Translation

(itstool) path: sect2/para
English
Ueli Maurer's <quote>Universal Statistical Test for Random Bit Generators</quote>(<link xlink:href="https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf"> <acronym>MUST</acronym></link>) quickly measures the entropy of a sample. It uses a compression-like algorithm. <link linkend="code">The code is given below</link> for a variant which measures successive (~quarter megabyte) chunks of a file.
497/4490
Context English Portuguese (Brazil) State
<personname><firstname>David</firstname><surname>Honig</surname></personname><affiliation> <_:address-1/> </affiliation> <personname><firstname>David</firstname><surname>Honig</surname></personname><affiliation> <_:address-1/> </affiliation>
1999-05-03 1999-05-03
FreeBSD is a registered trademark of the FreeBSD Foundation. FreeBSD is a registered trademark of the FreeBSD Foundation.
Motif, OSF/1, and UNIX are registered trademarks and IT DialTone and The Open Group are trademarks of The Open Group in the United States and other countries. Motif, OSF/1, and UNIX are registered trademarks and IT DialTone and The Open Group are trademarks of The Open Group in the United States and other countries.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this document, and the FreeBSD Project was aware of the trademark claim, the designations have been followed by the <quote>™</quote> or the <quote>®</quote> symbol. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this document, and the FreeBSD Project was aware of the trademark claim, the designations have been followed by the <quote>™</quote> or the <quote>®</quote> symbol.
$FreeBSD: head/en_US.ISO8859-1/articles/ipsec-must/article.xml 52227 2018-09-06 01:30:47Z ebrandi $ $FreeBSD: head/en_US.ISO8859-1/articles/ipsec-must/article.xml 52227 2018-09-06 01:30:47Z ebrandi $
You installed IPsec and it seems to be working. How do you know? I describe a method for experimentally verifying that IPsec is working. Você instalou o IPsec e ele parece estar funcionando. Como você sabe? Eu descrevo um método para verificar experimentalmente se o IPsec está funcionando.
The Problem O problema
First, lets assume you have <link linkend="ipsec-install"> installed <emphasis>IPsec</emphasis></link>. How do you know it is <link linkend="caveat">working</link>? Sure, your connection will not work if it is misconfigured, and it will work when you finally get it right. <citerefentry><refentrytitle>netstat</refentrytitle><manvolnum>1</manvolnum></citerefentry> will list it. But can you independently confirm it? Primeiro, vamos assumir que você tem o <link linkend="ipsec-install"><emphasis>IPsec</emphasis> instalado </link>. Como você sabe que ele está <link linkend="caveat">funcionando</link>? Claro, sua conexão não funcionará se ele estiver mal configurado, e funcionará quando você finalmente acertar a configuração. O <citerefentry> <refentrytitle>netstat</refentrytitle><manvolnum>1</manvolnum></citerefentry>irá listá-lo. Mas você pode confirmar isso de forma independente?
The Solution A solução
First, some crypto-relevant info theory: Em primeiro lugar, vejamos alguma informação teórica relevante em relação à criptografia:
Encrypted data is uniformly distributed, i.e., has maximal entropy per symbol; Dados criptografados são uniformemente distribuídos, ou seja, possuem entropia máxima por símbolo;
Raw, uncompressed data is typically redundant, i.e., has sub-maximal entropy. Os dados brutos, não comprimidos são tipicamente redundantes, isto é, possuem entropia submáxima.
Suppose you could measure the entropy of the data to- and from- your network interface. Then you could see the difference between unencrypted data and encrypted data. This would be true even if some of the data in <quote>encrypted mode</quote> was not encrypted---as the outermost IP header must be if the packet is to be routable. Suponha que você possa medir a entropia dos dados destinados para a sua interface de rede e também dos dados originados dela. Então você pode ver a diferença entre dados não criptografados e dados criptografados. Isso seria verdade mesmo que alguns dos dados no <quote>modo criptografado</quote> não estivessem criptografados --- como deve o cabeçalho IP mais externo para que o pacote seja roteável.
MUST MUST
Ueli Maurer's <quote>Universal Statistical Test for Random Bit Generators</quote>(<link xlink:href="https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf"> <acronym>MUST</acronym></link>) quickly measures the entropy of a sample. It uses a compression-like algorithm. <link linkend="code">The code is given below</link> for a variant which measures successive (~quarter megabyte) chunks of a file. O teste de <quote>Estatística Universal para Geradores de Bits Aleatórios</quote> de Ueli Maurer (<link xlink:href="https://web.archive.org/web/20011115002319/http://www.geocities.com/SiliconValley/Code/4704/universal.pdf"><acronym>MUST</acronym> </link>) mede rapidamente a entropia de uma amostra. Ele usa um algoritmo semelhante à compressão. <link linkend="code"> O código é dado abaixo</link> para uma variante que mede partes sucessivas (aproximadamente um quarto de megabyte) de um arquivo.
Tcpdump Tcpdump
We also need a way to capture the raw network data. A program called <citerefentry><refentrytitle>tcpdump</refentrytitle><manvolnum>1</manvolnum></citerefentry> lets you do this, if you have enabled the <emphasis>Berkeley Packet Filter</emphasis> interface in your <link linkend="kernel">kernel's config file</link>. Também precisamos de uma maneira de capturar os dados brutos da rede. Um programa chamado <citerefentry><refentrytitle>tcpdump</refentrytitle> <manvolnum>1</manvolnum></citerefentry> permite que você faça isso, se você ativou a interface <emphasis>Berkeley Packet Filter</emphasis> no seu <link linkend="kernel">arquivo de configuração do kernel</link>.
The command: O comando:
<userinput>tcpdump -c 4000 -s 10000 -w <replaceable>dumpfile.bin</replaceable></userinput> <userinput>tcpdump -c 4000 -s 10000 -w <replaceable>dumpfile.bin</replaceable></userinput>
will capture 4000 raw packets to <replaceable>dumpfile.bin</replaceable>. Up to 10,000 bytes per packet will be captured in this example. irá capturar 4000 pacotes brutos no arquivo <replaceable>dumpfile.bin</replaceable>. Até 10.000 bytes por pacote serão capturados neste exemplo.
The Experiment O Experimento
Here is the experiment: Aqui está o experimento:
Open a window to an IPsec host and another window to an insecure host. Abra uma janela para um host IPsec e outra janela para um host inseguro.
Now start <link linkend="tcpdump">capturing packets</link>. Agora comece a <link linkend="tcpdump">capturar os pacotes</link>.
In the <quote>secure</quote> window, run the <trademark class="registered">UNIX</trademark> command <citerefentry><refentrytitle>yes</refentrytitle><manvolnum>1</manvolnum></citerefentry>, which will stream the <literal>y</literal> character. After a while, stop this. Switch to the insecure window, and repeat. After a while, stop. Na janela <quote>segura</quote>, execute o comando <trademark class="registered">UNIX</trademark> <citerefentry><refentrytitle>yes</refentrytitle><manvolnum>1</manvolnum></citerefentry>, que transmitirá o caractere <literal>y</literal>. Depois de um tempo, pare com isso. Alterne para a janela insegura e repita. Depois de um tempo, pare.
Now run <link linkend="code">MUST</link> on the captured packets. You should see something like the following. The important thing to note is that the secure connection has 93% (6.7) of the expected value (7.18), and the <quote>normal</quote> connection has 29% (2.1) of the expected value. Agora execute o <link linkend="code">MUST</link> nos pacotes capturados. Você deve ver algo como o seguinte. O importante é notar que a conexão segura tem 93% (6,7) do valor esperado (7,18), e a conexão <quote>normal</quote> tem 29% (2,1) do valor esperado.
<prompt>%</prompt> <userinput>tcpdump -c 4000 -s 10000 -w <replaceable>ipsecdemo.bin</replaceable></userinput>
<prompt>%</prompt> <userinput>uliscan <replaceable>ipsecdemo.bin</replaceable></userinput>

