ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.5.pod (file contents):
Revision 1.1 by pcg, Fri Jun 11 15:56:12 2004 UTC vs.
Revision 1.4 by pcg, Thu Jan 27 07:02:18 2005 UTC

… …
5=head1 DESCRIPTION 5=head1 DESCRIPTION
6 6
7GVPE is a suite designed to provide a virtual private network for multiple 7GVPE is a suite designed to provide a virtual private network for multiple
8nodes over an untrusted network. 8nodes over an untrusted network.
9 9
10=over 4
11
12=item X<Virtual>
13
10"Virtual"X<Virtual> means that no physical network is created (of course), but an 14Virtual means that no physical network is created (of course), but an
11ethernet is emulated by creating multiple tunnels between the member 15ethernet is emulated by creating multiple tunnels between the member
12nodes. 16nodes.
13 17
18=item X<Private>
19
14"Private"X<Private> means that non-participating nodes cannot decode ("sniff)" nor 20Private means that non-participating nodes cannot decode ("sniff)" nor
15inject ("spoof") packets. 21inject ("spoof") packets.
16 22
17In the case of gvpe, even participating nodes cannot sniff packets send to 23In the case of gvpe, even participating nodes cannot sniff packets send to
18other nodes or spoof packets as if sent from other nodes. 24other nodes or spoof packets as if sent from other nodes.
19 25
26=item X<Network>
27
20"Network"X<Network> means that more than two parties can participate in the 28Network means that more than two parties can participate in the network,
21network, so for instance it's possible to connect multiple branches of a 29so for instance it's possible to connect multiple branches of a company
22company into a single network. Many so-called "vpn" solutions only create 30into a single network. Many so-called "vpn" solutions only create
23point-to-point tunnels. 31point-to-point tunnels.
32
33=back
24 34
25=head2 DESIGN GOALS 35=head2 DESIGN GOALS
26 36
27=over 4 37=over 4
28 38
… …
71=head1 COMPILETIME CONFIGURATION 81=head1 COMPILETIME CONFIGURATION
72 82
73Please have a look at the C<gvpe.osdep(5)> manpage for platform-specific 83Please have a look at the C<gvpe.osdep(5)> manpage for platform-specific
74information. 84information.
75 85
76Here are a few recipes for compiling your gvpe: 86Here are a few recipes for compiling your gvpe, showing the extremes
87(fast, small, insecure OR slow, large, more secure), between you should
88choose:
77 89
78=head2 AS LOW PACKET OVERHEAD AS POSSIBLE 90=head2 AS LOW PACKET OVERHEAD AS POSSIBLE
79 91
80 ./configure --enable-hmac-length=4 --enable-rand-length=0 92 ./configure --enable-hmac-length=4 --enable-rand-length=0
81 93
82Minimize the header overhead of VPN packets (the above will result in only 94Minimize the header overhead of VPN packets (the above will result in
834 bytes of overhead over the raw ethernet frame). 95only 4 bytes of overhead over the raw ethernet frame). This is a insecure
96configuration because a HMAC length of 4 makes collision attacks based on
97the birthday paradox easy, though.
84 98
85=head2 MINIMIZE CPU TIME REQUIRED 99=head2 MINIMIZE CPU TIME REQUIRED
86 100
87 ./configure --enable-cipher=bf --enable-digest=md4 101 ./configure --enable-cipher=bf --enable-digest=md4
88 102
89Use the fastest cipher and digest algorithms currently available in gvpe. 103Use the fastest cipher and digest algorithms currently available in
104gvpe. MD4 has been broken and is quite insecure, though.
90 105
91=head2 MAXIMIZE SECURITY 106=head2 MAXIMIZE SECURITY
92 107
93 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 108 ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1
94 109
95This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12 110This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12
96would also be pretty secure ;) and will additionally prefix each packet 111would also be pretty secure ;) and will additionally prefix each packet
97with 8 bytes of random data. 112with 8 bytes of random data. In the long run, people should move to
113SHA-224 and beyond, but support in openssl is missing as of writing this
114document.
98 115
99In general, remember that AES-128 seems to be more secure and faster than 116In general, remember that AES-128 seems to be more secure and faster than
100AES-192 or AES-256, more randomness helps against sniffing and a longer 117AES-192 or AES-256, more randomness helps against sniffing and a longer
101HMAC helps against spoofing. MD4 is a fast digest, SHA1 or RIPEMD160 are 118HMAC helps against spoofing. MD4 is a fast digest, SHA1 or RIPEMD160 are
102better, and Blowfish is a fast cipher (and also quite secure). 119better, and Blowfish is a fast cipher (and also quite secure).

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines