ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.5.pod (file contents):
Revision 1.2 by pcg, Tue Oct 12 11:54:33 2004 UTC vs.
Revision 1.4 by pcg, Thu Jan 27 07:02:18 2005 UTC

… …
5=head1 DESCRIPTION 5=head1 DESCRIPTION
6 6
7GVPE is a suite designed to provide a virtual private network for multiple 7GVPE is a suite designed to provide a virtual private network for multiple
8nodes over an untrusted network. 8nodes over an untrusted network.
9 9
10=over 4
11
12=item X<Virtual>
13
10"Virtual"X<Virtual> means that no physical network is created (of course), but an 14Virtual means that no physical network is created (of course), but an
11ethernet is emulated by creating multiple tunnels between the member 15ethernet is emulated by creating multiple tunnels between the member
12nodes. 16nodes.
13 17
18=item X<Private>
19
14"Private"X<Private> means that non-participating nodes cannot decode ("sniff)" nor 20Private means that non-participating nodes cannot decode ("sniff)" nor
15inject ("spoof") packets. 21inject ("spoof") packets.
16 22
17In the case of gvpe, even participating nodes cannot sniff packets send to 23In the case of gvpe, even participating nodes cannot sniff packets send to
18other nodes or spoof packets as if sent from other nodes. 24other nodes or spoof packets as if sent from other nodes.
19 25
26=item X<Network>
27
20"Network"X<Network> means that more than two parties can participate in the 28Network means that more than two parties can participate in the network,
21network, so for instance it's possible to connect multiple branches of a 29so for instance it's possible to connect multiple branches of a company
22company into a single network. Many so-called "vpn" solutions only create 30into a single network. Many so-called "vpn" solutions only create
23point-to-point tunnels. 31point-to-point tunnels.
32
33=back
24 34
25=head2 DESIGN GOALS 35=head2 DESIGN GOALS
26 36
27=over 4 37=over 4
28 38
… …
71=head1 COMPILETIME CONFIGURATION 81=head1 COMPILETIME CONFIGURATION
72 82
73Please have a look at the C<gvpe.osdep(5)> manpage for platform-specific 83Please have a look at the C<gvpe.osdep(5)> manpage for platform-specific
74information. 84information.
75 85
76Here are a few recipes for compiling your gvpe: 86Here are a few recipes for compiling your gvpe, showing the extremes
87(fast, small, insecure OR slow, large, more secure), between you should
88choose:
77 89
78=head2 AS LOW PACKET OVERHEAD AS POSSIBLE 90=head2 AS LOW PACKET OVERHEAD AS POSSIBLE
79 91
80 ./configure --enable-hmac-length=4 --enable-rand-length=0 92 ./configure --enable-hmac-length=4 --enable-rand-length=0
81 93
82Minimize the header overhead of VPN packets (the above will result in only 94Minimize the header overhead of VPN packets (the above will result in
834 bytes of overhead over the raw ethernet frame). 95only 4 bytes of overhead over the raw ethernet frame). This is a insecure
96configuration because a HMAC length of 4 makes collision attacks based on
97the birthday paradox easy, though.
84 98
85=head2 MINIMIZE CPU TIME REQUIRED 99=head2 MINIMIZE CPU TIME REQUIRED
86 100
87 ./configure --enable-cipher=bf --enable-digest=md4 101 ./configure --enable-cipher=bf --enable-digest=md4
88 102
89Use the fastest cipher and digest algorithms currently available in gvpe. 103Use the fastest cipher and digest algorithms currently available in
104gvpe. MD4 has been broken and is quite insecure, though.
90 105
91=head2 MAXIMIZE SECURITY 106=head2 MAXIMIZE SECURITY
92 107
93 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 108 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1
94 109

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines