Amagama e-SHA1 digest ku-OpenSSL: kusho ukuthini uhlu oludala
Amagama amadala e-SHA1 achaza ukubhaliswa kwelabhulali, hhayi lokho i-OpenVPN ekwenzile kupakethe. Hlukanisa igama elibhalisiwe, i-digest kanye nomsebenzi oyisebenzisayo.
Uhlu lwakudala lwe-digest lufundwa njengombhalo wezinqumo ze-cryptographic, futhi akunjalo. Amagama afana ne-SHA1, DSA-SHA1-old noma RSA-SHA1-2 ame eduze komunye nomunye kuma-build amadala e-OpenSSL ngoba ilabhulali yabhalisa izindawo zokungena ezimbalwa eduze komshini we-hash ohlobene. Ilebeli le-RSA noma le-DSA kulolo hlu OpenVPN alisho lutho mayelana nalokho elikwenzile kupakethe. Okufundayo uhlu lwelabhulali, hhayi irekhodi lesikhathi.
Izinto ezintathu kufanele zihlukaniswe ngaphambi kokuba noma isiphi isiphetho sibe nomqondo: igama elibhalisiwe, ukubalwa kwe-digest ngaphansi kwalo kanye nomsebenzi oyisebenzisayo.
Ukubhaliswa kuyi-interface, hhayi isilinganiso samandla
Ku-OpenSSL 1.0.2 ithebula lokubhalisa i-digest lixhumanisa amagama, amagama angamanye kanye nokusetshenziswa kufayela elilodwa. Isichazi sakudala se-DSS1 siyisimo esicace kakhulu: sibika ubude bokuphuma kwe-SHA-1 futhi sibiza inqubo yokuqedela ye-SHA-1 kuyilapho sithwele igama eliphakamisa i-algorithm ehluke ngokuphelele. Ngakho izinhlamvu ezengeziwe ekubhaliseni azisho enye i-hash, ukuphuma okude noma izinga elisha lokuphepha.
Umthombo ofanayo ugcina ubudlelwano bamagama angamanye kubafoni bakudala, okuchaza ukuthi kungani uhlu lubonakala lugcwele. Lona umbhalo wokuhambisana, hhayi isethembiso sokuthi umhlinzeki wamanje we-OpenSSL uzobonisa amagama afanayo.
Amagama okusayina awadali amasiginesha
Uhlaka lokusayina lungabopha i-digest ku-interface yelinye i-algorithm ukuze abafoni abakhona baqhubeke bahlanganiswa. Isiginesha yangempela yokhiye womphakathi idinga kokubili ukhiye kanye nesinyathelo sokusayina esiwusebenzisayo, futhi akukho kukho okuhlinzekwa igama elikusimenyu. Umugqa we-digest one-RSA ungamagama umfoni angawasebenzisa, hhayi ubufakazi bokuthi yonke ipakethe ye-VPN yayiphethe isiginesha ye-RSA.
Kulesi sinyathelo lapho imibhalo emidala igxumela khona ezinganekwaneni. Uma udinga ukwazi ukuthi amapakethe aqinisekiswa kanjani, thola inketho ekhethe indlela bese ufunda ukuthi yenzani enguqulweni oyisebenzisayo ngempela. Ikhasi lemanuwali elanikezwa nalolo khisho yilona kuphela incazelo ehambisana nohlelo oluphambi kwakho. Imihlahlandlela egciniwe ichaza ukukhishwa eyayibhalelwe kona, futhi kungase kube ngemuva kwezindlela ezimbalwa zokuqamba amagama.
Thola inketho esebenzise igama
Esimeni sokuqinisekiswa kwamapakethe esibhalwe yi-OpenVPN 2.6, auth ikhetha i-digest esetshenziswa yi-HMAC, ukwakheka kokuqinisekisa umyalezo onokhiye hhayi isiginesha yesitifiketi. I-algorithm yokusayina yesitifiketi se-TLS iyimpawu ehlukile yokuxhawana izandla.
Nge-cipher yedatha ye-AEAD, isilungiselelo esihlukile se-auth siyeka ukusebenza kumsele wedatha, kuyilapho indima yaso ku-tls-auth ihlala ingumbuzo ohlukile. Ngakho uhlu lwe-digest alukwazi ukukutshela ukuthi iyiphi i-hash evikela amapakethe amanje, iyiphi i-TLS suite okwavunyelwana ngayo noma ukuthi isitifiketi sozakwethu sasayinwa kanjani. Kuphela ukulungiselelwa okusebenzayo kanye nenguqulo elingaphendula lokho, futhi kuphela koxhumano oluphambi kwakho.
Bhala phansi okunawo ngempela
Bhala phansi inguqulo ye-OpenVPN, ilabhulali ye-crypto exhunyiwe, izinketho eziqondile kuphrofayela kanye nomphumela woxhumano lwangempela. Lelo qoqo liphendula imibuzo isithombe sesikrini semenyu ye-digest esingakwazi ukuyiphendula, futhi liyasinda ngemva kokuthuthukiswa okulandelayo ngoba libiza izinguqulo hhayi imibono.
Ngaphezu kwakho konke, ungakhethi isibongo sakudala ngoba igama laso lizwakala linamandla noma licace kakhulu. Khetha inqubomgomo esekelwayo yoxhumano lonke, futhi thwala amagama amadala njengerekhodi lokuthi ilabhulali yayiziveza kanjani ngaphambili.