DOCSLIB.ORG

Issue #1473 Does Strongswan Supports Openssl Engine to Add New Encryption Algorithm? 18.05.2016 13:19 - Mina Jafari

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Issue #1473 Does Strongswan Supports Openssl Engine to Add New Encryption Algorithm? 18.05.2016 13:19 - Mina Jafari strongSwan - Issue #1473 Does strongswan supports Openssl engine to add new encryption algorithm? 18.05.2016 13:19 - Mina Jafari Status: Closed Priority: Normal Assignee: Tobias Brunner Category: libstrongswan Affected version: 5.4.0 Resolution: No change required Description We can add a new encryption or hash algorithm to openssl algorithms using a dynamic method named "engine". I compiled my custom encryption algorithm as an openssl engine, does Strongswan supports loading a new algorithm using openssl engine? I've seen issue #832 and I thought it could be done by adding engine-id to file strongswan.d/charon/openssl.conf and compiling Strongswan with --enable-openssl and loading openssl plugin. But although openssl plugin is loaded, ipsec listalgs does not list my custom algorithm and I get error log: algorithm 'mina' not recognized skipped invalid proposal string: mina-sha1-modp1024 when I use mina algorithm in ipsec.conf. History #1 - 18.05.2016 14:33 - Tobias Brunner - Status changed from New to Feedback You at least also need to extend the proposal parser (source:src/libstrongswan/crypto/proposal/proposal_keywords.h#L94) and extend the plugin feature registration in the openssl plugin (source:src/libstrongswan/plugins/openssl/openssl_plugin.c#L268). And the list of algorithms in the crypter does also have to be extended (source:src/libstrongswan/plugins/openssl/openssl_crypter.c#L46 or directly in the constructor) #2 - 19.05.2016 18:48 - Mina Jafari Tobias Brunner wrote: You at least also need to extend the proposal parser (source:src/libstrongswan/crypto/proposal/proposal_keywords.h#L94) and extend the plugin feature registration in the openssl plugin (source:src/libstrongswan/plugins/openssl/openssl_plugin.c#L268). And the list of algorithms in the crypter does also have to be extended (source:src/libstrongswan/plugins/openssl/openssl_crypter.c#L46 or directly in the constructor) Do you mean it supports engine but if I want to see my algorithm I should change those files? #3 - 19.05.2016 19:56 - Tobias Brunner Do you mean it supports engine but if I want to see my algorithm I should change those files? I don't know whether it's supported or not for what you want to do. The only application that has once been tested is using engines to access RSA private keys (it's also the only place where an engine is explicitly instantiated, source:src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c#L599). But perhaps engines configured in openssl.cfg are loaded automatically when the plugin is initialized and OPENSSL_config() and ENGINE_load_builtin_engines(); ENGINE_register_all_complete(); are called. But even it that's the case and you could theoretically instantiate an EVP_CIPHER object backed by an engine you would still have to add additional changes so you can configure the algorithm and the IKE daemon would actually use it (that is if you actually want to add a new algorithm and not just a different implementation - e.g. hardware accelerated - for an existing one). #4 - 23.05.2016 11:48 - Mina Jafari Tobias Brunner wrote: Do you mean it supports engine but if I want to see my algorithm I should change those files? I don't know whether it's supported or not for what you want to do. The only application that has once been tested is using engines to access RSA private keys (it's also the only place where an engine is explicitly instantiated, 27.09.2021 1/7 source:src/libstrongswan/plugins/openssl/openssl_rsa_private_key.c#L599). But perhaps engines configured in openssl.cfg are loaded automatically when the plugin is initialized and OPENSSL_config() and ENGINE_load_builtin_engines(); ENGINE_register_all_complete(); are called. But even it that's the case and you could theoretically instantiate an EVP_CIPHER object backed by an engine you would still have to add additional changes so you can configure the algorithm and the IKE daemon would actually use it (that is if you actually want to add a new algorithm and not just a different implementation - e.g. hardware accelerated - for an existing one). I guess I should do the same thing as you did to use pkcs11 as an openssl engine. Is there any example or test which use this? I want to trace it to find out its code. (In fact I need a dynamic solution I mean the algorithm be compiled independently from strongswan, but strongswan can load it. such solution is provided by openssl called dynamic engine and is supported by some applications for example OpenVPN.) #5 - 23.05.2016 13:23 - Tobias Brunner I guess I should do the same