Kungani ukhiye omude we-Blowfish ungeke ulungise ibhloko lama-bithi angu-64

Iphrofayela ye-VPN inikeza i-Blowfish ngokhiye wamabithi angu-448, futhi othile uphakamisa ukusebenzisa ukhiye omude kakhulu ukuze i-cipher ihlale ikhona. Ubude bokhiye bungokoqobo, kodwa iyinombolo engalungile okufanele yenziwe ngcono. I-Blowfish iguqula amabhloko angamabithi angu-64 kungakhathaliseki ukuthi ukhiye umude kangakanani, futhi ububanzi bebhloko yibo obukhawulela ukuthi ukhiye owodwa ungavikela kangakanani ithrafikhi ngokuphepha. Sebenzisa izihlolo ezingezansi ngokulandelana futhi ume kwesokuqala esikhulula insizakalo, ngoba isinyathelo sakamuva asikwazi ukulungisa esandulelayo.

Hlola ukuthi abalingani baxoxa ngempela ngani

Funda i-cipher yesiteshi sedatha kuzo zombili iziphetho, hhayi kuphrofayela obuhlela ukuyisebenzisa. Ukulungiselelwa kweklayenti kungabala ama-cipher amaningi, futhi elikhethiwe liwumphumela wokuxoxisana phakathi kwezinhlelo ezimbili nezinguqulo zazo. Khulisa imininingwane yelogi ekuxhumekeni kokuhlola bese ufunda umugqa wesiteshi sedatha, osho i-cipher nosayizi wokhiye oqalwe ngempela.

Uma i-cipher okuxoxwe ngayo i-AES-GCM noma i-ChaCha20-Poly1305, ma ume lapha. Lezo zakhiwo zisebenzisa ibhloko lamabithi angu-128 futhi ziqinisekisa umthwalo, ngakho-ke impikiswano yokungqubuzana kwamabithi angu-64 engezansi ayisebenzi kuzo.

Hlukanisa ubude bokhiye nobubanzi bebhloko

I-Blowfish yamukela okhiye abasuka kumabithi angu-32 kuya kwangu-448, futhi imibhalo yombhali we-algorithm ibala zombili lezi zinombolo ngokwehlukana. Ukhiye uyimfihlo; ibhloko iyingxenye yokuguqulwa. Imfihlo ende yenza ukuqagela kube nzima futhi ayenzi lutho ngobubanzi bebhloko i-cipher eyisebenzayo.

Kumodi ye-CBC, i-cipher isetshenziswa kumabhloko anobubanzi obungashintshi, ahlanganiswe nebhloko yombhalo ofihliwe odlule futhi agcwalisiwe ekugcineni. Ku-Blowfish lobo bubanzi ngamabithi angu-64, okungamabhayithi ayisishiyagalombili. Uhlelo lokhiye lungaba lukhulu ngendlela oyifunayo; uchungechunge lusaqhubeka ngamabhayithi ayisishiyagalombili ngesikhathi.

Yingakho ukhiye omude kungeyona indlela yokunciphisa ingozi. Kubhekise ekuhlaselweni ngamandla okhiye, kuyilapho ingozi yokungqubuzana engezansi iyisici sobubanzi bebhloko nemodi.

Sebenzisa izibalo zosuku lokuzalwa kusayizi webhloko

Ibhloko lamabithi angu-64 linesilinganiso sosuku lokuzalwa esilinganiselwa kumabhloko angu-2^32 afihlwe ngaphansi kokhiye owodwa ngaphambi kokuba ukungqubuzana kube nokwenzeka. Ibhloko ngayinye ithwala amabhayithi ayisishiyagalombili, ngakho-ke isilinganiso esifanayo silinganiselwa kumabhayithi angu-2^35, noma ama-GiB angu-32 edatha ngaphansi kokhiye owodwa.

