Kuqumani isiphakamiso se-IPsec? Amasimu e-IKE ne-ESP

I-IKE iqala, izinhlangothi zombili zimemezela i-AES, futhi ithumbu lihluleka nge-NO_PROPOSAL_CHOSEN. Ilogi isho isiphakamiso kodwa ayisho isimu esingafananga. Isiphakamiso siyisinikezelo esisodwa esiphelele, futhi isimu esisodwa esingahambisani senza inhlanganisela yonke ingasebenzi, hhayi lowo mugqa kuphela. Ukusifunda njengesaka lezinqumo zama-algorithm ezizimele yisizathu esivamile sokuthi ukungafani kuhlale kungabonakali.

Izingxoxo ezimbili ezinohlu lweziphakamiso oluhlukene

I-IKEv2 yakha izinhlangano zokuphepha ezimbili. Eyokuqala yi-IKE SA, evikela ukushintshana kokulawula ngokwako, futhi eyesibili yi-CHILD SA, ethwala umkhondo wakho nge-ESP. Ngayinye inohlu lwayo lweziphakamiso, futhi uhlangothi lungamukela olunye futhi lunqabe olunye.

Lokho kwehlukanisa kuchaza ukudideka okuvamile: i-IKE SA esebenzayo ifakazela kuphela ukuthi ama-algorithm esiteshi sokulawula afanana. Uma isiphakamiso se-CHILD sehluleka, ithumbu alithwali ngisho iphakethe elilodwa, nakuba isigaba sokuqala siphelile futhi amalogi abonakala ephilile phezulu.

Ukuhleleka ngaphakathi kohlu ngalunye nakho kubalulekile. Ophendulayo ukhetha kusukela kuzinikezelo ezihleliwe zomqali, ngakho ukuhambisa ingeno ebanzi ehambisanayo ngaphezu kwencane kushintsha ukuthi iyiphi isethi ezofakwa ngaphandle kokushintsha igama le-algorithm elilodwa. Phina lokho kuhleleka kusimo esimisiwe esikhundleni sokuthembela kokuzenzakalelayo. Ukuhleleka okuzinzile kwenza nokuqhathaniswa kwamalogi phakathi kwezindawo kube nencazelo.

Yimaphi amasimu akusiphakamiso sini

Isethi yamasimu incane, kodwa ayifani ezingxoxweni ezimbili. Funda ithebula umugqa ngomugqa, ngoba isimu kukholomu eyodwa singase singabi khona kwelinye. Isakhiwo somusho siyahluka kuye ngokuqaliswa; imibhalo yeziphakamiso ye-strongSwan iyireferensi eyodwa eqondile.

Isimu sokubethela sisho i-cipher futhi, ezakhiweni eziningi zomusho, ubude bokhiye wayo. Isimu sobuphelele sisho i-hash esetshenziselwa ukuqinisekisa umbhalo obethelwe, futhi i-PRF isho umsebenzi okhipha into yokhiye ye-IKE SA. Iqembu le-DH lisungula into entsha yemfihlo eyabiwe, yingakho livela kuzinhlangothi zombili kodwa ngezinhloso ezahlukene.

Izinombolo zokulandelana ezinwetshiwe zingezomkhondo wedatha kuphela. Zandisa isikhala sokulandelana futhi zixoxwa njengengxenye yesiphakamiso se-CHILD, ngakho ukungafani lapho kunqaba isinikezelo se-CHILD kuyilapho i-IKE SA ihlala ingathintekile.

Isinikezelo esisodwa esiphelele sikhethwa kanjani

Isiphakamiso ngasinye siyisethi, futhi ophendulayo ufuna isethi lapho isimu ngasinye esidingekayo samukelekile. Ohlu ezimbili zingaqukatha i-AES ne-SHA-256 futhi zingabi nangeno ehambisanayo, ngoba ubude bokhiye, i-PRF noma iqembu le-DH kuyahluka. Ukuqhathanisa kwenzeka ngesiphakamiso ngasinye, hhayi nge-algorithm ngayinye.

Uma kungafani lutho, ophendulayo uthumela i-NO_PROPOSAL_CHOSEN nohlobo lwe-SA olwehlulekile. Funda ukuthi isaziso sibhekisa kuluphi uhlu lweziphakamiso ngaphambi kokuhlela isimo esimisiwe; ukushintsha ama-algorithm e-ESP lapho isiphakamiso se-IKE senqatshwa kumosha umjikelezo wokulungisa amaphutha.

Kufanele wazi ukuziphatha kokukhetha uma ulungisa iphrofayela. Ezinye izinto zokuqalisa zithanda ukuhleleka komqali, ezinye zihlela kabusha ngokomgomo wendawo, ngakho isethi esebenza phakathi kwabathengisi ababili inganyamalala uma uguqula ukuthi yiluphi uhlangothi oluqala ukuxhumana.

I-AEAD isusa isimu esikhundleni sokungeza esisodwa

I-AES-GCM ne-ChaCha20-Poly1305 ziqinisekisa futhi zibethele kumsebenzi owodwa. Uma enye yazo ikhethelwa i-ESP, i-algorithm yobuphelele ayixoxwa ngokwehlukana, ngoba isakhiwo se-AEAD sesivele siyihlanganisile. Ngakho isiphakamiso esihlanganisa i-AES-GCM ne-SHA-256 siyisengezo esingadingekile esimweni esihle futhi siyanqatshwa esimweni esibi.

I-PRF ihlala ihlukile ohlangothini lwe-IKE, ngoba ikhipha okhiye besiteshi sokulawula esikhundleni sokuvikela imithwalo. Yingakho isiphakamiso se-IKE singahlanganisa ngokomthetho i-cipher ye-AEAD ne-PRF neqembu le-DH, kuyilapho isiphakamiso se-ESP esihambisanayo sibala kuphela i-cipher ye-AEAD neqembu le-PFS elingakhethiwe.

Ubude bokhiye buyingxenye yethokheni yokubethela, ngakho i-AES-128-GCM ne-AES-256-GCM izinikezelo ezahlukene. Iphrofayela ekhutshelwe kumhlahlandlela owayecabanga okhiye abangama-256-bit ngeke ihambisane nendawo yokugcina emiswe ku-128-bit, nakuba imigqa yomibili isho i-AES-GCM. Izinhlangothi ezimbili zingavumelana ngomndeni we-cipher futhi zisenqaba zodwa ngenxa yenumbolo engemva kwedeshi.

Funda i-SA efakiwe, hhayi isimo esimisiwe

Uhlu lweziphakamiso olumisiwe luyisinikezelo; i-SA efakiwe iwumphumela. Ku-strongSwan nakuyi-kernel ye-Linux, kokubili ukubuka kuyatholakala:

sudo swanctl --list-sas
sudo ip xfrm state
sudo ip xfrm policy

swanctl --list-sas iphrinta ama-algorithm okuxoxiwe ngawo nge-SA ngayinye, kuhlanganise nokuthi i-CHILD isebenzisa i-AEAD yini. ip xfrm state ikhombisa lokho i-kernel ekufake ngempela, futhi yilapho uqinisekisa khona ukuthi ukuvuselelwa kokhiye akubuyelanga esethini ehlukile kunalelo oyibhalile.

Gcina lokho kuphuma eduze kwesimo esimisiwe ngemva kokulungiswa. Uma ukubuyekezwa kwekhasimende kushintsha okuzenzakalelayo kwayo, isethi erekhodiwe ikunika isisekelo sokuqhathanisa, futhi ukuqhathanisa kukhomba isimu esisukile esikhundleni sokuqala uphenyo phansi.