Ukubethela okulinganayo vs. ngokhiye womphakathi ku-VPN: okwenziwa yilowo nalowo

Abantu bachaza i-VPN „njengaleyo esebenzisa ukubethela ngokhiye womphakathi“ bese becabanga ukuthi iphakethe ngalinye likhiyiwe ngesitifiketi seseva. Leso sithombe asilungile ngendlela ebalulekile uma ufunda ifayela lokuhlela noma irekhodi lamaphakethe. Ingxenye yokhiye womphakathi ye-VPN imayelana nokuqinisekisa ukuthi ontanga ungubani nokuvumelana ngezinto eziyimfihlo; ingxenye yokulinganisa iyona evikela ngempela ukuhamba, iphakethe ngemuva kwephakethe, kukho konke ukuphila kwesikhathi.

Lezi zingxenye ezimbili zinempilo, izindlela zokuhluleka kanye nezinto ezingashicilelwa ngokuphephile ezihlukene. Uma uzihlukanisa, imibuzo efana nokuthi „ingabe i-RSA 2048 ibuthaka kune-AES-128“ iyeka ukudida, ngoba zazingakaze ziqhathaniswe.

Izenzo ezintathu ezixutshwayo

I-cryptography yokhiye womphakathi iyisambulela phezu kwezinhlobo ezintathu okungenani zemisebenzi ehlukene. Isiginesha ifakaza ukuthi umnikazi wokhiye wangasese ugunyazile umlayezo othile. Isivumelwano sokhiye sivumela ababili ontanga ukuthi bakhiphe imfihlo eyabiwe emananini abawashintshayo obala. Ukubethela ngokhiye womphakathi kufihla idatha ngaphansi kokhiye womphakathi womunye umuntu, ngakho ukhiye wangasese kuphela ongayivula.

Ukuxhawula kwe-VPN kusebenzisa kakhulu ezimbili zokuqala. Isitifiketi akusona ukhiye wokubethela; siyisitatimende esigciniwe esihlanganisa igama nokhiye womphakathi futhi sivumela uhlangothi olunye ukuthi lunqume ukuthi luthemba yini ukhiye olusanda kuwuthola. Isibonelo, ukusungulwa kokhiye ku-TLS 1.3 kusekelwe esivumelwaneni sokhiye (EC)DHE kanye neziginesha zesitifiketi, hhayi ekubetheleni isikhathi ngokhiye womphakathi weseva.

Ukuxhawula kukhiqiza ini ngempela

Ekuxhawuleni kwesimanje, uhlangothi ngalunye lwakha ipheya lokhiye lesikhashana, luhlinzeka izingxenye zomphakathi futhi lubala imfihlo eyabiwe engakaze iwele ucingo. Leyo mfihlo idlula emsebenzini wokukhipha ukhiye ukuze kwakheke ukhiye ohlukile wohlangothi ngalunye, kanye nama-nonce nezinto ze-IV ezidingwa isendlalelo samarekhodi. I-WireGuard yenza lokhu ngokwakheka kwayo okusekelwe ku-Noise; i-TLS 1.3 yenza nge-HKDF phezu kombhalo wokuxhawula.

Ubufakazi besikhathi eside — isitifiketi nokhiye wangasese, noma ukhiye we-WireGuard oqinile — buqinisekisa lokho kuhlinzeka. Busayina noma buhlanganyele kumbhalo, ngakho umuntu wangaphandle akanakukuqeda ukuxhawula esikhundleni sontanga. Ngemuva kwalokho ubufakazi abusebenzi iphakethe ngalinye. Uma busebenza, iphakethe ngalinye lalizodinga umsebenzi wokhiye wangasese, futhi umhubhe ogcwele wawuzokhawulwa umsebenzi ohamba kancane kakhulu kusiteki.

Kulandela imiphumela emibili eseceleni. Okokuqala, ukhiye wesikhathi uhlaziyekile njalo, ngakho umhlaseli ogetshenga ukhiye wesikhathi eside kamuva akanakukhulula izikhathi ezirekhodwe ngaphambili, uma isivumelwano sasingesikhashana. Okwesibili, ukhiye wesikhathi ophuzile ufaka engozini isikhathi esisodwa, hhayi ubunikazi.

