Iyini i-nonce ku-VPN, futhi kungani ukuyisebenzisa kabusha kuphula umhubhe
I-nonce iyinqobo yomlayezo ngamunye okumele ingaphindi ngaphansi kokhiye owodwa, futhi ngokuvamile ihamba obala. Ukuyihlela ngesandla iyiphutha okufanele ligwenywe.
Iningi labantu lihlangana negama elithi nonce kuphrofayela ye-VPN futhi licabanga ukuthi ingesinye isimfihlo esabiwe okufanele ikopishwe phakathi kontanga. Akunjalo. I-nonce iyinqobo okumele ingaphindi ngaphansi kokhiye ofanayo, futhi eziningi zezinto zokubethela ezisekelwe ku-nonce ihamba obala. Ukudideka kuhlala kungenangozi kuze kube umuntu uyihlela ngesandla, futhi yilapho ukonakala kwangempela kuqala khona.
I-nonce ivela kuphi ngempela
Ukubethela okuqinisekisiwe kudinga i-nonce ehlukile kumlayezo ngamunye obethelwe ngaphansi kokhiye. Amaphrothokholi ahlangabezana nalesi sidingo ngezindlela ezahlukene: isibali esikhula ngendlela efanayo, usawoti ohlanganiswe nesihlonzi sephakethe, noma inani elingahleliwe elide ngokwanele. I-IKEv2 ishintshanisa ama-nonce ngesikhathi sokushintshana kokuqala, futhi ayizona izimfihlo, kungukufakwa komphakathi kokuthola ukhiye.
Ukwehluka kungaba ngokwakheka noma ngokwamathuba. Isibali asikwazi ukuphinda kuze kube siyazungeza, yingakho iphrothokholi ichaza iphuzu lokuvuselela ukhiye kude ngaphambi kwalokho. Inani elingahleliwe lincike kumabhithi anele ukuze ukungqubuzana kungenzeki ngaphakathi komkhawulo womlayezo, okuyimpikiswano ehlukile enendlela ehlukile yokwehluleka. Imibhalo yephrothokholi isho ukuthi iyiphi indlela esebenzayo, futhi zombili ziphephile kuphela uma umkhawulo oshiwo uhlonishwa.
| Design | Where uniqueness comes from | Exhaustion is handled by |
|---|---|---|
| AES-GCM records | An IV, typically a counter | Rekey before the counter wraps |
| ChaCha20-Poly1305 | A 96-bit nonce from a counter or generator | A message limit per key |
| WireGuard | A per-key 64-bit counter | Rekey at a message cap |
| OpenVPN AEAD | Packet identifier plus implicit key material | Rekey on the packet-id limit |
| IKEv2 | Fresh nonces per exchange | A new security association |
Ukusebenzisa kabusha kubiza ini ngempela
Ukusebenzisa i-nonce kabusha ngaphansi kokhiye owodwa akusona isicubu esincane sokusebenza kahle. Nge-GCM, imilayezo emibili eyabelana i-IV ivumela umqaphi ukuthi abuyisele ukhiye wokuqinisekisa futhi abale i-exclusive-or yemibhalo emibili ecacile. Izakhiwo ezisekelwe ekugelezeni zisebenzisa kabusha ukugeleza kokhiye ngendlela efanayo, okuguqula umbhalo obethelwe ube yindida esikhundleni semfihlo.
Yingakho ukusetshenziswa kuvuselela ukhiye ngaphambi kokuba isibali sizungeze, nokuthi kungani kuma esikhundleni sokuqhubeka lapho isimo sako singaqinisekile. Ukuqalisa kabusha okusetha kabusha isibali ngenkathi ontanga esaphethe ukhiye omdala, noma umshini wokufanekisa obuyiselwe kusithombe esithathwe phakathi neseshini, yisimo esiqondile izikhawu ezikhona ukusivimbela. Akukho mhlaseli odingekayo; imisebenzi evamile yanele.
Kungani ukuhlela ngesandla kuyisixazululo esingalungile
Izibali, usawoti nezihlonzi zamaphakethe ziyimishini yesimo ezabiwe yizinhlangothi zombili. Ukushintsha uhlangothi olulodwa kwenza olunye lungahlangani, futhi umhubhe wehluleka ngezindlela ezibonakala njengenkinga yomzila. Isigxobo esisekelwe ukushintshana okusha kokhiye, okusetha kabusha isimo kuzinhlangothi zombili ngasikhathi sinye.
Amaphasiwedi nama-nonce nawo adlala izindima ezahlukene. Iphasiwedi ingukufakwa okuyimfihlo kokuthola ukhiye; i-nonce ingukufakwa komphakathi kumlayezo ngamunye. Inkambu yephrofayela enelebula i-nonce futhi ecela imfihlo ende ngokuvamile ingukhiye omile noma imfihlo eyabiwe ngaphambili ngaphansi kwegama elihlukile, ngakho funda imibhalo yaleyo nkambu esikhundleni sokucabanga.
Lapho iseluleko siphathelene nokuphathwa kwe-nonce, ukulungiswa inguqulo elungisiwe yomnakekeli, hhayi enye i-cipher noma ukhiye omfushane. Ukushintsha i-cipher ukuze ugweme igama elithi nonce kuhambisa inkinga esikhundleni sokuyixazulula.
Ukufunda isexwayiso ngaphandle kokuqagela
Umgqa we-log mayelana nezibali noma ama-nonce ngokuvamile uchaza isimo esilahlekile hhayi ukuhlaselwa. Hlola ukuthi ingabe ontanga oyedwa uqaliswe kabusha, ingabe umshini wokufanekisa okopishiwe usebenzise kabusha isihlonzi esifanayo, nokuthi izinhlangothi zombili ziyavumelana ngezilungiselelo zokuvuselela ukhiye. Bese usungula iseshini entsha futhi ubheke ukuthi umlayezo uyabuya yini.
Gcina ukuxilongwa kuhlukile ekwehlulekeni okungahlobene. Ikhasi elingalayishi, noma isicelo sobufakazi esizungezayo, akubona ubufakazi bokusebenzisa kabusha i-nonce, futhi ukukuthatha kanjalo kukuthumela kusigaba sokubethela ngenkathi inkinga ingaphezulu kwaso.
Ekubeni ukusetshenziswa okuvamile, umthetho ophephile mfushane: vumela ukusetshenziswa kuphathe i-nonce, gcina izinhlangothi zombili kumavithi asekelwayo, futhi thatha noma yikuphi ukusethwa kabusha kwesimo njengesizathu sokuvuselela ukhiye esikhundleni sokuhlela inani. Uma inkambu yephrofayela ingekho emibhalweni yomthengisi, ungazakheli inani layo. Ukulungisa umhubhe kuqala ngokwazi ukuthi ubheke isigaba esiphi.