thing as you did to use pkcs11 as an openssl engine. I don't think that's necessary. I think dynamic engines configured in openssl.cnf are loaded automatically when the openssl plugin calls OPENSSL_config(). Only if you want to instantiate a specific engine you'll need to load it manually. But as I said before, if you provide a completely new algorithm (not a new implementation for an existing/known algorithm) you'll need at least some code changes. Did you already look at strongSwan's own plugin system? #6 - 23.05.2016 15:28 - Mina Jafari Tobias Brunner wrote: I guess I should do the same thing as you did to use pkcs11 as an openssl engine. I don't think that's necessary. I think dynamic engines configured in openssl.cnf are loaded automatically when the openssl plugin calls OPENSSL_config(). Only if you want to instantiate a specific engine you'll need to load it manually. In fact I want to add a completely new algorithm but for now I'm trying gost algorithm with strongswan. It is an algorithm provided by openssl dynamic engine. I added gost id to strongswan.d/charon/openssl.cnf but I guess it is not loaded. because gost algorithm is not recognized in ipsec.conf. But as I said before, if you provide a completely new algorithm (not a new implementation for an existing/known algorithm) you'll need at least some code changes. Did you already look at strongSwan's own plugin system? Yes, I saw openssl plugin, in fact I see you call ENGINE_load_builtin_engines(), but I've read in openssl's README.ENGINE that this function register built-in engines, I guess dynamic engines like gost wont be loaded this way. I want gost engine to be compiled as a shared library and then can be loaded by strongswan. I think pkcs11 is not compiled this way. If you can tell me the engine_id in strongswan.d/charon/openssl.cnf where in code is applied I can maybe figure out something! #7 - 23.05.2016 18:50 - Tobias Brunner I added gost id to strongswan.d/charon/openssl.cnf but I guess it is not loaded. I was not referring to that file, but openssl.cnf, the configuration file for the OpenSSL library (e.g. located at /etc/ssl/openssl.cnf on Ubuntu). Yes, I saw openssl plugin, in fact I see you call ENGINE_load_builtin_engines(), but I've read in openssl's README.ENGINE that this function register built-in engines, I guess dynamic engines like gost wont be loaded this way. OPENSSL_config() should load dynamic engines that are configured in openssl.cnf. See e.g. http://sinodun.com/2009/02/developing-an-engine-for-openssl/ #8 - 24.05.2016 12:36 - Mina Jafari Tobias Brunner wrote: I added gost id to strongswan.d/charon/openssl.cnf but I guess it is not loaded. I was not referring to that file, but openssl.cnf, the configuration file for the OpenSSL library (e.g. located at /etc/ssl/openssl.cnf on Ubuntu). 27.09.2021 2/7 Yes, I saw openssl plugin, in fact I see you call ENGINE_load_builtin_engines(), but I've read in openssl's README.ENGINE that this function register built-in engines, I guess dynamic engines like gost wont be loaded this way. OPENSSL_config() should load dynamic engines that are configured in openssl.cnf. See e.g. http://sinodun.com/2009/02/developing-an-engine-for-openssl/ I've loaded the gost engine by adding it yo openss.cnf. But still not recognized by strongswan. I guess I have not changed strongswan's codes properly. First I could not find out how to extend the proposal parser. I've seen register_token function's definition here [[ source:src/libstrongswan/crypto/proposal/proposal_keywords.c]] but it is not called anywhere. So how is it used to register each proposal token? #9 - 24.05.2016 13:05 - Tobias Brunner So how is it used to register each proposal token? It is not. That function is provided for plugins to dynamically register their own tokens i.e. without having to modify the strongSwan sources. The predefined tokens for known algorithms are statically defined in source:src/libstrongswan/crypto/proposal/proposal_keywords_static.txt #10 - 24.05.2016 14:33 - Mina Jafari It is not. That function is provided for plugins to dynamically register their own tokens i.e. without having to modify the strongSwan sources. The predefined tokens for known algorithms are statically defined in source:src/libstrongswan/crypto/proposal/proposal_keywords_static.txt So the changes you mentioned before for the code is not needed for engine? just needed for plugin? Can compile plugins as shared library and independent from strongswan? (I need such independent solution to add my new algorithm, that's why I wanted to use engine earlier.) #11 - 24.05.2016 14:45 - Tobias Brunner So the changes you mentioned before for the code is not needed for engine? just needed for plugin? If you add a new algorithm you'll have to register that token (at least if you want to make it configurable in the config files).
