--- gvpe/doc/gvpe.5	2008/09/03 04:58:46	1.11
+++ gvpe/doc/gvpe.5	2013/07/13 04:10:29	1.12
@@ -1,15 +1,7 @@
-.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
+.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.20)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
-.de Sh \" Subsection heading
-.br
-.if t .Sp
-.ne 5
-.PP
-\fB\\$1\fR
-.PP
-..
 .de Sp \" Vertical space (when we can't use .PP)
 .if t .sp .5v
 .if n .sp
@@ -53,7 +45,7 @@
 .el       .ds Aq '
 .\"
 .\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
 .ie \nF \{\
@@ -132,7 +124,7 @@
 .\" ========================================================================
 .\"
 .IX Title "GVPE 5"
-.TH GVPE 5 "2008-09-01" "2.2" "GNU Virtual Private Ethernet"
+.TH GVPE 5 "2013-07-10" "2.24" "GNU Virtual Private Ethernet"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -144,7 +136,7 @@
 \&\s-1GVPE\s0 is a suite designed to provide a virtual private network for multiple
 nodes over an untrusted network. This document first gives an introduction
 to VPNs in general and then describes the specific implementation of \s-1GVPE\s0.
-.Sh "\s-1WHAT\s0 \s-1IS\s0 A \s-1VPN\s0?"
+.SS "\s-1WHAT\s0 \s-1IS\s0 A \s-1VPN\s0?"
 .IX Subsection "WHAT IS A VPN?"
 \&\s-1VPN\s0 is an acronym, it stands for:
 .IP "Virtual" 4
@@ -178,7 +170,7 @@
 \&\s-1GVPE\s0 provides a true multi-point network in which any number of nodes (at
 least a few dozen in practise, the theoretical limit is 4095 nodes) can
 participate.
-.Sh "\s-1GVPE\s0 \s-1DESIGN\s0 \s-1GOALS\s0"
+.SS "\s-1GVPE\s0 \s-1DESIGN\s0 \s-1GOALS\s0"
 .IX Subsection "GVPE DESIGN GOALS"
 .IP "\s-1SIMPLE\s0 \s-1DESIGN\s0" 4
 .IX Item "SIMPLE DESIGN"
@@ -226,7 +218,7 @@
 Here are a few recipes for compiling your gvpe, showing the extremes
 (fast, small, insecure \s-1OR\s0 slow, large, more secure), between which you
 should choose:
-.Sh "\s-1AS\s0 \s-1LOW\s0 \s-1PACKET\s0 \s-1OVERHEAD\s0 \s-1AS\s0 \s-1POSSIBLE\s0"
+.SS "\s-1AS\s0 \s-1LOW\s0 \s-1PACKET\s0 \s-1OVERHEAD\s0 \s-1AS\s0 \s-1POSSIBLE\s0"
 .IX Subsection "AS LOW PACKET OVERHEAD AS POSSIBLE"
 .Vb 1
 \&   ./configure \-\-enable\-hmac\-length=4 \-\-enable\-rand\-length=0
@@ -234,9 +226,9 @@
 .PP
 Minimize the header overhead of \s-1VPN\s0 packets (the above will result in
 only 4 bytes of overhead over the raw ethernet frame). This is a insecure
-configuration because a \s-1HMAC\s0 length of 4 makes collision attacks based on
-the birthday paradox pretty easy.
-.Sh "\s-1MINIMIZE\s0 \s-1CPU\s0 \s-1TIME\s0 \s-1REQUIRED\s0"
+configuration because a \s-1HMAC\s0 length of 4 makes collision attacks almost
+trivial.
+.SS "\s-1MINIMIZE\s0 \s-1CPU\s0 \s-1TIME\s0 \s-1REQUIRED\s0"
 .IX Subsection "MINIMIZE CPU TIME REQUIRED"
 .Vb 1
 \&   ./configure \-\-enable\-cipher=bf \-\-enable\-digest=md4
@@ -245,16 +237,15 @@
 Use the fastest cipher and digest algorithms currently available in
 gvpe. \s-1MD4\s0 has been broken and is quite insecure, though, so using another
 digest algorithm is recommended.
