Okhiye abangama-8192-bit bavimba ukuxhawulana; i-DH engama-1024-bit iyenqatshwa

Kusiseva esisodwa amaklayenti ayama isikhashana bese ephinda axhumeke, kanti esinye senqaba ukuxhumana ngokushesha ngomlayezo mayelana nosayizi wokhiye. Zibonakala njengezinkinga ezihlukene futhi iyinkinga eyodwa ekhomba izinhlangothi eziphambene. I-cryptography yokuxhawulana inezindleko ezikhula ngosayizi wepharamitha, futhi inesisekelo esiphansi izincwadi zesimanje ezingehli ngaphansi kwaso. Ukulinganisa usayizi wempahla uhlu lokuhlola, futhi into yokuqala ukunquma ukuthi yiliphi kulamaphutha amabili onalo ngempela.

Funda ukwehluleka ngaphambi kokukhiqiza kabusha noma yini

Isikhathi sikutshela ingxenye enkulu yako. Ukuxhawulana okuthatha amasekhondi ambalwa bese kufa ngokuvamile kusho ukuthi ukubala kweqa ukubekezela kohlangothi olunye, okukhomba emiparamitha emikhulu kakhulu kuhadiwe noma esikhathini esibekiwe. Ukwenqatshwa ngokushesha okusho usayizi wokhiye noma weqembu kukhomba kolunye uhlangothi, empahleni izincwadi ezingeke ziyamukele nhlobo.

Lokhu okubili kudinga izilungiso eziphambene, futhi yilapho iningi lemizamo lihluleka khona. Ukwakha kabusha ipharamitha engama-8192-bit kuklayenti osele lenqabe iqembu elincane kwenza icala elihamba kancane libe libi kakhulu ngaphandle kokusiza ilelihamba ngokushesha. Bhala ukuthi yiluphi uphawu olubonile ngaphambi kokuthinta ifayela.

Bese uhlola ukuthi kudingeka ini kohlangothi olunye. Iseva elilungiselelwe iqembu elikhulu lomkhakha ophelayo iphoqa iklayenti ngalinye ukuthi lichithe isikhathi se-CPU esifanayo kunoma yikuphi ukuxoxisana kabusha, hhayi nje lapho lixhuma. Uma inkinga ivela ngesikhathi esilinganayo hhayi lapho kuqalwa, leso sikhathi siyisikhombisi esinamandla sokuthi yisiphi isilungiselelo esibizayo. Ukuxoxisana kabusha kuphinda ukubala konke, ngakho ukuma okuphindayo njalo ngehora ngokuvamile kuyindleko efanayo ekhokhwa futhi.

Icala elihamba kancane: impahla abakwazi ukuyikhokha kuhadiwe

Umsebenzi we-Diffie-Hellman ne-RSA ukhula ngokushesha ngosayizi wokhiye, futhi konke lokho kwenzeka ngaphambi kokuthi noma yikuphi ukuxhumana kugeleze ethubeni. Kumuthi omncane noma kuklayenti elinamandla aphansi, iqembu elikhulu ngokwanele lingaphusha ukushintshana kudlule isikhathi esibekiwe sohlangothi olunye, ngakho ukuxhumana kuzama futhi noma kubonakale kumile ngaphandle kwanoma yiliphi iphutha.

Isilungiso ukwehla uye osayizini osekelwa yilolo nalolo hlangothi futhi ongabalwa ngokukhululeka yiyo yonke idivayisi. Ukhiye we-RSA wamabit angama-2048 neqembu lamabit angama-2048 kuhlala kuyisisekelo esihambisana kabanzi; okukhulu kusiza kuphela uma zonke izinhlangothi zivumelana futhi i-CPU ingakukhokhela ekuxoxisaneni kabusha ngakunye. Konke okungaphezu kwaleso sisekelo ukushintshana okwenziwe ngamabomu, hhayi ukuthuthukisa.

Usayizi akuwona amaphuzu, futhi inombolo enkulu kunazo zonke kuthebula lokuqhathanisa akuyona ngokuzenzakalela impendulo efanele. Khetha inani elincane kunazo zonke elivunyelwa inqubomgomo yakho futhi elamukelwa yizo zonke izinhlangothi, bese ukala ukuxhawulana esikhundleni sokucabanga ukuthi kube ngcono. Iqembu elincane elisadlula isikhathi likutshela ukuthi usayizi awusizange ube yindaba yonke.

Icala elisheshayo: iqembu izincwadi ezilinqabayo

Izakhivo zesimanje ze-OpenSSL zinqaba ngqo amaqembu amancane kunazo zonke omkhakha ophelayo, futhi izinga lokuphepha elinyusiwe liphusha isisekelo siphansi ngisho phezulu. I-firmware yomuthi eletha ifayela lamapharamitha eminyaka engamashumi ngayo iwumthombo ojwayelekile, futhi uphawu ukuxhumana okwehluleka ngokushesha ngomlayezo osho iqembu noma usayizi wokhiye. Akukho lutho kulokho kwehluleka okuhamba ngezikhathi, futhi yikho okukwenza kube lula ukukubona.

Shintsha ifayela esikhundleni sokuhlela ukulungiselelwa ukuze weqe ukuhlola. Khiqiza iqembu lamanje, liqinisekise, bese ulifaka lapho i-daemon ilifunda khona ngempela. Gcina ifayela elidala kuze kube yilapho iklayenti lixhuma ngempumelelo nelisha:

openssl dhparam -out /etc/openvpn/ffdhe2048.pem 2048
openssl dhparam -in /etc/openvpn/ffdhe2048.pem -check -noout
ls -l /etc/openvpn/ffdhe2048.pem

Umyalo wokuhlola uqinisekisa ifayela futhi awunyathelisi lutho olusizayo uma udlula; uhlu luqinisekisa ukuthi ushintshe ifayela elilayishwa yisevisi, hhayi ikhophi endala eseceleni kwalo. Qondisa ukulungiselelwa kuleyo ndlela, qala kabusha i-daemon, futhi uqinisekise ukuthi iklayenti elahluleka ngaphambili manje liqedela ukuxhawulana.

Uma iseva ibuye isethe izinga lokuphepha noma iphrofayela yesitifiketi, zifunde ngaphambi kokuphetha ngokuthi iqembu lalilimaza. Iphrofayela edinga ikilasi eliqinile ingase lenqabe impahla obekungayamukela okumisiwe, futhi ukususa leso silungiselelo ukushintsha okuncane kunokucisha ukuhlola emhlabeni wonke.

Khetha usayizi wohlangothi olunye nehadiwe

Thola ukuthi ingaphenduli kahle ini ekugcineni okukude ngaphambi kokukhiqiza into eyivelakancane. Idivayisi endala kakhulu eqenjini lamabit angama-2048 yidivayisi okufanele ishintshwe, ngoba ukuqondisa iseva eqenjini elibuthakathaka kushintsha isikhalo sokuhambisana sibe ukuphazamiseka. Izilungiso eziqhubekayo ziya kusoftware emisha, hhayi emiparamitheni emidala. Konke okuhlukile kwesikhashana kulo mkhakha kunendlela yokuba ukulungiselelwa okungunaphakade.

Lapho i-CPU yeseva iwumkhawulo, shintsha i-algorithm esikhundleni sokwehla ngaphansi kwenqubomgomo. Ukushintshana kokhiye kwe-elliptic curve njenge-X25519 kushibhe kakhulu kuneqembu elikhulu lomkhakha ophelayo futhi kusekelwa kabanzi, okukwenza kube impendulo engcono esikhalweni sokwenza kusebenze kunemodulus encane ye-RSA.

Noma yini oyikhethayo, ihlole ngokuxhumana okukodwa kwangempela futhi ubuke ukuthi ukuxhawulana kuthatha isikhathi esingakanani, hhayi nje ukuthi ekugcineni kuyaxhuma. Ukuxhumana okuphumelela ngamasekhondi ayishumi nambili kunembangela efanayo nokuphuma kwehluleka kwaweshumi nanhlanu.

Bhala ukukhetha ukuze ukwakhiwa kabusha kungakususi

Gcina ifayela lamapharamitha ngaphansi kokuphathwa kokulungiselelwa futhi ubhale eceleni usayizi, isizathu nedethi. Iseva eyakhiwe kabusha eqala ngokuthula ukukhiqiza okumisiwe kwayo iyindlela iphutha elifanayo elibuyela ngayo ngemva kwezinyanga eziyisithupha ngaphandle kokuthi kube noyichaza isinqumo sokuqala.

Bhala ulwazi olufanayo eceleni kwe-endpoint nephrofayela, ukuze ukubuyekezwa kungadingi ukukwakha kabusha kusukela kusayizi wefayela. Uma ukuxhumana okulandelayo kuma, lowo mbhalo umehluko phakathi kokuhlola kwemizuzu emihlanu nophenyo olusha. Futhi kuvimbela unjiniyela olandelayo ukuxazulula icala elihamba kancane ngesilungiso esihloselwe elisheshayo.