I-TLS 1.3 isathumela igama lesiphakeli ngombhalo ocacile

Ukukhulisa umlaleli ku-TLS 1.3 kushintsha lokho umbukeli angakufunda, kodwa hhayi ngokwedlulele njengoba inombolo yenguqulo isikisela. I-ClientHello isahamba ngaphambi kokuba kuxoxwe nganoma yikuphi ukubethela, futhi ekuxhumaneni okuvamile igama lesiphakeli eliceliwe likhona lapho ngombhalo ocacile. I-Encrypted Client Hello iyindlela eyifihayo, futhi iwukusetshenziswa okuhlukile okunezidingo zayo. Yenza lezi zinyathelo ezine ngaphambi kokubhala inqubomgomo ecabanga okunye kwalokhu kuziphatha kokubili.

Okwembulwa yikuxhawula ngempela

I-TLS 1.3 ibethela isitifiketi sesiphakeli kanye nengxenye enkulu yokuxhawula okulandela i-ServerHello. Konke iklayenti elikuthumelayo kuqala kungaphandle kwalokho kuvikelo, ngoba izikhiye azikabikhona. Isikhombisi segama lesiphakeli siyingxenye yaleyo ndiza yokuqala, yingakho umbukeli ongenzi lutho esakwazi ukuyifunda ngaphandle kokuphula lutho.

Isincazelo se-ECH, RFC 9849, sikushintsha lokhu ngokubethela i-ClientHello yangaphakathi yesiphakeli esisebenzisana. Ukuxhawula kwangaphandle kusala futhi kuthwala igama lomphakathi uxhoxho lwezokuxhumana olungabona, ngakho ukusetshenziswa kusadinga ubunikazi bangaphandle obunengqondo kwabalamuli. Lelo gama langaphandle yingxenye abantu abayilahlekayo lapho belindele ukuthi ukuxhumana kube ngokungaziwa. Kuyigama lokufihla, hhayi igama elifihliwe, futhi kufanele lixazululwe futhi liqinisekiswe njenganoma yiliphi elinye.

Akukho kulokhu okufihla indlela yokulethwa. Amakheli omsuka nawokuyalela, amachweba, usayizi wamaphakethe nesikhathi kuhlala kubonakala, futhi lokho kuvame ukusho okwengeziwe mayelana nokuthi ubani okhulumayo kunegama. Ukuxazululwa kwamagama kanye nobudlelwano ezingeni lohlelo lokusebenza kungenye ingqimba, ngayinye inokubonakala kwayo.

Funda i-ClientHello esikhundleni sokucabanga

Inguqulo ekwi-ServerHello ayikutsheli ukuthi iklayenti likuthumele ini. Bheka indiza yokuqala ngqo, kusukela endaweni emelela umbukeli omkhathazayo.

openssl s_client -connect app.plant.example:443 -servername app.plant.example -tls1_3 </dev/null> 2>/dev/null | head -20
sudo tcpdump -ni eth0 -c 40 'tcp port 443' -w /tmp/tls.pcap
tshark -r /tmp/tls.pcap -Y 'tls.handshake.extensions_server_name' -T fields -e tls.handshake.extensions_server_name

Umyalo wokuqala wenza ukuxhawula futhi ubonisa imingcele okuxoxwe ngayo, kuhlanganise nenguqulo yephrothokholi negama olicele. Eyesibili ibamba amaphakethe okuqala okuxhumana kwangempela, futhi eyesithathu ikhipha inkambu ye-SNI kulokho kubamba. Uma inkambu igcwele, umbukeli omulingisile angayifunda.

Bamba ngokwehlukana ohlangothini lweklayenti nasekhondeni lapho lezi ezimbili zingavumelani, ngoba ukubamba kwendawo kungabonisa igama uhlamvu lwephakathi oluzolibhala kabusha noma ululahle kamuva. Bamba futhi kusuka kusiphathi esingaqedi i-TLS ngokwaso, njengoba ummeleli oqedayo ebona umbhalo ocacile ngokomklamo futhi akafakazi lutho ngalokho okubonwa uxhoxho.

Thatha isandiso se-ECH njengesimangalo, hhayi njengobufakazi

Ukubona isandiso se-ECH ku-ClientHello akusho ukuthi ukuxhumana kwasebenzisa i-ECH. Amaklayenti athumela i-GREASE ECH lapho engenakho ukumisa okusebenzisekayo, ukuze nje ukuxhawula kwawo kubonakale kufana. Isandiso sikhona, i-hello yangaphakathi iyisiheho, futhi igama langempela lisafundeka.

dig +short HTTPS app.plant.example
openssl s_client -connect app.plant.example:443 -tls1_3 -status </dev/null> 2>/dev/null | grep -i -E 'ech|status_request'

Umyalo wokuqala ubonisa ukuthi umsuka ushicilela irekhodi lensiza ye-HTTPS enepharamitha yokumisa ye-ECH, futhi yileyo ndlela amaklayenti afunda ngayo ukhiye. Eyesibili ifuna imininingwane yesimo sokuxhawula, nakuba umyalezo wempumelelo weklayenti uwubufakazi obuqinile. Ukwamukelwa yikho okubalulekile: isiphakeli esingenalo ukhiye ohambisanayo asikwazi ukubethela i-hello yangaphakathi, futhi ukuxhumana kuyahlehla.

Hlola neklayenti, ngoba ukusekelwa kwesiphequluli nokumisa kuyahluka ngenguqulo nangeplathifomu. Inqubomgomo eyakhiwe phezu kuka „iziphequluli zesimanje zisebenzisa i-ECH“ iwukucabanga ngensimu yezinto, hhayi iqiniso ngensimu yakho. Bhala uhlu lwezinguqulo ezixhuma ngempela, bese uhlola eyodwa yakho ngayinye. Ikhasi elifanayo elisebenza kusiphequluli sedesikithophu samanje lingase lingafihli lutho kuklayenti elidala kuxhoxho olufanayo.

Bhala ububanzi bombukeli enqubomgopweni

Shono ukuthi umbukeli uhlezi kuphi nokuthi yini ebonakalayo kulelo phuzu ngaphambi kokunquma ukuthi ukuphathwa kungathembela kuyini. Ukuxhumana kwesiphequluli nesizindalwazi, ukuthuthwa kwe-VPN kwangaphandle kanye nommeleli oqeda i-TLS ngakunye kwembula iqoqo lezinto ezihlukile, futhi umthetho obhalelwe indawo eyodwa awuvamisile ukudluliselwa ngokuhlanzekile kwenye.

Uma ukuphathwa kuncike ekufundweni kwe-SNI, hlola ukuthi amaklayenti asetshenzisiwe aziphatha kanjani lapho i-ECH itholakala nalapho ingatholakali. Bese ubhala umphumela wokuhambisana, ngoba isihlungi esiyeka buthule ukufanisa sibi kunesingakaze sisetshenziswe.

Ekugcineni, gcina ukungaqiniseki embhalweni. Ukushintsha isimangalo sakudala somhlaba wonke ngesisha kushiya igebe elifanayo ngaphansi kwegama elihlukile lephrothokholi, futhi umhloli olandelayo uzokukholwa ngokuqinile okufanayo.