Iqembu le-DH elabiwe, izimfihlo ezintsha: kungani ukuhlasela kushibha

Amapharamitha eqembu asesidlangalaleni ngokomklamo, futhi ubusobala obunjalo yibo obenza kube lula ukungawanaki. Ku-Diffie-Hellman enkambu elilinganiselwe, imodulus nesikhiqizi kwabiwe, kuyilapho ama-exponent ayimfihlo kanye nokhiye beseshini abavela kuwo kungabiwe. Isigaba esibiza kakhulu sokuhlasela kwesihlungi senkambu yezinombolo sincike eqenjini hhayi ekushintsheni okukodwa, ngakho iqembu elilodwa elibuthaka elisetshenziswa yonke indawo liba umthwalo owabiwe. Ukubiza amapharamitha ngokuthi asesidlangalaleni kuyiqiniso futhi akuhlangene nendaba, ngoba izindleko ezisetshenziswa kabusha yizindleko zokuhlasela lelo qembu.

Ingxenye esesidlangalaleni ayiyona ingxenye esengozini, futhi ugibe ulapho

Impikiswano evamile yengxenye ithi amapharamitha ashicilelwe kumgangatho, ngakho umhlaseli useyawazi futhi ukuwafihla ngeke kushintshe lutho. Zombili izitatimende ziqinisekile futhi akukho okulandela komunye. Iqembu elizenzakalelayo elithunyelwayo lisesidlangalaleni, futhi iqembu langasese olwakha ngesonto eledlule liyabonakala kunoma ubani oqeda ukuxhawulana. Ukugcinwa kuyimfihlo akuzange kube ukulawula; amandla nokuqinisekisa ukulawula.

Okushintshayo ukuthi zingaki izindawo ezabelana ngobuthaka obufanayo. Inhlangano eyodwa ekhiqiza iqembu layo lamabhithi angu-2048 ikhokhela izindleko zayo zokuhlasela, kuyilapho inani elizenzakalelayo lephrothokholi elikhethwa yizigidi lisabalalisa izindleko ezilodwa kubo bonke. Ngalowo mqondo iqembu elingajwayelekile alilona ngokuzenzakalela elingcono. Iqembu elingajwayelekile elincane kakhulu liyimfihlo eyabiwe encane enamehlo ambalwa phezu kwayo.

Ukuqinisekisa kubaluleke njengosayizi. Umlingani othumela imodulus enezici ezincane, noma engenaso isimo ephrothokholi esilindele, angaveza ulwazi mayelana ne-exponent eyimfihlo ngisho lapho ubude bamabhithi bubonakala buhloniphekile. Imitapo yolwazi yenqaba amapharamitha akhohlakele emnyangweni wokungena yenza umsebenzi wangempela, yingakho ukuhlaziya amapharamitha okubhalwe ngesandla kuyindawo embi yokonga umzamo.

Isibalo sangaphambili sinikeza ini umhlaseli ngempela

Isihlungi senkambu yezinombolo sinesigaba esincike kuphela enombolweni eyinhloko, futhi umphumela waso ungasetshenziswa kabusha ngokumelene nakho konke ukushintshana okusebenzisa leyo nombolo eyinhloko. Yiyo yonke indlela engemuva kokukhathazeka komlando: ingxenye ebiza kakhulu ikhokhwa kanye, futhi izindleko zomkhawulo zeseshini ngayinye elandelayo yehla. Ama-exponent amasha asavikela ukushintshana ngakunye kumqaphi ongenzi lutho, inqobo nje uma iqembu likhulu ngokwanele ukwenza ukuhlunga kungenzeki. Zombili izitatimende ziyavumelana, futhi izimpikiswano eziningi ngalesi sihloko zivela ekukhetheni okukodwa nokulahla okunye.

Iphepha le-Logjam lango-2015 lakhombisa ukwehliswa kuya ku-Diffie-Hellman wamabhithi angu-512 wezinga lokuthumela ngaphandle futhi lalinganisela ukuthi ukuhlasela amaqembu amakhulu asetshenziswa kabusha kabanzi ngezinsiza ezinkulu kungabiza malini. Umbukiso wawucacile, izilinganiso zazingezilinganiso, futhi akukho kukho okwakuwubufakazi bokuthi iseshini ethile ye-VPN yahlukaniswa.

Cabanga ngephepha ngenxa yendlela nangenxa yokwehliswa okukhonjisiwe, hhayi njengesilinganiso sokusabalalisa kwakho. Izibalo zakudala zokuthi zingaki iziphakeli ezabelana ngeqembu elizenzakalelayo zichaza i-inthanethi yalowo nyaka, hhayi inethiwekhi ongayihlola namuhla. Okusemqoka ukuthwala kumbuzo: ingabe amadivayisi akho asaxoxisana ngeqembu elincane noma eliqinisekiswe buthaka?