Load more

Recommended publications
  • Flexgw Ipsec VPN Image User Guide
    FlexGW IPsec VPN Image User Guide Zhuyun Information Technology Co.,Ltd. www.cloudcare.cn Zhuyun Information Technology Co.,Ltd. Contents .......................................................................................................... .................................................................................................................. 1 Introduction 4 1.1 Software Compon.e..n..t.s................................................................................................................... 4 1.2 Login Description ................................................................................................................... 4 1.3 Function Description ....................................................................................................5 1.4 Typical Scenarios Des..c..r..i.p..t..i.o..n......................................................................................................5 1.5 Program Description .................................................................................6 1.6 Software Operation Command Summary ............................... 7 ............................................................................................................... 2 IPSec Site-to-Site VPN User Guide (VPC network scenario) 8 2.1 Start IPSec VPN.s..e..r..v..i.c..e.................................................................................................................8 2.2 Add new tunnel .................................................................................................................
    [Show full text]
  • Openvpn with Two-Factor Authentication (2FA)
    Portal > Knowledgebase > VPN > OpenVPN > OpenVPN with Two Factor Authentication (2FA) OpenVPN with Two Factor Authentication (2FA) Dmitriy Eshenko - 2021-09-21 - 0 Comments - in OpenVPN Using DUO 2fa with OpenVPN requires to install an additional plugin. Upload tar archive to your router then unarchive required plugins and helper files curl http://dev.packages.vyos.net/tmp/openvpn-plugin-duo_2.4_amd64.deb -O sudo dpkg -i openvpn-plugin-duo_2.4_amd64.deb Following documentation from DUO site, configure OpenVPN instance https://duo.com/docs/openvpn Get integration key, secret key, and API hostname from DUO control panel and add to VyOS the next commands for activating the plugin. set interfaces openvpn vtunX openvpn-option '--plugin /usr/lib/openvpn/duo/duo_openvpn.so IKEY SKEY HOST' set interfaces openvpn vtunX openvpn-option 'reneg-sec 0' Where: IKEY - integration key, SKEY - secret key, HOST - API hostname Full OpenVPN configuration: set interfaces openvpn vtun10 local-port '1194' set interfaces openvpn vtun10 mode 'server' set interfaces openvpn vtun10 openvpn-option '--plugin /usr/lib/openvpn/duo/duo_openvpn.so XXX YYY api-zzz.duosecurity.com' set interfaces openvpn vtun10 openvpn-option 'reneg-sec 0' set interfaces openvpn vtun10 persistent-tunnel set interfaces openvpn vtun10 protocol 'udp' set interfaces openvpn vtun10 server push-route '100.64.0.0/24' set interfaces openvpn vtun10 server subnet '10.23.1.0/24' set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ovpn/ca.crt' set interfaces openvpn vtun10 tls cert-file '/config/auth/ovpn/central.crt' set interfaces openvpn vtun10 tls crl-file '/config/auth/ovpn/crl.pem' set interfaces openvpn vtun10 tls dh-file '/config/auth/ovpn/dh.pem' set interfaces openvpn vtun10 tls key-file '/config/auth/ovpn/central.key' How to generate cryptographic materials described by the following link https://support.vyos.io/en/kb/articles/using-easy-rsa-to-generate-x-509-certificates-and-keys -2.
