Ingabe isitifiketi se-RSA singasebenza ne-dh none ku-OpenVPN?

Nansi ikhophi yomhleli wesiphakamiso ethi dh none eceleni kwesitifiketi esithi RSA, kanye nokungabaza okukhathazayo kokuthi enye yazo kufanele iphosakele. Akukho okulungile. Isitifiketi siyasayina futhi siqinisekise; ukushintshana kokhiye kusungula imfihlo eyabiwe. Lezi yimisebenzi emibili ehlukene ku-handshake eyodwa, futhi i-TLS ivumela isitifiketi se-RSA ukuthi siqinisekise i-handshake esebenzisa isivumelwano sesikhashana kumjikelezo oyi-elliptic.

Ukudideka kuvame ukuza nomhlahlandlela wokufuduka. Uthi shintsha ifayela lamapharamitha e-DH nge-dh none, umfundi ubona ukuthi isitifiketi akusona isitifiketi somjikelezo oyi-elliptic, futhi la maqiniso amabili abhekwa njengokuphikisana.

Kungani lezi zilungiselelo ezimbili zibonakala zihlobene

Ikhophi endala ye-OpenVPN yayifuna ifayela lamapharamitha e-DH ngoba i-Diffie-Hellman yensimu elinganiselwe idinga amapharamitha wesizinda okungavunyelwana ngawo yizinhlangothi zombili. Umyalelo we-dh wawukhombisa kulelo fayela. Lapho ukusetshenziswa kudlulela ku-ECDH, amapharamitha avela kumjikelezo oqanjwe igama esikhundleni salokho, futhi ifayela alisadingeki, okuyilokho okushiwo yi-dh none.

Izitifiketi ziyi-eksisi ehlukile. Zithwala ukhiye womphakathi nesiginesha okufakazela ubunikazi besiphakamiso, futhi lowo khiye ungaba yi-RSA noma umjikelezo oyi-elliptic kungakhathalekile ukuthi ukhiye wesikhathi kuvunyelwana ngawo kanjani. I-handshake esebenzisa i-ECDHE ekuvumelaneni ngokhiye kanye ne-RSA ekuqinisekiseni ivamile futhi isatshalaliswa kabanzi.

Ukuqanjwa kwamagama kwenza ukuhlangana kube kubi nakakhulu. Umjikelezo oyi-elliptic uvela kumagama e-suite e-ECDHE nakwa-ECDSA, ngakho kulula ukucabanga ukuthi noma yikuphi ukuxhumana okukhuluma ngomjikelezo kumele kube nesitifiketi somjikelezo. Akunjalo.

Indlela yokufunda ngendlela efanele igama le-suite ye-TLS 1.2

Thatha i-ECDHE-RSA-AES256-GCM-SHA384. Ithokheni yokuqala iwumndeni wokushintshana kokhiye: i-Diffie-Hellman yesikhashana kumjikelezo oyi-elliptic. Eyesibili iwumndeni wokuqinisekisa: i-RSA. Okusele kuchaza ukuvikelwa kwamarekhodi kanye ne-hash esetshenziswa ku-handshake.

I-suite ye-ECDHE-ECDSA isebenzisa umndeni wokushintshana kokhiye ofanayo ngendlela ehlukile yokuqinisekisa, ngakho idinga isitifiketi somjikelezo oyi-elliptic. I-suite ye-DHE-RSA isebenzisa i-Diffie-Hellman yesikhashana yensimu elinganiselwe ngokuqinisekisa kwe-RSA, futhi leyo idinga amapharamitha e-DH ngempela.

Funda igama le-suite ukusuka kwesobunxele kuye kwesokudla bese wabela ingxenye ngayinye umsebenzi wayo. Lapho amathokheni ehlukanisiwe, umbuzo ushintsha usuka ku-«ingabe isitifiketi sami sihambisana ne-dh none» uya ku-«ingabe isiphakamiso sami sivumela i-suite okushintshana kwayo kokhiye kungadingi ifayela le-DH».

