| … | |
… | |
| 50 | |
50 | |
| 51 | =back |
51 | =back |
| 52 | |
52 | |
| 53 | =head2 GVPE DESIGN GOALS |
53 | =head2 GVPE DESIGN GOALS |
| 54 | |
54 | |
| 55 | =over 4 |
55 | =over 4 |
| 56 | |
56 | |
| 57 | =item SIMPLE DESIGN |
57 | =item SIMPLE DESIGN |
| 58 | |
58 | |
| 59 | Cipher, HMAC algorithms and other key parameters must be selected |
59 | Cipher, HMAC algorithms and other key parameters must be selected |
| 60 | at compile time - this makes it possible to only link in algorithms |
60 | at compile time - this makes it possible to only link in algorithms |
| … | |
… | |
| 130 | gvpe. MD4 has been broken and is quite insecure, though, so using another |
130 | gvpe. MD4 has been broken and is quite insecure, though, so using another |
| 131 | digest algorithm is recommended. |
131 | digest algorithm is recommended. |
| 132 | |
132 | |
| 133 | =head2 MAXIMIZE SECURITY |
133 | =head2 MAXIMIZE SECURITY |
| 134 | |
134 | |
| 135 | ./configure --enable-hmac-length=16 --enable-rand-length=8 --enable-digest=sha1 |
135 | ./configure --enable-hmac-length=16 --enable-rand-length=16 --enable-digest=sha384 |
| 136 | |
136 | |
| 137 | This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12 |
137 | This uses a 16 byte HMAC checksum to authenticate packets (I guess 8-12 |
| 138 | would also be pretty secure ;) and will additionally prefix each packet |
138 | would also be pretty secure ;) and will additionally prefix each packet |
| 139 | with 8 bytes of random data. In the long run, people should move to |
139 | with 16 bytes of random data. |
| 140 | SHA-256 and beyond). |
|
|
| 141 | |
140 | |
| 142 | In general, remember that AES-128 seems to be as secure but faster than |
141 | In general, remember that AES-128 seems to be as secure but faster than |
| 143 | AES-192 or AES-256, more randomness helps against sniffing and a longer |
142 | AES-192 or AES-256, more randomness helps against sniffing and a longer |
| 144 | HMAC helps against spoofing. MD4 is a fast digest, SHA1, RIPEMD160, SHA256 |
143 | HMAC helps against spoofing. MD4 is a fast digest, SHA1, RIPEMD160, SHA256 |
| 145 | are consecutively better, and Blowfish is a fast cipher (and also quite |
144 | are consecutively better, and Blowfish is a fast cipher (and also quite |
