ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.5.pod (file contents):
Revision 1.1 by pcg, Fri Jun 11 15:56:12 2004 UTC vs.
Revision 1.3 by pcg, Thu Jan 27 06:58:48 2005 UTC

… …
5=head1 DESCRIPTION 5=head1 DESCRIPTION
6 6
7GVPE is a suite designed to provide a virtual private network for multiple 7GVPE is a suite designed to provide a virtual private network for multiple
8nodes over an untrusted network. 8nodes over an untrusted network.
9 9
10=over 4
11
12=item X<Virtual>
13
10"Virtual"X<Virtual> means that no physical network is created (of course), but an 14Virtual means that no physical network is created (of course), but an
11ethernet is emulated by creating multiple tunnels between the member 15ethernet is emulated by creating multiple tunnels between the member
12nodes. 16nodes.
13 17
18=item X<Private>
19
14"Private"X<Private> means that non-participating nodes cannot decode ("sniff)" nor 20Private means that non-participating nodes cannot decode ("sniff)" nor
15inject ("spoof") packets. 21inject ("spoof") packets.
16 22
17In the case of gvpe, even participating nodes cannot sniff packets send to 23In the case of gvpe, even participating nodes cannot sniff packets send to
18other nodes or spoof packets as if sent from other nodes. 24other nodes or spoof packets as if sent from other nodes.
19 25
26=item X<Network>
27
20"Network"X<Network> means that more than two parties can participate in the 28Network means that more than two parties can participate in the network,
21network, so for instance it's possible to connect multiple branches of a 29so for instance it's possible to connect multiple branches of a company
22company into a single network. Many so-called "vpn" solutions only create 30into a single network. Many so-called "vpn" solutions only create
23point-to-point tunnels. 31point-to-point tunnels.
32
33=back
24 34
25=head2 DESIGN GOALS 35=head2 DESIGN GOALS
26 36
27=over 4 37=over 4
28 38
… …
92 102
93 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 103 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1
94 104
95This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12 105This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12
96would also be pretty secure ;) and will additionally prefix each packet 106would also be pretty secure ;) and will additionally prefix each packet
97with 8 bytes of random data. 107with 8 bytes of random data. In the long run, people should move to
108SHA-224 and beyond, but support in openssl is missing as of writing this
109document.
98 110
99In general, remember that AES-128 seems to be more secure and faster than 111In general, remember that AES-128 seems to be more secure and faster than
100AES-192 or AES-256, more randomness helps against sniffing and a longer 112AES-192 or AES-256, more randomness helps against sniffing and a longer
101HMAC helps against spoofing. MD4 is a fast digest, SHA1 or RIPEMD160 are 113HMAC helps against spoofing. MD4 is a fast digest, SHA1 or RIPEMD160 are
102better, and Blowfish is a fast cipher (and also quite secure). 114better, and Blowfish is a fast cipher (and also quite secure).

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines