Yimaphi amaphakethe e-OpenVPN avikelwa yi-digest ye-auth?
Ukukhetha i-auth kuhlanganisa okuncane kunalokho okuphakanyiswa yiphrofayela. Hlola isiteshi, isimo se-AEAD kanye nokuvikelwa kwesiteshi sokulawula ngaphambi kokusetha inqubomgomo ye-digest.
Izingxabano eziningi nge-digest ze-OpenVPN ziqala ngephakethe elingalungile. Ukufunda auth SHA256 ngokuthi “yamukela kuphela ontanga abanikela nge-SHA256” yinto yokuqala okufanele uyikhohlwe. Ukukhetha kubiza i-digest kumaphakethe athile, futhi ukuthi yimaphi lawo maphakethe kuncike esiteshini nasekutheni ukuthi leso siteshi siyi-AEAD yini. Hlola imibuzo emine engezansi ngokulandelana; ngayinye inciphisa okushiwo yilokhu kulungiselelwa ekusetshenzisweni kwakho.
Shono isiteshi okufanele sikuvikele ukulungiselelwa
OpenVPN inesiteshi sokulawula esithwala ithrafikhi yokuxhawulana kwe-TLS kanye nesiteshi sedatha esithwala umthwalo wethanneli. I-digest ye-auth ineqhaza kukho kokubili, kodwa hhayi iqhaza elifanayo, futhi iphrofayela ayivamisile ukwenza umehluko ubonakale. Bhala ukuthi iyiphi kulezi ezimbili ozama ukuyikhawulela ngaphambi kokuthinta ifayela lokucushwa.
Ithebula elingezansi liyinguqulo emfushane yokuthi ukukhetha okufanayo kwehlela kanjani esimweni ngasinye.
| Context | What the auth digest does |
|---|---|
| Data channel without AEAD | Selects the HMAC digest that authenticates each data packet |
| Data channel with AEAD, such as GCM | Unused for the data channel; the cipher authenticates its own packets |
| Control channel protected by tls-auth | Selects the HMAC digest for that protection, even when data is AEAD |
Hlola ukuthi isiteshi sedatha siyi-AEAD yini ngaphambi kokuthembela kuso
Uma i-cipher yedatha okwavunyelwana ngayo iyi-AES-GCM noma i-CHACHA20-POLY1305, isiteshi sedatha siziqinisekisa sodwa futhi i-digest ehlukile ayiwenza umsebenzi ocabangayo. Zombili ziyizakhiwo ze-AEAD, ngakho ubuqotho bukhiqizwa umsebenzi ofanayo oshifayo umthwalo. Lokhu akukona ukwehliswa kwezinga, kodwa kusho ukuthi inqubomgomo ethethelelwe ngokuthi “yonke iphakethe ledatha iyi-HMAC-SHA256” ayilungile ngempela kulelo thaneli. Qinisekisa inani okwavunyelwana ngalo kulogi yeseva noma kokuphuma kwesimo sekhlayenti ngaphambi kokubhala kabusha inqubomgomo.
Hlola i-cipher okwavunyelwana ngayo ngempela esikhundleni sohlu kuphrofayela, ngoba izingxoxo zingawela kwelinye ilunga lesethi. data-ciphers AES-256-GCM:AES-128-GCM uhlu lwezingxoxo, futhi zombili izingeniso ziyi-AEAD, ngakho akukho nolunye olusebenzisa i-digest ye-auth ukuvikela umthwalo.
Thatha ukuvikelwa kwesiteshi sokulawula njengesinqumo esisodwa
I-tls-auth yengeza i-HMAC kumaphakethe esiteshi sokulawula futhi ithatha i-digest yayo ekulungiselelweni kwe-auth, yingakho ithaneli le-AEAD lisenokuba ne-digest enengqondo elungisiwe. I-tls-crypt inhlelo ehlukile enokuvikelwa kwayo okuqinile, ngakho ungacabangi ukuthi izuza njengefa yonke impawu ye-tls-auth. Funda imibhalo yendlela oyikhethile esikhundleni sokudlulisela imicabango phakathi kwazo.
Ontanga bobabili kufanele bavumelane ngenhlelo nangendlela yokhiye. I-digest efanayo kodwa ifayela lokhiye elisetshenziswe ngendlela engalungile likhiqiza ukuxhawulana okwehluleka ngenxa yezizathu okulungiselelwa kwe-digest okungakwazi ukuzichaza.
Gcina i-auth ihlukile ekuxoxiswaneni nge-cipher nakumasertifikethi
Izilungiselelo ezintathu zihlala zixutshwa: i-digest ye-auth, uhlu lwama-cipher edatha kanye ne-algorithm yesiginesha yesertifikethi. Ukushintsha eyokuqala akukhiphi kabusha isertifikethi, akukhethi i-digest yesiginesha yaso futhi akudali indlela yomsebenzisi-nephasiwedi. Izincazelo zezinketho zephrothokholi kuma-mthombo we-OpenVPN 2.6 zichaza ngayinye esigabeni sayo, okuyisikhumbuzo esiwusizo sokuthi ziyizinkinobho ezizimele.
Lapho ontanga benqaba ukuxhuma ngemuva kwenguquko ye-digest, imbangela ivamise ukuba ukungafani kwesinye sezilungiselelo ezimbili ezisele. Funda iziphelo zombili ngaphambi kokushintsha noma yisiphi.
Bhala inqubomgomo bese uyiqhathanisa nokucushwa okusebenzayo
Isitatimende sezinga lemikhumbi kufanele sisho ngokucacile izimo zesiteshi sedatha ezivunyelwe nokuvikelwa okukhethiwe kwesiteshi sokulawula, emshweni owodwa. Lowo msho uyaqinisekiseka; “sisebenzisa i-SHA256” awunjalo. Bese uyiqhathanisa namaphrofayela asebenzayo eseva nekhlayenti esikhundleni sethemplate esendaweni yokugcina.
Qeda ngokurekhoda ukuthi ithaneli ngalinye lavumelana ngani ngempela nokuthi iyiphi indlela eyaqinisekisa amaphakethe alo. Umugqa we-auth obonakala kuphrofayela uwubufakazi benhloso yokucushwa kuphela, futhi inhloso iyingxenye eshibhile kakhulu yokuhlola.