AES-256 noma i-OFB: khetha ukwakhiwa kwe-cipher ye-VPN okuphelele

I-AES-256 ne-OFB ziphendula imibuzo ehlukene, futhi yilapho ukubuyekezwa kwe-cipher kungahambi kahle lapho kuthathwa njengezinketho eziqhudelanayo. Enye isho i-cipher yamabhulokhi enosayizi wokhiye; enye ichaza indlela i-cipher yamabhulokhi eguqulwa ngayo ibe umfudlana womlayezo omude. Incwadi yokuqondisa yokukhetha ukuvikelwa kufanele ibheke ukwakhiwa konke, kuhlanganise nendlela umamukeli athola ngayo iphakethe elishintshiwe.

Shono izingxenye ezine zokwakhiwa

Ukubuyekezwa ngakunye kwehla emibuzweni emine: iyiphi i-primitive nosayizi wokhiye, imilayezo icutshungulwa kanjani ngayo, umamukeli unqaba kanjani ushintsho olungagunyaziwe, futhi iphrothokholi ilawula kanjani okokufaka, okhiye kanye nempilo yabo. Uhlu lwamagama ajwayelekile luphendula owokuqala kuphela. Owesibili nowesithathu yilapho umehluko wangempela ukhona, kanti owesine yilapho ukuqaliswa kuhlukana buthule. Buza ngalolo hlelo bese ubhala izimpendulo.

I-OFB ivela phakathi kwamamodi obumfihlo embhalweni we-NIST mayelana namamodi e-cipher yamabhulokhi, futhi ubumfihlo yikho kuphela enikwelayo. Iphrothokholi ehlanganisa imodi yokubhala ngemfihlo ne-MAC ehlukile kufanele izihlanganise kahle, futhi igama le-algorithm alikufakazeli lokho kuhlanganisa. Ngakho igama lemodi lodwa alikwazi ukunquma isinqumo sokusetshenziswa.

Umbuzo wesine yilowo umsebenzi wokusebenza angawuqinisekisa ngempela ohlelweni olusebenzayo.

Khetha ukwakhiwa okuqinisekisiwe

Ukubhala ngemfihlo okuqinisekisiwe kunikeza ubumfihlo nobuqotho ndawonye, futhi ukwakhiwa kwe-AEAD kuvikela nedatha ehlobene ekushintsheni ngaphandle kokuyibhala ngemfihlo. Lokhu kuyisici sokuvikelwa kwamaphakethe, futhi akuhlangene nokuthi umuntu ungene ngempumelelo yini.

I-Umhlahlandlela we-Netgate mayelana nezilungiselelo ze-crypto ze-OpenVPN ikhomba ezinkethweni ze-AEAD, kuhlanganise ne-AES-GCM, zomsele wedatha, futhi lolu uhlobo lwenqubomgomo esekelwayo okufanele ilandelwe. Sebenzisa izinketho ezisekelwa ukuphuma okufakiwe namaklayenti angontanga, esikhundleni sokukopisha ukuhleleka kwamamodi omlando ekusetshenzisweni okusha. Ukuhambisana kwakudala, izingemuva ze-crypto nokusekelwa kwe-offload konke kukhawulela okutholakalayo ngempela.

Ukwakhiwa okusekelwayo kunqoba ukuhlanganiswa okuhlakaniphile njalo.

Funda umphumela okuvunyelwene ngawo, hhayi isiphakamiso

I-cipher evela ohlwini olwamukelwe ayisho lutho ngesikhathi samanje. Funda ukuvikelwa komsele wedatha okuvunyelwene ngakho kuklayenti noma esangweni, bese uqhathanisa nenqubomgomo obufuna ukuyiphumeza. Isilungiselelo esisabala inketho endala kontanga omdala sisinqumo sokuhambisana, hhayi isitatimende ngesikhathi esiphambi kwakho.

openvpn --config client.conf --verb 4 2>&1 | grep -Ei 'cipher|data channel|auth'

Esangweni umphumela olinganayo yinhlangano yezokuphepha noma imininingwane ye-crypto yoxhumano, kuye ngeplathifomu. Kuzo zombili izimo isiphakamiso nomphumela kungamazwi ahlukene. Uhlu olunenketho endala kontanga omdala akusho ukuthi sonke isikhathi siyisebenzisa, futhi isikhathi esiyisebenzisayo yikho obudinga ukukwazi.

Rekhoda amaqiniso womabili ndawonye, nosuku kanye nenguqulo yeklayenti.

Linganisa kuphela lokho okungaqhathaniswa

Ukudlula kwedatha kuncike kuhadiwe yamaphoyinti okugcina, ukuqaliswa, ukusheshisa, usayizi wamaphakethe kanye nesilungiselelo esikhethiwe. Ubude bokhiye noma igama elithi OFB akukutsheli ukuthi ukuphuma kuzoshesha kangakanani. Ngakho isilinganiso esivela kwenye isayithi singcono kakhulu njengophawu mayelana nehadiwe ephethwe omunye umuntu. Izinombolo zakho ziqala emaphoyintini akho okugcina.

Ukuze uqhathanise ngokugunyaziwe gcina amaphoyinti okugcina, umthwalo womsebenzi kanye nenqubomgomo edingekayo kungaguquki, futhi urekhode ukuvikelwa okuvunyelwene ngakho kanye nezinguqulo zokuqaliswa. Bese uhlulela umphumela ngokuthi uhlelo lwekhompyutha luqedile yini, lulahlekelwe malini nokuthi amaphoyinti okugcina ayenzani, esikhundleni sokucabanga izindleko ze-crypto ocwaningweni olulodwa lwejubane. Inombolo eyenziwe ngaphansi kwezinye izimo iyindaba, hhayi isilinganiso.

Uma intanga endala ingakwazi ukufeza inqubomgomo, lokho kuyisinqumo sokuhambisana kumnikazi wayo.

Gcina ubuqotho ngaphandle kokuhweba

Ukucisha izahlolo zobuqotho noma ukwamukela iseva engaqinisekisiwe akukona ukuthuthukisa ukusebenza futhi akukona ukulungisa ukuhambisana. Kushintsha isici sokuphepha okwakukhelwe ukwakhiwa. Kuyafana nokwandisa uhlu lwama-cipher amukelwe kuze kuxhume intanga endala: uxhumano luyaphumelela futhi inqubomgomo ayisekho.

Bhala ukwakhiwa okwamukelwe kanye nomnikazi wako encwadini yokuqondisa, ukuze ushintsho olulandelayo luqale ngesinqumo hhayi ngokuthanda.

Lokho okufunayo inqubomgomo ezingakwazi ukuyiphumeza zombili izinhlangothi. Ukuphikisana ngokuthi yiliphi igama elinamandla kakhulu enye ingxoxo, futhi ngokuvamile iphetha ngaphandle kwesinqumo.