AH noma ESP? Thatha isinqumo ngalokho okufanele iphakethe likuvikele

Iziphakamiso ezimbili ze-IPsec zingasho i-algorithm efanayo yobuqotho esekelwe ku-SHA kodwa zifune izinqubo zokuvikela ezihlukene; i-AH ne-ESP akuzona izipelingi ezimbili zokuhlelo okukodwa kokuqinisekisa. Funda inqubo kuqala, bese kuba ama-algorithm ayo, bese kuba imodi yayo, futhi ukungacaci okuningi kuyanyamalala. I-AH iqinisekisa iphakethe, kuhlanganise nezinkambu zezihloko ze-IP ezingashintshi ohambweni, kanti i-ESP iqinisekisa futhi ifihle lokho ekukuhlanganisayo futhi ishiye isihloko sangaphandle. Lowo mehluko unquma ukusetshenziswa okuningi kunanoma yiliphi igama le-hash.

Lokho i-AH ikumboza i-ESP ingakumbozi

I-AH inikeza ubuqotho, ukuqinisekiswa komthombo wedatha kanye nensizakalo yokulwa nokuphindwa eyichazayo yona, futhi ayinakho ukufihlakala. Ukumboza kwayo kuhlanganisa idatha yesigaba esiphezulu kanye nezinkambu zezihloko ze-IP ezithathwa njengezingashintshi yimithetho yayo, okuyiyo ngqo ingxenye i-ESP eyishiya ngaphandle kumodi yokuthutha. Uma imfuneko ithi isihloko se-IP ngokwaso kufanele siqinisekiswe, i-AH iyona nqubo ephendulayo.

Lokhu kumboza futhi kuyisizathu sokuthi i-AH ibe buthaka emkhakheni. Izinkambu ezishintshayo njenge-TTL, isamba sokuqinisekisa sesihloko kanye nezinye izinketho azikwazi ukuqinisekiswa ngoba amarutha angazibhala kabusha, ngakho inqubo izibeka ku-zero ngaphambi kokubala ukuhlola. Ngakho noma yini ebhala kabusha amakheli iphula ukubalwa, hhayi inqubomgomo kuphela.

I-NAT iguqula ukukhetha kube umkhawulo

Ukuhumusha amakheli kubhala kabusha umthombo noma indawo okulhwayo esihlokweni se-IP i-AH esisanda kusiqinisekisa, ngakho ukuhlolwa kobuqotho kwehluleka kolunye uhlangothi, futhi kwehluleka njengephutha lenqubo hhayi njengomlayezo ofundekayo. I-ESP ayisiqinisekisi isihloko sangaphandle, yingakho i-ESP enokudlula kwi-NAT isebenza kanti i-AH ngemuva kwe-NAT ayisebenzi. Umhubhe ozinhlangothi zombili ezingemuva kwamarutha ajwayelekile iyona ndawo lokhu okubonakala khona kuqala. Ngakho umbuzo wokuqala awukho wokuthi iyiphi inqubo enamandla, kodwa ukuthi ingabe ukhona umhumushi phakathi kwezinhlangothi.

Uma ekhona, i-AH iyaphuma, futhi ingxoxo idlulela ku-ESP kanye nokukhetha kwayo ama-algorithm. Lona umkhawulo hhayi intando, ngakho indawo yawo isekuqaleni kwesinqumo hhayi ekugcineni.

Imodi iphindaphinda umbuzo

I-ESP kumodi yokuthutha ivikela umthwalo wesigaba esiphezulu futhi ishiye isihloko se-IP; kumodi yomhubhe ihlanganisa yonke iphakethe langaphakathi, kuhlanganise isihloko se-IP sangaphakathi, futhi iyivikele. I-AH inayo imodi emibili efanayo, ngakho i-AH noma i-ESP empeleni iyinhlanganisela ezine ngaphambi kokukhetha noma iyiphi i-algorithm.

Ama-algorithm e-ESP kumodi ehlanganisiwe abe eseqeda ubuqotho ngaphandle kwenqubo yesibili. I-AES-GCM ne-ChaCha20-Poly1305 ziqinisekisa futhi zifihla esakhiweni esisodwa, ngakho ukwengeza i-AH phezulu akuthengi lutho kodwa kudla esinye isihloko kanye nokunye ukuxoxisana. Isakhiwo sivumela i-AH ne-ESP ndawonye, futhi umbuzo ongokoqobo ukuthi ingabe isango lakho nokukhishwa kwakho kuyakusekela lokho kuhlanganiswa nokuthi ngabe ukhona yini ongayinakekela kamuva.

Isikhundla esethembekile se-AH kuphela

Uhlobo lwe-ESP lobuqotho kuphela lugcina i-algorithm futhi lushiya isimangalo sokufihla esikhundleni sokusicupha, futhi ludlula kwi-NAT. Uma idizayini endala yayisebenzisa i-AH ngoba kwakudingeka ukuqinisekisa ngaphandle kokufihlakala, lolo hlobo luyinto yokuhumusha eqondile, hhayi umhubhe ofihliwe onencwadi enamathiselwe.

Ukubona i-ESP esiphakamisweni nakho akubona ubufakazi bokufihla. Funda i-algorithm yokufihla: umhlahlandlela we-NULL usho ubuqotho kuphela, futhi umhlahlandlela wemodi ehlanganisiwe usho kokubili.

Thatha isinqumo ngemibuzo emithathu

Buza ukuthi ukufihlakala kuyadingeka yini, ingabe ukhona umhumushi endleleni, futhi iziphi izinkambu zezihloko okufanele ziqinisekiswe. Lezo zimpendulo ezintathu zikhomba enqubeni eyodwa nemodini eyodwa, futhi ukuzibhala kuthatha isikhathi esincane kunokufunda ama-RFC futhi kamuva.

Bese uqinisekisa lokho okwamukelwe hhayi lokho okwaphakanyiswa. I-ip xfrm state ikhombisa inqubo, imodi kanye nama-algorithm enhlangano efakiwe, futhi ukungafani akufaki lutho, okuwukwehluleka okuhlanzekile kunomhubhe ophuma ngaphandle kokuvikelwa obekuhlosiwe.

Hlukanisa ukwehluleka kokuqinisekisa, ukumboza kwezikhethi kanye namaphutha omzila kulesi sinqumo. Zinikeza izimpawu ezihlukene, futhi ukusola inqubo ngenkinga yesikhethi kuyindlela eqinisekile yokuchitha usuku ugxusha i-hash ngaphandle kwesizathu.