şükela:  tümü | bugün
  • (bkz: ssl)
  • anahtar kelime** veya dijital sertifika* yardimiyla ip aglari* uzerinde sifrelenmis ip trafigi kullanarak guvenli erisim saglayan bir yontemdir.
  • tcp/ip iletişiminde verilerin şifrelenerek gönderildiği bir tekniktir. windows 2000, windows 2003 networklerinin internet ve intranet ortamlarındaki güvenliğini oluşturmaktadır. ayrıca pptp ve l2tp gibi vpn (virtual private networks) protokolleri de ipsec ile şifrelenerek güvenli hale gelirler.
  • (bkz: ietf)tarafından oluşturulan internet güvenlik protokolü standardıdır. ağ güvenlik geçidi ((bkz: vpn)) uygulamaların sıklıkla kullanılmaktadır. şifreleme ve asıllama algoritmalarından bağımsız olması sebebiyle askeri ve ticari uygulamaların ikisinde de kullanılmaktadır. ticari uygulamalarda genellikle şifreleme algoritması olarak (bkz: aes)asılllama algoritması olarak da (bkz: sha1)kullanılır.
  • theo de raadt 'ın bildirdiğine göre openbsd implementasyonuna fbi tarafından backdoor yerleştirilen zımbırtı.

    http://marc.info/…penbsd-tech&m=129236621626462&w=2

    --- spoiler ---

    list: openbsd-tech
    subject: allegations regarding openbsd ipsec
    from: theo de raadt <deraadt () cvs ! openbsd ! org>
    date: 2010-12-14 22:24:39
    message-id: 201012142224.obemodwm031222 () cvs ! openbsd ! org
    [download message raw]

    i have received a mail regarding the early development of the openbsd
    ipsec stack. it is alleged that some ex-developers (and the company
    they worked for) accepted us government money to put backdoors into
    our network stack, in particular the ipsec stack. around 2000-2001.

    since we had the first ipsec stack available for free, large parts of
    the code are now found in many other projects/products. over 10
    years, the ipsec code has gone through many changes and fixes, so it
    is unclear what the true impact of these allegations are.

    the mail came in privately from a person i have not talked to for
    nearly 10 years. i refuse to become part of such a conspiracy, and
    will not be talking to gregory perry about this. therefore i am
    making it public so that
    (a) those who use the code can audit it for these problems,
    (b) those that are angry at the story can take other actions,
    (c) if it is not true, those who are being accused can defend themselves.

    of course i don't like it when my private mail is forwarded. however
    the "little ethic" of a private mail being forwarded is much smaller
    than the "big ethic" of government paying companies to pay open source
    developers (a member of a community-of-friends) to insert
    privacy-invading holes in software.

    ----

    from: gregory perry <gregory.perry@govirtual.tv>
    to: "deraadt@openbsd.org" <deraadt@openbsd.org>
    subject: openbsd crypto framework
    thread-topic: openbsd crypto framework
    thread-index: acuzjuf6ct4gcsmqqv+fo3/+2m80eg==
    date: sat, 11 dec 2010 23:55:25 +0000
    message-id: <8d3222f9eb68474da381831a120b1023019ac034@mbx021-e2-nj-5.exch021.domain.local>
    accept-language: en-us
    content-language: en-us
    x-ms-has-attach:
    x-ms-tnef-correlator:
    content-type: text/plain; charset="iso-8859-1"
    content-transfer-encoding: quoted-printable
    mime-version: 1.0
    status: ro

    hello theo,

    long time no talk. if you will recall, a while back i was the cto at
    netsec and arranged funding and donations for the openbsd crypto
    framework. at that same time i also did some consulting for the fbi,
    for their gsa technical support center, which was a cryptologic
    reverse engineering project aimed at backdooring and implementing key
    escrow mechanisms for smart card and other hardware-based computing
    technologies.

    my nda with the fbi has recently expired, and i wanted to make you
    aware of the fact that the fbi implemented a number of backdoors and
    side channel key leaking mechanisms into the ocf, for the express
    purpose of monitoring the site to site vpn encryption system
    implemented by eousa, the parent organization to the fbi. jason
    wright and several other developers were responsible for those
    backdoors, and you would be well advised to review any and all code
    commits by wright as well as the other developers he worked with
    originating from netsec.

    this is also probably the reason why you lost your darpa funding, they
    more than likely caught wind of the fact that those backdoors were
    present and didn't want to create any derivative products based upon
    the same.

    this is also why several inside fbi folks have been recently
    advocating the use of openbsd for vpn and firewalling implementations
    in virtualized environments, for example scott lowe is a well
    respected author in virtualization circles who also happens top be on
    the fbi payroll, and who has also recently published several tutorials
    for the use of openbsd vms in enterprise vmware vsphere deployments.

    merry christmas...

    gregory perry
    chief executive officer
    govirtual education

    "vmware training products & services"

    540-645-6955 x111 (local)
    866-354-7369 x111 (toll free)
    540-931-9099 (mobile)
    877-648-0555 (fax)

    http://www.facebook.com/gregoryvperry
    http://www.facebook.com/govirtual

    --- spoiler ---
  • hakkindaki openbsd backdoor iddialarinin yalan oldugunu dusunuyorum. bunu dusunme sebebim ise devlet/fbi kontratlarindaki nda'in genelde 3-5 yilda expire etmeyen cinsten olmasi.

    balon cikacak soylemisti dersiniz...
  • ethernet'in uzerinde transport layer'in altinda; ip ile ayni levelda olan bir protokol. sanilanin aksine ssl (veya tls) transport layer uzerinde bir guvenlik katmani saglarken ipsec bunu daha asagida gerceklestirir. yani sifrelenen komple ip paketleridir, sadece ip paketlerinin uzerinde yer alan payload degil.
  • aynı zamanda defakto bir linux ipsec tunneling araçlarından biridir. ilk olarak openswan projesi için geliştirilmiştir. direkt ipsec komutunu konsoldan parametrelerle çağırarak çalıştırılır. tahmin edilebileceği gibi çoğunlukla vpn bağlantısı kurmak için kullanılır.