    [Show full text]
  • Enabling TPM Based System Security Features
    Enabling TPM based system security features Andreas Fuchs <[email protected]> Who am I ? ● 13 year on/off TPMs ● Fraunhofer SIT: Trustworthy Platforms ● TCG-member: TPM Software Stack WG ● Maintainer – tpm2-tss: The libraries – tpm2-tss-engine: The openssl engine – tpm2-totp: Computer-to-user attestation (mjg’s tpm-totp reimplemented for 2.0) 2 The hardware stack ● Trusted Platform Module (TPM) 2.0 – Smartcard-like capabilities but soldered in – Remote Attestation capabilities – As separate chip (LPC, SPI, I²C) – In Southbridge / Firmware – Via TEEs/TrustZone, etc – Thanks to Windows-Logos in every PC ● CPU – OS, TSS 2.0, where the fun is... 3 The TPM Software Stack 2.0 ● Kernel exposes /dev/tpm0 with byte buffers ● tpm2-tss is like the mesa of TCG specs ● TCG specifications: – TPM spec for functionality – TSS spec for software API ● tpm2-tss implements the glue ● Then comes core module / application integration – Think GDK, but OpenSSL – Think godot, but pkcs11 – Think wayland, but cryptsetup 4 The TSS APIs System API (sys) Enhanced SYS (esys) Feature API (FAPI) • 1:1 to TPM2 cmds • Automate crypto for • Spec in draft form HMAC / encrypted • TBimplemented • Cmd / Rsp sessions • No custom typedefs U serialization • Dynamic TCTI • JSON interfaces s • No file I/O loading • Provides Policy e • No crypto • Memory allocations language r • No heap / malloc • No file I/O • Provides keystore S p TPM Command Transmission Interface (tss2-tcti) p a Abstract command / response mechanism, • No crypto, heap, file I/O a Decouple APIs
    [Show full text]
  • Master Thesis
    Master's Programme in Computer Network Engineering, 60 credits MASTER Connect street light control devices in a secure network THESIS Andreas Kostoulas, Efstathios Lykouropoulos, Zainab Jumaa Network security, 15 credits Halmstad 2015-02-16 “Connect street light control devices in a secure network” Master’s Thesis in Computer Network engineering 2014 Authors: Andreas Kostoulas, Efstathios Lykouropoulos, Zainab Jumaa Supervisor: Alexey Vinel Examiner: Tony Larsson Preface This thesis is submitted in partial fulfilment of the requirements for a Master’s Degree in Computer Network Engineering at the Department of Information Science - Computer and Electrical Engineering, at University of Halmstad, Sweden. The research - implementation described herein was conducted under the supervision of Professor Alexey Vinel and in cooperation with Greinon engineering. This was a challenging trip with both ups and downs but accompanied by an extend team of experts, always willing to coach, sponsor, help and motivate us. For this we would like to thank them. We would like to thank our parents and family for their financial and motivational support, although distance between us was more than 1500 kilometres. Last but not least we would like to thank our fellow researchers and friends on our department for useful discussions, comments, suggestions, thoughts and also creative and fun moments we spend together. i Abstract Wireless communications is a constantly progressing technology in network engineering society, creating an environment full of opportunities that are targeting in financial growth, quality of life and humans prosperity. Wireless security is the science that has as a goal to provide safe data communication between authorized users and prevent unauthorized users from gaining access, deny access, damage or counterfeit data in a wireless environment.
    [Show full text]
  • N2N: a Layer Two Peer-To-Peer VPN
    N2N: A Layer Two Peer-to-Peer VPN Luca Deri1, Richard Andrews2 ntop.org, Pisa, Italy1 Symstream Technologies, Melbourne, Australia2 {deri, andrews}@ntop.org Abstract. The Internet was originally designed as a flat data network delivering a multitude of protocols and services between equal peers. Currently, after an explosive growth fostered by enormous and heterogeneous economic interests, it has become a constrained network severely enforcing client-server communication where addressing plans, packet routing, security policies and users’ reachability are almost entirely managed and limited by access providers. From the user’s perspective, the Internet is not an open transport system, but rather a telephony-like communication medium for content consumption. This paper describes the design and implementation of a new type of peer-to- peer virtual private network that can allow users to overcome some of these limitations. N2N users can create and manage their own secure and geographically distributed overlay network without the need for central administration, typical of most virtual private network systems. Keywords: Virtual private network, peer-to-peer, network overlay. 1. Motivation and Scope of Work Irony pervades many pages of history, and computing history is no exception. Once personal computing had won the market battle against mainframe-based computing, the commercial evolution of the Internet in the nineties stepped the computing world back to a substantially rigid client-server scheme. While it is true that the today’s Internet serves as a good transport system for supplying a plethora of data interchange services, virtually all of them are delivered by a client-server model, whether they are centralised or distributed, pay-per-use or virtually free [1].
