dalilin yawanci rashin daidaituwa ne a ɗaya daga cikin sauran saituna biyu. Karanta duka ƙarshen biyu kafin ka canza ɗayansu.
Rubuta manufar ka kwatanta ta da tsare-tsare masu gudana
Sanarwa a matakin runduna ya kamata ta ambaci halayen tashar bayanai da aka yarda da su da kariyar tashar sarrafawa da aka zaɓa a bayyane, a cikin jumla ɗaya. Wannan jumlar ana iya gwada ta; “muna amfani da SHA256” ba haka ba. Sannan kwatanta ta da ingantattun bayanan martaba na uwar garke da na abokin ciniki maimakon da samfuri a cikin ajiya.
Kammala ta hanyar rubuta abin da kowane tunnel ya tattauna da gaske da kuma wace hanya ce ta tabbatar da fakitinsa. Layin auth da ake gani a cikin bayanin martaba hujja ce kawai ta niyyar tsari, kuma niyya ita ce mafi arha sashe na binciken.