I-DES ne-3DES ku-VPN: kungani zombili ziyizinguquko ezingalungile

Zombili izindlela zokubethela seziphelelwe yisikhathi, futhi azikho okukodwa okuyindawo efanele yethrafikhi entsha. Ukuqhathanisa okuwusizo akukhona i-DES ne-3DES; i-algorithm eseyekisiwe neyegcinwayo. Uma i-gateway isanikeza enye yazo, umsebenzi uwukuthola ukuthi yini eyidingayo bese ususa leso sidingo, hhayi ukukhetha eqinile kakhulu phakathi kwemigwaqo emibili evalekile.

Ukuqhathanisa abantu abasakufuna akulungile

Izimpendulo ezabhalwa ngawo-2000 ziqhathanisa i-DES ne-DES ephindwe kathathu futhi ziphetha ngokuthi i-DES ephindwe kathathu inamandla kakhulu. Lokho kwakunengqondo ngaleso sikhathi futhi akusizi ngalutho manje, ngoba zombili ziyekisiwe ukuvikela ithrafikhi entsha futhi ukukhetha phakathi kwazo wukukhetha phakathi kwemigwaqo emibili evalekile.

I-NIST yahoxisa izinga le-DES ngo-2005, futhi isincomo sayo se-TDEA sahoxiswa ngoJanuwari 2024 ngemuva kokuthi isikhathi sokugcina sokusebenzisa i-TDEA ekuvikeleni okusha kwe-cryptographic sidlule ekupheleni kuka-2023. Lezo zinsuku zichaza ukushintsha, hhayi ukuhlelwa. Isikhathi esifushane noma umlayezo wenani eliphansi awuvuli umbuzo futhi, ngoba isimo se-algorithm asincikile ekutheni ukhiye usetshenziswa isikhathi esingakanani.

Ukuvuselelwa kokhiye kuwukulawula okuhlukile, futhi akubuyiseli imvume.

Hlukanisa izingxoxo nendlela yedatha

Amaphrothokholi e-VPN axoxa ngokuvikelwa ezindaweni ezingaphezu kwelilodwa. Isiteshi sokulawula singasebenzisa isethi eyodwa kuyilapho idatha ethwalwayo isebenzisa enye, futhi uhlu lweziphakamiso lusho kuphela lokho ozakwabo akulungele ukukwamukela. Funda umphumela oxoxiwe, hhayi isiphakamiso. Lowo mehluko uchaza ukudideka okuvamile: i-gateway isabala i-algorithm endala futhi umqhubi acabanga ukuthi iyasetshenziswa, kuyilapho ingase inikezwe futhi ingakhethwa neze, noma ikhethwe kuphela ozakwabo oyedwa wakudala.

Ku-gateway ye-IPsec umphumela ofanele wukuhlanganiswa kwezokuphepha; ku-OpenVPN yikhona ukubethela nezilungiselelo ze-TLS kulo server log yokuxhumana. Kokubili kusho ukuthi yini ekhethiwe. Akukho okukodwa okufakazelwa yinketho endala esekhona efayeleni lokumiswa.

Uma ungakwazi ukubona umphumela oxoxiwe, awukwazi ukusho ukuthi ukubethela kuyekisiwe.

Thola ingxenye esayidingayo

Izidingo zakudala zivela ezindaweni ezintathu: iklayenti lakudala elinganikezi lutho olungcono, inqubomgomo ye-gateway esabala i-algorithm, kanye nedivayisi ekhuluma kuphela iphrothokholi endala. Ngayinye inesixazululo esihlukile. Buza umnikazi wesithiyo ukuthi iyiphi kuzo ngaphambi kokuvula umhlinzeki wokuhambisana, ngoba ukuyivula kuthinta wonke ozakwabo oxhumayo.

Kudivayisi eyodwa engakwazi ukushintshwa okwamanje, beka i-gateway egcinwayo phambi kwayo futhi ukhawulele lokho umngcele owuthwalayo. Lokho kubamba ukubethela kwakudala ngaphandle kokwenza wonke umsebenzisi okude akuzuze njengefa.

Ukuvimbela akulona isichibi, futhi akwenzi umphathi wakudala athembeke.

Fuduka nezihlolo osunazo

Ukufuduka kuphela lapho ozakwabo abahlosiwe bexhuma ngephrofayela egcinwayo, isethi exoxiwe iyileyo obukulindele, futhi uhlelo lokusebenza luyasebenza. Gcina ukuqinisekiswa kobunikazi besiphakeli nezihlolo ze-akhawunti ngaso sonke isikhathi; ukushintsha kokubethela akusona isizathu sokuzikhulula.

openvpn --version
openssl ciphers -v 'DEFAULT:!DES:!3DES'

Bhala izinguqulo zeklayenti ne-gateway eceleni komphumela oxoxiwe, ukuze ukubuyekezwa okulandelayo kusho ukuthi yini eyashintsha ngempela.

Hoxisa imvume endala ngomnikazi wayo, bese uqinisekisa ukuthi ozakwabo onikeza kuphela i-algorithm eyekisiwe manje uyenqatshwa. Ukufuduka okushiya inketho endala ivuliwe wukufuduka okungazange kwenzeke. Gcina ubufakazi bokwenqatshwa kanye nerekhodi loshintsho, ngoba ukucwaninga okulandelayo kuzobuza ukuthi wazi kanjani, futhi umugqa wokumiswa osusiwe uwubufakazi obuthakathaka kunokwenqatshwa okubhaliwe. Engeza usuku lokuhlola nobunikazi bozakwabo kulelo rekhodi ngesikhathi isikhathi sisesisha.

Idatha yomlando iyinkinga ehlukile

Ukufunda ingqolodo evikelwe eminyakeni edlule kungase kudinge i-algorithm endala ngokusemthethweni. Lokho wukususa ukubethela ezintweni ezikhona, futhi akusona umsebenzi ofanayo nokuvikela ithrafikhi entsha.

Gcina umsebenzi onjalo kusiphakeli esihlukanisiwe esinenhloso ebhaliwe kanye nohlu olufushane lwabangakwazi ukuwusebenzisa.

Umehluko ubalulekile ngoba yisona sizathu kuphela esithembekile sokugcina ukubethela okuyekisiwe kutholakala. Kufanelekela ithuluzi elinomkhawulo, hhayi umugqa waphakade kuphrofayela ye-VPN yomphakathi.