Inani lamabhithi efayeleni lokhiye elimile alilona amandla okubhala ngemfihlo e-OpenVPN

Isihloli noma uzakwethu ukhomba inani lamabhithi eliphrintwe ngaphakathi kwefayela lokhiye elimile le-OpenVPN futhi ubuza ukuthi kungani umhubhe ungalusebenzisi uhlobo lokubhala ngemfihlo olwalelo sayizi. Umbuzo uzwakala unengqondo, futhi impendulo ayiyona inombolo: ibhanela libala into yokhiye egciniwe, kuyilapho ukubhala ngemfihlo kusebenzisa kuphela ingxenye edingwa usayizi wokhiye wakho. Ukuthatha leso sibalo njengesilungiselelo samandla kuholela ekuhlelweni okungashintshi lutho. Le fomethi yakhiwe ukuthi igcine into eningi kunalokho okusetshenziswa yinoma iyiphi i-algorithm eyodwa.

Lapha kuhlanganiswa imibuzo emibili: ukuthi ifayela ligcina ingakanani into yokhiye, nokuthi ukubhala ngemfihlo okuvunyelwene ngakho kunamandla angakanani. Owesibili kuphela ochaza umhubhe.

Yini ibhanela eliyibalayo ngempela inani elikulo

Isitsha sihlela into yokubhala ngemfihlo kanye nento ye-HMAC njengezakhiwo ezihlukene, futhi uhlobo olunye lwezinhlangothi ezimbili lugcina amasethi amabili anjalo ukuze uhlangothi ngalunye luthwale okhiye bako. Ikhodi yokubhala ithola inani eliphrintwe ngenani lezakhiwo ezihlelwe, usayizi wazo kanye namabhithi ayisishiyagalombili ngebhayithi ngayinye. Lesi sibalo sisebenza phezu kwesitoreji, hhayi isitatimende sokuthi ukubhala ngemfihlo okukodwa kusebenzisa yonke ibhayithi egciniwe. Isihloko siphinde sibeke isabelo esikhulu sento yokubhala ngemfihlo ukuze ushintsho lwentela yomtapo wezincwadi lungakwazi ukushintsha ngokuthula izilinganiso zefomethi.

Qhathanisa lokhu nokhiye wesitifiketi, lapho inani lamabhithi lichaza ngempela usayizi wento eyodwa. Ukhiye we-RSA wamabhithi angu-4,096 nefayela lokhiye elibhanela lakho lifunda amabhithi angu-4,096 kuyizinto ezihlukene ezinemisebenzi ehlukene, futhi ukuzihlela ngokuthi yizilungiselelo ezimbili zokhiye oyedwa kuletha iziphetho ezimbi.

Amasethi amabili okhiye efayeleni elilodwa

Ingxenye ngayinye yefayela inikeza into yokubhala ngemfihlo nokuqinisekisa ngoba imodi yokhiye owabiwe ngaphambili ivikela amaphakethe kuzo zombili izinhlangothi ngalezo zingcezu ezihlukene. Ukubhala ngemfihlo okusebenzayo kusebenzisa kuphela amabhayithi adingwa usayizi wokhiye wakho, futhi isifinyezo sisebenzisa usayizi waso wokuphuma, yingakho amandla asebenzisekayo avela kuzinketho hhayi kubude befayela. Ukwandisa ibhlokhi ye-hexadecimal akuceli i-algorithm elungisiwe ukuthi isebenzise okuningi kuyo. Ukuhlela umbhalo ngenombolo enkulu kushintsha okuncane nakakhulu.

Uma ngempela ufuna ukhiye omude, isilungiselelo okufanele sishintshwe ukubhala ngemfihlo noma isifinyezo, futhi umakhi ukhiqiza lokho okudingwa ama-algorithm akhethiwe.

Ukufunda iphrofayela kukutshela ukuthi uneyiphi imodi

Ifomethi yefayela elifanayo isebenzela imisebenzi emibili ehluke kakhulu, futhi iphrofayela kuphela esho ukuthi iyiphi onayo. Umugqa wakudala we-secret wenza ifayela libe into yokhiye kuphela yomhubhe, kuyilapho i-tls-auth noma i-tls-crypt ilenza libe ukuvikelwa kweshaneli yokulawula eceleni kwezitifiketi. Akukho kusetshenziswa okukodwa okuliguqula libe ukhiye oyimfihlo wesitifiketi sekhasimende, noma ngabe ibhlokhi libukeka lifana kangakanani. Khomba inketho nenguqulo ngaphambi kokukhiqiza okubambayo, futhi usebenzise umakhi obhaliwe esikhundleni sokwengeza izinhlamvu.

Lowo mehluko uphinde unqume impendulo ekuchayekeni. Ukhiye we-tls-auth ovuzayo awudaluli okhiye besikhathi, kodwa uvumela umhlaseli ukuthi afake ithrafikhi yeshaneli yokulawula, ngakho usadinga ukushintshwa. Ukhiye we-secret ovuzile mubi kakhulu, ngoba kwakuyinto eyayivikela idatha ngokwayo.

Yini ukubuyekezwa kokuphepha okufanele kuyibhale phansi

Bhala izinto ezintathu ngokwehlukana: ukuvikelwa kweshaneli yedatha okuvunyelwene ngakho, ukuvikelwa kweshaneli yokulawula, nokuthi omphethe bayazikhomba kanjani. Umugqa onjenge-data-ciphers AES-256-GCM uchaza owokuqala kuphela, futhi umbiko oma lapho awukwazi ukuphendula ukuthi ishaneli yokulawula ivikelwe noma cha. Ifayela lokhiye elimile lingaphansi kwesigaba sesibili uma lisetshenziswa ne-tls-auth noma i-tls-crypt, futhi alikho kusigaba uma lingasetshenziswa. Ababuyekezi abahlanganisa izigaba bacela ifayela lokhiye elikhudlwana kuyilapho abakufunayo kungukubhala ngemfihlo okunamandla kakhulu.

Uma ifayela lichayekile, lizungezise futhi ulisabalalise kabusha ngeshaneli eligunyaziwe. Ukwengeza izinhlamvu emfihlweni ophuliwe akulona ukuzungezisa, futhi kushiya into echayekile isebenza.

Gcina irekhodi lokuzungezisa kanye nephrofayela elikuyo. Ukubuyekezwa okulandelayo kuzobuza ukuthi yimuphi ukhiye ovikele isiphi isikhathi, futhi ibhanela ngeke likuphendule lokho.