    [Show full text]
  • Openvpn® Settings Page - Simple Mode
    Grandstream Networks, Inc. WP820 Enterprise Portable Wi-Fi Phone OpenVPN® Guide Table of Contents OVERVIEW ..................................................................................................................... 3 ENABLE OPENVPN® FEATURE ................................................................................... 4 OPENVPN® MODES ...................................................................................................... 4 Simple Mode ........................................................................................................................4 Professional Mode (Expert Mode) ........................................................................................6 Table of Figures Figure 1: VPN Architecture Overview ....................................................................................................... 3 Figure 2: OpenVPN® Settings Page - Simple Mode ................................................................................. 4 Figure 3: OpenVPN® Settings Page - Expert Mode ................................................................................. 6 Figure 4: Expert Mode ZIP file ................................................................................................................. 6 Table of Tables Table 1: OpenVPN® Settings – Simple Mode ........................................................................................... 5 P a g e | 2 WP820 OpenVPN® Guide OVERVIEW VPN (Virtual Private Network) is a network that communicates by creating a dedicated and
    [Show full text]
  • Wireguard in Eduvpn Report
    WireGuard in eduVPN Report Nick Aquina SURF, Utrecht Fontys University of Applied Sciences, Eindhoven INTERNSHIP REPORT FONTYS UNIVERSITY OF APPLIED SCIENCES HBO-ICT Data student: Family name, initials: Aquina, N Student number: project period: (from – till) 31 August 2020 – 22 January 2021 Data company: Name company/institution: SURF Department: Team Security Address: Kantoren Hoog Overborch, 3511 EP Utrecht, Moreelsepark 48 Company tutor: Family name, initials: Spoor, R Position: (Tech) Product Manager University tutor: Family name, initials: Vos, A Final report: Title: WireGuard in eduVPN Date: 12 January 2021 Approved and signed by the company tutor: Date: 12 January 2021 Signature: Preface This report is written for my internship for Fontys. The internship was done at SURF for the eduVPN project. My task was to build a proof of concept in which WireGuard is integrated into eduVPN. This internship took place from September 2020 until January 2021. I would like to thank Arno Vos for his guidance and feedback throughout this internship. I would also like to thank Rogier Spoor for guiding me throughout this internship and inviting me to meetings which gave me a valuable insight into cyber security and technological issues facing members of SURF. And last, but not least, I would like to thank François Kooman for all technical support, advice and code reviews which helped improve the project. All blue text can be clicked to open a hyperlink. 1 Contents Preface . .1 Summary 4 Introduction 5 Free software . .5 The company (SURF) 6 Project 7 Context / Initial situation . .7 Project goal . .7 Assignment . .7 Constraints . .8 Development strategy .
    [Show full text]
  • Nist Sp 800-77 Rev. 1 Guide to Ipsec Vpns
    NIST Special Publication 800-77 Revision 1 Guide to IPsec VPNs Elaine Barker Quynh Dang Sheila Frankel Karen Scarfone Paul Wouters This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-77r1 C O M P U T E R S E C U R I T Y NIST Special Publication 800-77 Revision 1 Guide to IPsec VPNs Elaine Barker Quynh Dang Sheila Frankel* Computer Security Division Information Technology Laboratory Karen Scarfone Scarfone Cybersecurity Clifton, VA Paul Wouters Red Hat Toronto, ON, Canada *Former employee; all work for this publication was done while at NIST This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-77r1 June 2020 U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
    [Show full text]
  • Comparison of Virtual Networks Solutions for Community Clouds
    KTH Royal Institute of Technology Bachelor Thesis Comparison of Virtual Networks Solutions for Community Clouds Examiner: Vladimir Vlassov Author: Albert Avellana Supervisors: Paris Carbone, Hooman Peiro Information and Communication Technology School February 2014 KTH Royal Institute of Technology Abstract Information and Communication Technology School Bachelor Thesis Comparison of Virtual Networks Solutions for Community Clouds by Albert Avellana Cloud computing has a huge importance and big impact nowadays on the IT world. The idea of community clouds has emerged recently in order to satisfy several user expectations. Clommunity is a European project that aims to provide a design and implementation of a self-configured, fully distributed, decentralized, scalable and robust cloud for a community of users across a commmunity network. One of the aspects to analyze in this design is which kind of Virtual Private Network (VPN) is going to be used to interconnect the nodes of the community members interested in access cloud services. In this thesis we will study, compare and analyze the possibility of using Tinc, IPOP or SDN-based solutions such as OpenFlow to establish such a VPN. Acknowledgements I would like to express my gratitude to all those who gave me the possibility to do this thesis in KTH. Firstly, I would like to thank Vlad for the opportunity he gave me to do this thesis and for his support. Secondly, thanks to my thesis supervisors: Paris Carbone and Hooman Peiro, who guided me through the research, helped me and gave me recommendations during this period. Also, I would like to thank F´elixFreitag and Leandro Navarro from Universitat Polit`ecnica de Catalunya for supporting me from Barcelona and make this stay in Stockholm possi- ble.
