Iphutha le-cipher ye-TLS ku-OpenVPN: qhathanisa izinhlangothi zombili kuqala

Iphutha elithi «akukho cipher eyabiwe» lizwakala njengesilungiselelo esisodwa okufanele sishintshwe, futhi isilungiselelo esishintshwa iningi yiso esingalungile. OpenVPN igcina izinqubomgomo ezihlukene ze-TLS control channel eyenza ukuxhawulana kanye ne-data channel ethwala amaphakethe ngaphakathi komhubhe, futhi iphutha libiza elokuqala ngenkathi abantu belungisa elesibili. Ukuqhathanisa okokuvunyelwa yicala ngalinye, ngokulandelana okulungile, kuguqula ukuqagula kube izinqumo ezimbili noma ezintathu: inguqulo, bese kuba uhlu lwama-suite, bese kuba izifakazelo.

Uma udedela lolo kulandelana, ungachitha ihora ufaka igama le-AES ohlwini olungakaze lubhekwe.

Izinhlawulo zama-cipher ezimbili, futhi eyodwa kuphela ephula ukuxhawulana

I-TLS control channel ixoxisana ngesikhathi se-TLS, futhi inqubomgomo yayo ibhalwa nge- tls-cipher ye-TLS 1.2 kanye ne- tls-ciphersuites ye-TLS 1.3. I-data channel ilungiselelwa ngokwehlukana nge- data-ciphers, lapho ukungafani kukhiqiza ukuxhumana okusungulwayo bese kungakwazi ukudlulisa ithrafikhi. Kokubili kukhiqiza amaphutha akhuluma ngama-cipher, yingakho kudidaniswa. Ukuxhawulana okungaqedi kukhomba i-control channel, kanti umhubhe osunguliwe olahla amaphakethe ukhomba i-data channel.

Funda umyalezo wonke, hhayi umugqa wokuqala. Ukungafani kwenguqulo, i-suite engekho, i-algorithm yesiginesha yesitifiketi echazwa yicala, kanye nokwehluleka kokuqinisekisa igama lomsingathi konke kuphela ngephutha le-TLS, futhi kukodwa kuphela kukho okumayelana nohlu lwakho lwama-suite. Ukuhlukanisa lezi zigaba yikho okuningi kokuxilonga.

Qhathanisa izinguqulo ngaphambi kokuqhathanisa ama-suite

Uhlangothi olulinganiselwe ku-TLS 1.2 kanye nohlangothi oludinga u-1.3 ababi nenguqulo eyabiwe, futhi akukho chungechunge lwe-cipher oluvale lesikhala. Bhala phansi tls-version-min kanye ne- tls-version-max kuzinhlangothi zombili, noma izimiso ezenziwe ngokuzenzakalela zokwakhiwe okusetshenziswayo, ngoba inqubomgomo ye-OpenSSL yesabelo ingakhuphula umkhawulo ngaphandle kokuthi nolulodwa ukhetho lwe-OpenVPN lusho lokho. Uma uhlangothi olulodwa luyisigcawu noma iklayenti lenkampani yangaphandle, iwindi lalo yilokho okuvunyelwa yi-firmware yalo. Ukuqhathanisa ama-suite kuba nencazelo kuphela uma amawindi ehlangana.

Leyo mibhalo kufanele ibize namafayela e-binary angempela. I- openvpn yomugqa womyalo kukhompyutha yakho yokukhama akusona ngempela iklayenti elisingatha iphrofayela elethiwe.

Izinhlu ze-TLS 1.2 ne-TLS 1.3 azihlanganiswa

Amagama ama-suite e-TLS 1.2 abukeka njenge- ECDHE-RSA-AES256-GCM-SHA384 futhi angene ku- tls-cipher, okwamukela uchungechunge lwe-cipher lwe-OpenSSL. Ama-suite e-TLS 1.3 abizwa ngokuthi TLS_AES_256_GCM_SHA384 futhi angene ku- tls-ciphersuites; ukwengeza elilodwa kuchungechunge lwe-1.2 akulungiseleli uhlu lwe-1.3, futhi isihlukanisi singamukela umbhalo ngaphandle kokuqondanisa. Isihlungi esilungile kunguqulo eyodwa asisho lutho ngenye. Bhala ukuthi yiluphi uhlu olwenguqulo iphi.

openvpn --show-tls iphrinta lokho okusekelwa ukwakhiwe kwasekhaya, futhi lokho kuwuhlu hhayi isithembiso: uhlangothi olukude lungase lungavumeli lawo ma-suite, futhi iphrofayela esebenzayo ingase ingawasebenzisi. Kusebenzise ukukhipha ukwakhiwe okungakwazi ukunikeza i-suite nhlobo, bese uqhathanisa izinhlu ezilungiselelwe.

Fakazela ukuxoxisana kuxhumano olusha

Ukuxhawulana okuphumelelayo yiwona kuphela ubufakazi obalwayo, futhi kufanele kuvele kuklayenti langempela ngephrofayela yangempela. Khuphula izinga lemininingwane yeseva, xhuma kanye, bese ufunda emibhalweni yokufaka inguqulo yephrothokholi ne-suite okuxoxiswene ngazo esikhundleni sokucabanga ukuthi inani lokuqala elinikeziwe liwinile. Bese uqinisekisa ngokwehlukana i-data channel ngethrafikhi edlula emhubheni, ngoba ukuxhawulana okusebenzayo ne-data channel ehlulekayo kungamalungiselelo ahlukene. Phinda ngemva kwanoma yiluphi ushintsho lokumisela, ngoba iphrofayela yeklayenti esiphelelwe yisikhathi iyimbangela evamile yomphumela ongelungile.

Uma kungekho kulungiselelwa okwabiwe okugunyaziwe, impendulo ingukuthuthukisa noma uhlelo lokufuduka, hhayi inqubomgomo eyenziwe buthakathaka. tls-version-min ukwehlisa, ukucisha ukuqinisekisa noma ukuvumela wonke ama-suite amadala kususa ukwenqaba ngaphandle kokugcwalisa imfuneko yokuphepha eyakukhiqizayo.

Bhala phansi enguqulweni ekhulunywe ngayo, i-suite kanye ne-cipher yedatha kuthikithi yoshintsho. Umuntu olandelayo ozohlangabezana nephutha le-TLS uzoqala kulo mbhalo, hhayi kuchungechunge lwe-cipher olutholakale kokuthunyelwe kwiforamu.