Kungani idatha enkulu isebenzisa ukhiye olinganayo

Amasifra alinganayo aphatha umthamo kahle: i-AES-GCM noma i-ChaCha20-Poly1305 icubungula iphakethe ngalinye ngokhiye osevele usememorini, iqinisekisa isihloko futhi inyusa isibali. Uhlangothi olwamukelayo luhlola i-nonce nethegi yokuqinisekisa bese lilahla konke okwehlulekayo noma okuphindayo. Lokhu kushibhile ngokwanele ukusebenza ngesivinini somugqa kuzinto ezijwayelekile, futhi ukwakheka okufanayo kunikeza imfihlo nobuqotho ngokudlula okukodwa.

Ukwakheka futhi yindawo lapho iningi lamaphutha okusetshenziswa lihlala khona. I-nonce ephindayo ku-GCM yephula imfihlo nobuqiniso kanyekanye, ngakho izivumelwano zikhipha ukhiye ngohlangothi futhi zigcina isibali noma inkathi ecacile. Uma ufunda irekhodi lamaphakethe futhi ubude bombhalo obethelwe buhambisana nombhalo ocacile kanye nokwengezwa okungaguquki, isendlalelo esilinganayo siyasebenza, hhayi umsebenzi wokhiye womphakathi iphakethe ngalinye.

Ukuphila, ukugqumisa ukhiye nokufihla okuzayo

Ukhiye wesikhathi wenzelwe ukuphela. I-TLS 1.3 ivumela umlayezo we-KeyUpdate ukuthi ugqumise ukhiye wokuhamba; i-WireGuard ivuselela isikhathi ngemuva kwesikhathi esilungiselelwe noma inani lemilayezo futhi igcine endala isikhashana kumaphakethe asendleleni. OpenVPN ixoxisana kabusha ngokhiye wesiteshi sayo sedatha ngokohlelo, kanti reneg-sec ilawula isikhala.

Akukho kulokhu kugqumisa okufana nokuvuselela isitifiketi. Isitifiketi singase sisebenze unyaka ngenkathi ukhiye wesikhathi ushintsha njalo ngemizuzu embalwa, futhi isitifiketi singashintshwa ngaphandle kokuthinta ukhiye womhubhe osebenzayo. Uma uhlela ukuphela, buza ukuthi iyiphi into oyigqumisayo; impendulo inquma ukuthi amakhasimende azoxhuma kabusha noma avuselele ukhiye kuphela.

Ukufunda ukuhlela nokuxilonga ngaphandle kokuxuba izinto

Ngokomkhuba ukhetha iphrothokholi ephelele kanye nezakhiwo ezisekelwayo, awuhlanganisi eyakho. Ukhiye we---tls-crypt we-OpenVPN uvikela isiteshi sokulawula; isiteshi sedatha sisebenzisa amasifra alinganayo avunyelwene. Okokufaka kwe-PrivateKey ne-PublicKey kwe-WireGuard kuyinto yobunikazi, kanti ukhiye wayo wokuthutha ukhiqizwa ngaphakathi. Ukufunda lezo zinkambu njengohlobo olufanayo lwemfihlo kuholela emaphutheni afana nokunamathisela ukhiye womphakathi lapho kufanele kube khona owangasese.

Gcina izinto zomphakathi zihlukile kwezangasese. Isitifiketi, ukhiye womphakathi we-WireGuard nesigxivizo somunwe kuphephile ukwabelana ngakho kuthikithi. Ukhiye wangasese, ukhiye owabiwe ngaphambili nokhiye wesikhathi okhishiwe akuphephile. Uma uqhathanisa amandla, qhathanisa ngaphakathi kohlobo olulodwa: isihlonzi se-elliptic curve, usayizi we-modulus ye-RSA nosayizi wokhiye we-AES kukala izinto ezihlukene ngaphansi kwezicabango ezihlukile. Incazelo ye-TLS 1.3 iyireferensi ewusizo yokuthi izendlalelo ezimbili zihlangana kanjani, ngisho noma umhubhe wakho ungeyona i-TLS.