-.Sh "\s-1MAXIMIZE\s0 \s-1SECURITY\s0"
+.SS "\s-1MAXIMIZE\s0 \s-1SECURITY\s0"
 .IX Subsection "MAXIMIZE SECURITY"
 .Vb 1
-\&   ./configure \-\-enable\-hmac\-length=16 \-\-enable\-rand\-length=8 \-\-enable\-digest=sha1
+\&   ./configure \-\-enable\-hmac\-length=16 \-\-enable\-rand\-length=12 \-\-enable\-digest=ripemd610
 .Ve
 .PP
 This uses a 16 byte \s-1HMAC\s0 checksum to authenticate packets (I guess 8\-12
 would also be pretty secure ;) and will additionally prefix each packet
-with 8 bytes of random data. In the long run, people should move to
-\&\s-1SHA\-256\s0 and beyond).
+with 12 bytes of random data.
 .PP
 In general, remember that \s-1AES\-128\s0 seems to be as secure but faster than
 \&\s-1AES\-192\s0 or \s-1AES\-256\s0, more randomness helps against sniffing and a longer
@@ -265,7 +256,7 @@
 .IX Header "HOW TO SET UP A SIMPLE VPN"
 In this section I will describe how to get a simple \s-1VPN\s0 consisting of
 three hosts up and running.
-.Sh "\s-1STEP\s0 1: configuration"
+.SS "\s-1STEP\s0 1: configuration"
 .IX Subsection "STEP 1: configuration"
 First you have to create a daemon configuration file and put it into the
 configuration directory. This is usually \f(CW\*(C`/etc/gvpe\*(C'\fR, depending on how you
@@ -310,7 +301,7 @@
 be able to reach the other nodes. You can, of course, also use proxy \s-1ARP\s0
 or other means of pseudo-bridging, or (best) full routing \- the choice is
 yours.
-.Sh "\s-1STEP\s0 2: create the \s-1RSA\s0 key pairs for all hosts"
+.SS "\s-1STEP\s0 2: create the \s-1RSA\s0 key pairs for all hosts"
 .IX Subsection "STEP 2: create the RSA key pairs for all hosts"
 Run the following command to generate all key pairs for all nodes (that
 might take a while):
@@ -320,7 +311,7 @@
 .Ve
 .PP
 This command will put the public keys into \f(CW\*(C`/etc/gvpe/pubkeys/\f(CInodename\f(CW\*(C'\fR and the private keys into \f(CW\*(C`/etc/gvpe/hostkeys/\f(CInodename\f(CW\*(C'\fR.
-.Sh "\s-1STEP\s0 3: distribute the config files to all nodes"
+.SS "\s-1STEP\s0 3: distribute the config files to all nodes"
 .IX Subsection "STEP 3: distribute the config files to all nodes"
 Now distribute the config files and private keys to the other nodes. This
 should be done in two steps, since only the private keys meant for a node
@@ -346,7 +337,7 @@
 .PP
 You should now check the configuration by issuing the command \f(CW\*(C`gvpectrl \-c
 /etc/gvpe \-s\*(C'\fR on each node and verify it's output.
-.Sh "\s-1STEP\s0 4: starting gvpe"
+.SS "\s-1STEP\s0 4: starting gvpe"
 .IX Subsection "STEP 4: starting gvpe"
 You should then start gvpe on each node by issuing a command like:
 .PP
@@ -368,7 +359,7 @@
 .Vb 1
 \&   t1:2345:respawn:/opt/gvpe/sbin/gvpe \-D \-L first >/dev/null 2>&1
 .Ve
-.Sh "\s-1STEP\s0 5: enjoy"
+.SS "\s-1STEP\s0 5: enjoy"
 .IX Subsection "STEP 5: enjoy"
 \&... and play around. Sending a \-HUP (\f(CW\*(C`gvpectrl \-kHUP\*(C'\fR) to the daemon
 will make it try to connect to all other nodes again. If you run it from