    [Show full text]
  • Obfuscating VPN Traffic
    Obfuscating VPN Traffic JJF Derksen August 22, 2018 Supervisor: dr. ir. Marc X. Makkes Universiteit van Amsterdam Rogier Spoor SURFnet Host organisation: SURFnet, https://www.surf.nl Universiteit van Amsterdam Faculteit der Natuurwetenschappen, Wiskunde en Informatica Master Software Engineering http://www.software-engineering-amsterdam.nl Contents Abstract 3 1 Introduction 4 2 Related work 6 3 Background 7 3.1 Network traffic ........................................ 7 3.2 Virtual private network ................................... 8 4 Experiment setup 11 4.1 Setups............................................. 11 4.2 Experiments.......................................... 12 4.2.1 Experiment one: OpenVPN server detection.................... 12 4.2.2 Experiment two: network traffic monitoring.................... 12 4.3 OpenVPN configurations .................................. 13 4.3.1 OpenVPN standard configuration.......................... 13 4.3.2 OpenVPN secure configuration........................... 15 4.3.3 OpenVPN obfuscation configuration........................ 15 4.3.4 OpenVPN TLS 1.3 configuration.......................... 16 5 Results and analysis 17 5.1 Active detection OpenVPN server ............................. 17 5.1.1 Port scanning..................................... 17 5.1.2 Connection request.................................. 17 5.1.3 TCP three way handshake.............................. 18 5.2 Monitoring network traffic.................................. 18 5.2.1 Handshake ...................................... 18 5.2.2 Client hello.....................................
    [Show full text]
  • Sophos Connect Help Contents About Sophos Connect
    Sophos Connect help Contents About Sophos Connect............................................................................................................................ 1 How to install Sophos Connect.....................................................................................................1 How to uninstall Sophos Connect.................................................................................................2 Connections................................................................................................................................... 2 Events............................................................................................................................................ 8 Troubleshoot event errors........................................................................................................... 10 General troubleshooting.............................................................................................................. 19 About Sophos Connect Admin...............................................................................................................25 Editing configuration files............................................................................................................ 25 Legal Notices..........................................................................................................................................27 (2021/03/05) Sophos Connect 1 About Sophos Connect Sophos Connect is a VPN client that you can install on Windows and Macs.
    [Show full text]
  • Openvpn Client LAN Internet
    Setting an OpenVPN on Linux and MikroTik to securely access a web server Teddy Yuliswar MikroTik Certified Trainer #TR0442 Indonetworkers.com Training Center (ITC) Jl. S. Parman No. 189B Ulak Karang Utara Padang – West Sumatera - Indonesia Indonetworkers.com/training Case 1. We want to have a web-based application that is on a server that can only be accessed by office employees - our branch offices (not allowed to be accessed publicly) or 2. We want to manage client routers that do not have public ip via a single web based app Problem At the Head Office and Branch (both) there is no dedicated internet for example : 1. From ISP Dynamic Internet IP 2. Under the NAT Router / Does not have a public IP What do we need to solved this problem? What are the steps? What is OpenVPN? Symmetric Encryption Example Symmetric Encryption • Blowfish, AES, RC4, DES, RC5, and RC6 • The most widely used now AES-128, AES-192, and AES-256. Asymmetric Encryption Example Asymmetric Encryption Most are used in everyday communication channels, especially through the Internet. Popular asymmetric key encryption : EIGamal, RSA, DSA, Elliptic curve techniques, PKCS Why OpenVPN? OpenVPN PPTP L2TP/IPsec SSTP IKEv2/IPSec Encryption 160-bit, 256-bit 128-bit 256-bit 256-bit 256-bit Weak High security (might Security Very high High High be weakened by NSA) Speedy, due to low Medium, due to Fast Fast Very fast Speed encryption double encapsulation Stability Very stable Very stable Stable Very stable Very stable Strong desktop Windows- Limited platform support, but mobile Strong Windows Multiple device and platform, but works support beyond Compatibility could be improved.
    [Show full text]