Ukwehluleka kokuqinisekisa i-HMAC yephakhethi ye-OpenVPN: yiluphi ungqimba?

Izinhluleka ezimbili ezibikwa ngamagama afanayo futhi cishe azikho into ezivumelana ngayo. Enye iphakhethi elingaqinisekiswanga ithegi yalo yokuqinisekisa; enye umuntu okwanqatshwa ubufakazi bakhe. Uma uthatha eyokuqala njengeyesibili, uzofuna iphasiwedi eyayingeyona inkinga neze.

Umlayezo usho ungqimba, futhi umsebenzi owusizo ukuqonda ukuthi yiluphi ungqimba ngaphambi kokushintsha noma iyiphi into. Ukuqhathanisa izimbangi ndawonye kuyindlela esheshayo yokubona umehluko.

Izinhluleka ezimbili ezabelana ngegama

Iphutha lokuqinisekisa iphakhethi livela ngenkathi kucutshungulwa ithrafikhi: ithegi noma isifinyezo kuphakhethi olutholiwe akuzange kuhambelane nalokho okubalwe umamukeli. Ukwenqatshwa kwe-akhawunti kwenzeka ngemva kokuhlaziywa kokushintshana kokungena, futhi kusho umsebenzisi hhayi iphakhethi. Umlayezo wesithathu, mayelana nokungatholi i-HMAC kuphakhethi engenayo, wehluke futhi, ngoba lapho iphakhethi yafika ingenaso nhlobo isici sokuqinisekisa ebesilindelekile. Isiqalo esigcwele selogi sikutshela ukuthi iyiphi kulezi zintathu onawo, futhi isiqalo ngokuvamile yiso esiqala ukususwa lapho iphutha linanyathiselwa kuthikithi.

Umehluko ushintsha ukulungisa. Okukodwa kudinga izilungiselelo zesiteshi ezihambelanayo, okunye isimo se-akhawunti, futhi okwesithathu iphrofayili engahambelani nesilaleli efinyelele kuso.

Qhathanisa lokho uhlelo olusebenzayo elukushuthile ngempela

Ifayela elilungile kudiski alifakazeli lutho mayelana nohlelo olwaqala ngaphambi kokuthi lilungiswe. Hlola iphrofayili ekhethiwe, iphoyinti lokugcina elixhumene nalo, nokuthi ngabe isevisi ishuthwe kabusha yini kusukela kushintsho. Qinisekisa futhi ukuthi iphoyinti lokugcina lingelephrofayili, ngoba enye insiza noma enye isevisi ingase ilalele lapho ifayela elidala lilindele okunye.

Ukuthumela kabusha iphrofayili esekelwayo kusuka emthonjeni ofanayo kuwukuqhathanisa okushibhile, ngoba kususa umehluko phakathi kwalokho ocabanga ukuthi kulungisiwe nalokho iklayenti elikuthumelayo ngempela. Ukukhiqiza into entsha yokhiye kuyisinyathelo esikhulu kakhulu, futhi kusiza kuphela uma izinhlangothi zombili zikwamukela ndawonye. Ukushintsha uhlangothi olulodwa endaweni kudala kabusha ukungafani obuzama ukukususa.

Qhathanisa isiteshi sokulawula nesiteshi sedatha

Izindlela ezimbili ziqinisekisa izingxenye ezahlukene zoxhumano futhi zilungiswa ngokwehlukana, njengoba incwadi yezinketho ye-2.6 ichaza. I-tls-auth yengeza i-HMAC kumaphakhethi esiteshi sokulawula futhi ithatha impikiswano yendlela okufanele ibe ngokumelene ezinhlangothini zombili, kuyilapho i-tls-crypt ivikela isiteshi sokulawula ngokhiye owabiwe esikhundleni salokho. Akukho nokukodwa okuwukuhlola kobuqotho besiteshi sedatha uqobo. Ngokhodi yedatha ye-AEAD lokho kuhlola kwakhiwe ngaphakathi kwikhodi, ngakho isifinyezo se-auth esihlukile asisetshenziswa ngendlela esetshenziswa ngayo ngokhodi engeyona ye-AEAD.

Lokho kusho ukuthi umugqa we-auth okopishwe ekusetshenzisweni okusebenzayo okungeyona ye-AEAD ungase ungabi nandaba ekusetshenzisweni kwe-AEAD, futhi ukusetshenziswa kwe-AEAD kusengahluleka esiteshini sokulawula uma ukhiye we-tls-auth noma indlela yawo kungalungile. Qhathanisa isilungiselelo ngasinye nohlangothi olulwa nalo, hhayi nokulungiselelwa okukhunjulwayo.

Qhathanisa ukulungisa nempawu oyishiyayo

Ukucisha ukuqinisekiswa kwephakhethi kuthulisa isexwayiso futhi kususa ukuhlola okuthole ukungafani, okuyinto engafani nokulungisa iphrofayili. Buza ukuthi iyiphi impawu oyishiyayo nokuthi ngabe umklamo usamile yini ngaphandle kwayo.

Funda isehlakalo sokuqala esifanele kuzinhlangothi zombili ngaphambi kokushintsha noma yini, bese ushintsha kuphela ukungafani okushiwo yiso.

Uma umzamo olandelayo uqhubekela embhalweni wesitifiketi noma wokungena, lokho kuyinqhubekela phambili hhayi ukuhlehla: ungqimba lwephakhethi manje luyavumelana futhi uxhumano luye lwaqhubeka. Rekhoda izilungiselelo ezidale ushintsho, ukuze umuntu olandelayo azuze incazelo esikhundleni semfihlo.