AES-256-GCM akutholakalanga: amandla ekhasimende noma izingxoxo?

Iphrofayela ye-OpenVPN esebenza kwenye indawo ibika ukuthi i-AES-256-GCM ayitholakalanga, noma ukuthi izinhlangano azinayo i-cipher eyabiwe, futhi umcabango wokuqala ukushintsha iphrofayela. Le mibiko emibili ichaza ukwehluleka okuhlukene. Enye ithi uhlelo lwasekhaya alunayo leyo algorithm; enye ithi izinhlangano zombili zine-algorithm kodwa azinakho ukukhetha okwabiwe. Ukushintsha iphrofayela akulungisi nokukodwa kuze kube yilapho wazi ukuthi iyiphi onayo.

Funda umbhalo oqondile wephutha kanye nohlelo oluyikhiqizile.

Thola ukuthi iyiphi iphutha onayo

Umlayezo mayelana ne-cipher engatholakalanga uvela ekuhlaziyweni kwezinketho emshinini wasekhaya, ngaphambi kokuba noma iyiphi iphakethe ithunyelwe. Kusho ukuthi ifayela elisebenzayo eliphambi kwakho, noma umtapo wolwazi elixhunywe kuwo, akunikezi leyo algorithm. Umlayezo mayelana nokungabikho kwe-cipher eyabiwe uza kamuva, ngesikhathi sezingxoxo, futhi usho ukuthi izinhlangano zombili zisekela i-cipher kodwa azikwazi ukuvumelana ngoyedwa.

Umehluko ubalulekile ngoba owokuqala uyinkinga yenguqulo yesofthiwe kanti owesibili uyinkinga yokuhlelwa. Owokuqala uxazululwa ngenombolo yenguqulo. Owesibili uxazululwa ngokuqhathanisa izinhlu ezimbili.

Ukushoda kwamandla endaweni

Ukwakhiwa kwakudala komphakathi kwandulela izindinganiso zesimanje, futhi uhlelo lwedeskithophu lungaletha injini yalo ehlukile kunephakethe lomugqa womyalo elifakwe eceleni. Yenza izivivinyo kufayela elisebenzayo eliqale ngempela ukuxhumana, bese ukhetha ukwakhiwa okusekelwayo esikhundleni sokufundisa uhlelo oludala i-algorithm entsha.

openvpn --version
openvpn --show-ciphers | grep -i gcm
openvpn --show-tls | head -5

Uma i-AES-256-GCM ingekho kulolo hlu, awukho umugqa wephrofayela ozoyengeza. Isixazululo ikhasimende elisha noma okunye ukwakhiwa, futhi imikhawulo yohlangothi oludala iba umbuzo wokuklama ohlukile.

Kumakhasimende asekelwe ku-OpenVPN 3 injini nemiyalo eyamukelwayo ihlukile kumugqa womphakathi 2.x, ngakho umbhalo wephrofayela ofanayo ungahluleka ngezizathu ezingenalutho oluhlobene nohlu lwe-cipher.

Ukushoda ezingxoxweni

Uma izinhlangano zombili zibala i-algorithm, umbuzo osele ukuthi iyiphi inhlangano enikeza luphi uhlu. I-OpenVPN yomphakathi yashintsha igama lomyalo wezingxoxo: i-ncp-ciphers ku-2.4 yaba i-data-ciphers ku-2.5, futhi ku-2.6 umugqa wakudala we-cipher usebenza kakhulu ekuhambisaneni nasekubuyeleni emuva hhayi ekuchazeni isethi okuxoxwe ngayo.

Yingakho ukushintsha umugqa wakudala we-cipher kuphela kungashiya uhlu lwezingxoxo lungathintekile. Umugqa wakudala usabalulekile ekubuyeleni emuva, futhi lowo umsebenzi ohlukile. Ukuhlanganisa kokubili kukhiqiza izilungiso ezingashintshi lutho olubonakalayo.

openvpn --version | head -2
grep -n -E '^(data-ciphers|ncp-ciphers|cipher|tls-cipher)' server.conf client.ovpn

Qhathanisa izinhlu zalezi zinhlangano zombili kanye nomlayezo wokwenqaba wesiphakeli. Uma ukuhlangana kungenalutho, qondanisa izinhlu ngamabomu esikhundleni sokukopisha inani embhalweni obhalelwe enye inguqulo. Uhlu olubanzi kakhulu lwenza buthaka ngokuthula ukuxhumana ngakunye. Uhlu oluncane kakhulu lushiya ngaphandle uhlangothi obufuna ukulugcina.

Gcina ukuhambisana kucacile

Ukubuyela emuva kohlangothi olulodwa oludala kuyisinqumo esinezindleko: ukusatshalaliswa konke kwamukela inketho ebuthakathaka ukuze idivayisi eyodwa ixhumane. Kubhale kanjalo, futhi kukhawulele ohlangothini oludinga.

Izimo ezimbili zinquma umphumela. Uma iphutha lingasekhaya, shintsha ukwakhiwa. Uma iphutha lisezingxoxweni, qondanisa izinhlu kuzinhlangothi zombili futhi ubhale ukuthi yiziphi izinguqulo ozisekelayo.

Bese ubika iphutha eliqondile nemiphumela yenguqulo namandla elinanyathiselwe. Lolo mbhangqwana luhlukanisa i-algorithm engekho nokungavumelani, futhi lumisa umjikelezo olandelayo wezilungiso zokuqagela ngaphambi kokuba uqale.