Okujwayelekile akufani nobuthaka

I-RFC 7919 ichaza amaqembu anamagama enkambu elilinganiselwe ukuze zombili izinhlangothi zivumelane ngeqembu ngesihlonzi futhi zisebenzise inqubomgomo engaguquki. Ukuba ngokwejwayelekile kuyinzuzo, ngoba kususa ukungaqondakali kwezingxoxo futhi kuvumela ukuqaliswa ukwenqaba osayizi abangasekelwe. Iqembu elinegama libuthaka kuphela lapho usayizi walo ungaphansi kwenqubomgomo othi uyayilandela, hhayi ngoba livela embhalweni. Umqondo ofanayo usebenza emaqenjini omkhakhi oyi-elliptic, anokwakheka okuhlukile nezindlela zokuhluleka ezihlukile.

Gcina izakhiwo zihlukene lapho ucabanga ngazo. Isiphetho mayelana ne-Diffie-Hellman enkambu elilinganiselwe asisho lutho nge-X25519, futhi isiphetho mayelana neqembu le-MODP lamabhithi angu-1024 asisho lutho ngalelo lamabhithi angu-3072. Inqubomgomo yamandla yeyomshini ngamunye, yosayizi ngamunye kanye nenguqulo yephrothokholi ngayinye, yingakho ibinzana lokubhala ngokufihliwe okunamandla akuyona isitatimende esingabuyekezwa.

Ukuqinisekisa ubunikazi kungenye ingxenye, futhi akuthathi indawo. Iqembu elinamandla ngaphandle kokuqinisekisa umlingani lishiya umhlaseli phakathi, futhi isitifiketi esivumelekile asikwazi ukusindisa ukushintshana kwamabhithi angu-768. Zihlole njengemigqa emibili ezimele, bese uqinisekisa ukuthi yomibili ixoxisana ngayo ngempela.

Funda iqembu elixoxisiwe ekuxhumaneni kwangempela

Funda iqembu elixoxisiwe kudivayisi hhayi kusifanekiso sokucushwa. Izifanekiso zichaza inhloso, futhi inani elithakazelisayo yilelo izinhlangothi zombili ezivumelane ngalo ekuxhawulaneni kokugcina. Endaweni yokugcina ye-IPsec umphumela wesimo uvamise ukuphrinta isiphakamiso esikhethiwe, kufaka neqembu le-MODP.

Thwebula lowo mugqa ngaphambi nangemuva koshintsho lwenqubomgomo, futhi ugcine yomibili kurekhodi loshintsho. Ukuqhathanisa kuwubufakazi.

ipsec statusall | grep -Ei "proposal|ESP|IKE"
openssl dhparam -in /etc/vpn/dh3072.pem -check -noout

Uma ngemuva koshintsho isimo sisabonisa iqembu elidala, ukuxhumana akuzange kuxoxisane kabusha futhi ukuhlelwa kokucushwa akufakazanga lutho. Qalisa kabusha umlingani noma usule inhlangano yezokuphepha, bese ufunda isimo futhi. Inqubomgomo esetshenziswa kuphela ekuxhumaneni okusha izoshiya imigudu emide kumapharamitha amadala inqobo nje uma isahamba.

Hlola iqembu nobunikazi bomlingani ngokwahlukana

Hlukanisa lokho iqembu elikuvikelayo nalokho okukhonjwa ukuthi ubani ukwelinye icala. Rekhoda indlela yokushintshana kokhiye, usayizi weqembu kanye nendlela yokuqinisekisa njengezinkambu ezintathu, ngoba zihluleka ngokuzimela. Umhubhe owaxoxisana ngeqembu lamabhithi angu-3072 kodwa owamukela noma isiphi isitifiketi awuyona ingozi efanayo naleyo ebopha umlingani futhi esebenzisa iqembu lamabhithi angu-2048.

Bhala imigomo yokwamukela ngaphambi kokuthi ukubuyekezwa kuqale, ukuze umphumela ube ukuqhathanisa hhayi umbono. Usayizi omncane weqembu ngenguqulo ngayinye yephrothokholi, uhlu lwemvume lwamaqembu anamagama kanye nokuqinisekisa komlingani okuphoqelekile kwanele ukwenza isinqumo sibe ngumshini. Ukungaqondakali kulolo hlu yikho okuguqula ukubuyekezwa kube impikiswano, futhi izimpikiswano azilungiswa. Ngaleso sikhathi umphumela uwuhlu lwezindawo zokugcina ezihluleka umthetho oshiwo.

ipsec statusall | grep -Ei "peer|auth|cert"
openssl s_client -connect vpn.acme.example:443 -brief -cipher 'DHE-RSA-AES256-GCM-SHA384'

Vala umjikelezo ngokufunda futhi amanani axoxisiwe ngemuva kokulungiswa. Ifayela lokucushwa elihambisanayo akulona ubufakazi bokuthi umhubhe ulithathile. Umphumela wesimo nokuxhawulana okukodwa okusha kungubufakazi, futhi ukuwaqoqa kuthatha isikhathi esincane kunomhlangano wokuthi ayadingeka yini.