Ilogi ye-OpenVPN: i-cipher yesiteshi sokulawula neyesiteshi sedatha

Umugqa welogi oqoka DHE-RSA-AES256-SHA awusona isifinyezo salokho konke ukuxhumana. Ungowokuxhumana ngesandla kwe-TLS okuvikela isiteshi sokulawula, futhi ithrafikhi engaphakathi komhubhe ingahle ibethelwe ngokuphelele ngenye into. Ukukubika njenge-cipher yedatha ye-VPN yiphutha okufanele ligwenywe.

Imiphumela emibili ibalulekile, futhi iphendula imibuzo ehlukene. Eyokuqala i-TLS suite okwavunyelwana ngayo yesiteshi sokulawula; enye i-cipher yedatha yamaphakethe umhubhe owuthwalayo.

Imiphumela emibili, imibuzo emibili

Isiteshi sokulawula sithwala ukuxhumana ngesandla kanye nemilayezo yokuphatha phakathi kontanga. I-cipher yaso ikhethwa isitaki se-TLS, ngakho igama lilandela imithetho ye-TLS. Isiteshi sedatha sithwala ithrafikhi yabasebenzisi futhi sihlelwa ukuxoxisana kwe-cipher kwe-OpenVPN uqobo.

Nquma ukuthi uphendula umbuzo uphi ngaphambi kokufunda noma yimuphi umugqa. Ukuthi umhubhe ubethelwe yini nokuthi ukuxhumana ngesandla kuqinile yini akusona umbuzo owodwa.

Isiqeshana selogi esibonisa imigqa yomibili yiso esiwusizo. Funda umugqa wokulawula ukuze uthole inguqulo ye-TLS ne-suite, nomugqa wedatha ukuze uthole i-algorithm evikela ikhwelayo ngempela.

Hlaziya igama le-suite ye-TLS ngokwengqikithi yalo

Egameni lomlando lesitayela se-OpenSSL elifana nelithi DHE-RSA-AES256-SHA, ingxenye ngayinye ichaza isinqumo esihlukile. DHE isivumelwano sokhiye se-Diffie-Hellman sesikhashana, RSA indlela yokuqinisekisa, AES256 i-AES-256 kumodi ye-CBC yamarekhodi e-TLS, futhi SHA i-MAC yerekhodi esekelwe ku-SHA-1.

Ingxenye yokugcina ayisona isigxivizo seminwe sesitifiketi, futhi ukusifunda kanjalo kuyiphutha elivamile. Igama futhi alikutsheli inguqulo yeprotocol lodwa, ngoba i-TLS 1.3 isebenzisa uhlelo lokwetha amagama oluhluke ngokuphelele. TLS_AES_256_GCM_SHA384 ilandela lelo fomu elisha, lapho i-hash yokugcina iyingxenye yokwakhiwa kwe-suite hhayi ukukhethwa kwe-MAC. Sebenzisa ukufunda ngezingxenye esitayeleni esidala sokwetha amagama kuphela.

Isithenjwa sama-suite e-OpenSSL sixhumanisa lawa magama nezincazelo zawo uma ingxenye ethile ingaziwa.

Funda umphumela wesiteshi sedatha wethrafikhi ethwalwayo

Ethrafikhi ethwalwayo, funda umugqa wesiteshi sedatha kuleyo nhlangano. Ekuhlelweni, data-ciphers uhlu luyisethi evunyelwe, akusona ubufakazi bokuthi i-algorithm ethile yavunyelwana ngayo. Ilogi irekhoda ukukhetha; ukuhlela kurekhoda uhlu lwezinketho.

I-cipher ye-AEAD efana ne-AES-GCM ithwala ukuhlolwa kwayo kobuqotho, ngakho i-HMAC ehlukile yesiteshi sedatha ayiyona ingxenye yaloyo ndlela.

auth isiyalelo asithuthukisi i-TLS, izitifiketi noma i-cipher yedatha. Sikhetha i-digest ezingxenyeni zeprotocol ezisasebenzisa eyodwa, futhi nge-cipher yedatha ye-AEAD ayikho i-HMAC yedatha ehlukile okufanele ihlelwe.

Gcina ukuhlolwa kobuwena ngaphandle komphumela we-cipher

I-algorithm yesiginesha yesitifiketi, ukuqinisekiswa kochunge lwettemba nokuqinisekiswa kwegama lentanga kwezinye izici ezintathu igama le-cipher elingasho lutho ngazo. Isitifiketi esiphelelwe yisikhathi siyahluleka noma i-suite inamandla kangakanani. Igama leseva elingafani nalo liyahluleka ngendlela efanayo. Ukulungisa isilungiselelo se-digest kuphrofayela akulungisi noma yikuphi kwalokhu okubili.

Gcina lokho kuhlolwa kumanothi okubuyekeza eduze komphumela we-cipher, hhayi kuhlanganiswe kuwo.

Rekhoda imiphumela evunyelwene ngayo kusukela kunhlangano yamanje

Thatha imiphumela kuxhumano lwamanje futhi urekhode izinguqulo zeklayenti neseva kanye nayo. Ilogi eyengeza kuphela ingaba nomugqa wenhlangano endala, futhi ukuwucaphuna njengowamanje yikho okwenza inkinga eselungisiwe ibonakale isaqhubeka.

Ukubuyekeza inqubomgomo, nika umnikazi wokuhlelwa inguqulo ne-suite ye-TLS evunyelwene ngayo, i-cipher yedatha ekhethiwe kanye nezilungiselelo zokuqinisekisa isitifiketi kanyekanye. Shintsha leso sigaba, bese ufunda ilogi entsha ukuqinisekisa amanani amasha avunyelwene ngawo.