Yini i-dh none eyivimbelayo ngempela

I-dh none itshela isiphakamiso ukuthi singalayishi ifayela lamapharamitha e-DH lensimu elinganiselwe. Akuvimbeli ukuqinisekisa, ukuqinisekiswa kwesitifiketi noma i-TLS uqobo. Kodwa idinga ukuthi ukushintshana kokhiye okuvunyelwene ngakho kungadingi lawo mapharamitha, okusho empeleni i-suite ye-ECDHE noma i-handshake ye-TLS 1.3.

Kulowo mfuno kuqhamuka ukonakala. Uma inqubomgomo ye-cipher ye-TLS yesiphakamiso ilinganiselwe kuma-suite e-DHE, noma iklayenti linikeza wona kuphela, ukususa ifayela lamapharamitha akushiye ndlela esebenzisekayo yokushintshana kokhiye futhi i-handshake yehluleka. Iphutha livame ukuvela phakathi ne-handshake yesiteshi sokulawula, ngaphambi kwanoma yikuphi ukuqinisekiswa komsebenzisi. Funda uhlu lwama-cipher ngaphambi kokusola ifayela elingekho.

Ohlangothini lomjikelezo oyi-elliptic, umjikelezo ukhethwa ikhophi ye-TLS yesiphakamiso, futhi i-OpenVPN inikeza inketho yokuwukhetha emagatsheni amadala. I-TLS 1.3 ibhekana nokuxoxisana kweqembu ngaphakathi kwephrothokholi futhi ayibheki neze ifayela le-DH.

I-dh none ngokwayo akukona ukwehliswa kwezokuphepha. Amandla okushintshana ke ancike kumjikelezo ne-suite okuvunyelwene ngakho ngempela, yingakho isinyathelo esilandelayo siwukubheka lokho okukhethwa izinhlangothi hhayi ifayela elingekho.

Ukuqinisekisa ukuxoxisana ngaphambi kokuhlela

Phakamisa izinga lemininingwane yesiphakamiso neklayenti bese ufunda umugqa wesiteshi sokulawula okhipha i-OpenVPN ngemva kokuxhumana. Ukhipha inguqulo ye-TLS ne-cipher okuvunyelwene ngayo, futhi kubika uhlobo lokhiye lwesitifiketi sozakwethu. Lowo mugqa owodwa uphendula umbuzo ikhophi yokucushwa ewuphakamisa kuphela.

Uma ibonisa i-TLS 1.2 ne-suite ye-ECDHE-RSA nesitifiketi se-RSA, inhlanganisela iyikho kanye lokho i-dh none ekulindele, futhi akukho okumele kulungiswe. Uma ibonisa i-suite ye-DHE noma ukwehluleka kwe-handshake ngaphandle kwe-cipher eyabiwe, ukulungisa kusezinqubomgomo zama-cipher noma emandleni eklayenti, hhayi esitifiketini.

Hlola iklayenti elidala kakhulu ohlose ukulisekela, ngoba iklayenti lamanje lingase lixoxisane nge-TLS 1.3 kuyilapho elidala kakhulu lilinganiselwe kuma-suite e-TLS 1.2. Uma iklayenti elidala kakhulu lingenakho ukuhlangana, khulisa ama-suite avunyelwe noma thuthukisa leyo ndawo yokugcina.

Ungacishi ukuqinisekiswa kwesitifiketi ukuze weqe ukwehluleka kwe-handshake. Ukwehluleka kukutshela ukuthi izinhlangothi azikwazanga ukuvumelana ngokushintshana kokhiye, futhi ukucisha ukuhlola kususa isiqinisekiso sobunikazi ngaphandle kokuxazulula isivumelwano.

Uhlu lokuhlola: ingabe isitifiketi yi-RSA, ingabe i-suite ye-ECDHE ivunyelwe, ingabe ilogi ibonisa leyo suite, futhi ingabe neklayenti elisekelwayo elidala kakhulu liyayixoxisana? Uma zozine kungu-yebo, i-dh none yenza umsebenzi wayo.