Kuthathe njengesilinganiso, hhayi njengesabelo. Ukungqubuzana kungenzeka, futhi ukuthi okukodwa kuveza yini into kuncike kumodi, ephethini yethrafikhi nasekutheni umhlaseli angakwazi ukubona noma ukuthonya umbhalo osobala ozungezile. Ibhayithi lokuqala ngemva kwama-GiB angu-32 akusona isigameko sokufihla, futhi ama-GiB angu-32 okuqala awakaqinisekiswa njengaphephile.

Abacwaningi be-Sweet32 babonisa ngo-2016 ukuhlasela okungokoqobo kuma-cipher ebhloko yamabithi angu-64, kuhlanganise nesimo se-OpenVPN, ngaphansi kwezimo ezazidinga ukubuka nokukhiqiza ithrafikhi. Izilungiselelo zabo eziyisisekelo nezinguqulo zesofthiwe ezishicilelwe ziwumongo womlando, hhayi incazelo yokuthunyelwa kwakho.

Nquma ukuthi ukusetshenziswa kabusha kwe-CBC kubalulekile yini lapha

Ku-CBC, ibhloko yombhalo ofihliwe ephindwayo isho ukuthi amabhloko amabili ombhalo osobala ahluka ngobudlelwano obaziwayo, ngoba i-XOR yochungechunge iyazikhansela. Umhlaseli ongabuka umbhalo ofihliwe futhi azi noma akwazi ukuthonya omunye wombhalo osobala angathola ulwazi ngomunye. Ukhiye we-Blowfish awudingeki neze kulokho.

Ngakho-ke imibuzo efanele ukuthi ukhiye uhlala isikhathi esingakanani enkonzweni, ithrafikhi engakanani idlula ngaphansi kwawo nokuthi ngabe ukhona yini ongabuka futhi aqondise leyo thrafikhi. Ukushintshwa kokhiye kunciphisa inani lamabhloko ngokhiye ngamunye, kodwa isikhathi asiwona umkhawulo wamabhayithi: ithunu elimatasa lingahambisa idatha eningi kakhulu kunelengile ngehora elifanayo. Uma ugcina i-cipher endala, thola umkhawulo ekwakhiweni nasevolumu yangempela, hhayi enombolweni eyindilinga.

Uma ivolumu elikalisiwe ngokhiye ngamunye ihlala ingaphansi kakhulu kwesilinganiso sosuku lokuzalwa, ukuchayeka kuncane. Kusenjalo akusona uziro futhi kuseyisizathu sokuhlela ukufuduka esikhundleni sokuyeka ukukhathazeka.

Shintsha i-cipher, hhayi ukhiye

Hambisa insizakalo ku-cipher ye-AEAD esekelwayo futhi uqinisekise ukuthi bobabili abalingani, izinguqulo zabo kanye nezingemuva zazo zokubhala ngokufihlakeleyo zingayixoxa. Ukhiye omude we-Blowfish akushintshi lutho okubalulekile, futhi ukuqagela umyalo omusha kuklayenti eyodwa iyindlela ithunu elisebenzayo eliba eliphukile. Hlola ushintsho kuklayenti eyodwa naseva eyodwa ngaphambi kokuthinta yonke eminye imikhumbi. Gcina iphrofayela endala itholakala ukuze kubuyiselwe emuva kuze kube yilapho i-cipher entsha idlule umjikelezo ophelele wokuxhumana.

Gcina ukuqinisekiswa kwesitifiketi nokuqinisekiswa kwe-akhawunti kusebenza ngesikhathi soshintsho. Zisabela imibuzo ehlukene: ukungena okuphumelelayo akukwazi ukwandisa ibhloko, futhi i-cipher yedatha engcono ayizisi isizathu sokuthemba iseva engalungile.

Vala isihlolo ngokufunda kabusha i-cipher okuxoxwe ngayo ekuxhumekeni okusha bese uqinisekisa ukuthi i-cipher endala ayisamukelwa. Uma umlingani usayinikeza, ukufuduka akukapheli, noma iphrofayela engakwelinye icele ithini.