Uliscan 21 Dec 98
L=8 256 258560
Measuring file ipsecdemo.bin
Init done
Expected value for L=8 is 7.1836656
6.9396 --------------------------------------------------------
6.6177 -----------------------------------------------------
6.4100 ---------------------------------------------------
2.1101 -----------------
2.0838 -----------------
2.0983 ----------------- 		<prompt>%</prompt> <userinput>tcpdump -c 4000 -s 10000 -w <replaceable>ipsecdemo.bin</replaceable></userinput>
<prompt>%</prompt> <userinput>uliscan <replaceable>ipsecdemo.bin</replaceable></userinput>

Uliscan 21 Dec 98
L=8 256 258560
Measuring file ipsecdemo.bin
Init done
Expected value for L=8 is 7.1836656
6.9396 --------------------------------------------------------
6.6177 -----------------------------------------------------
6.4100 ---------------------------------------------------
2.1101 -----------------
2.0838 -----------------
2.0983 -----------------
Caveat Embargo
This experiment shows that IPsec <emphasis>does</emphasis> seem to be distributing the payload data <emphasis>uniformly</emphasis>, as encryption should. However, the experiment described here <emphasis>cannot</emphasis> detect many possible flaws in a system (none of which do I have any evidence for). These include poor key generation or exchange, data or keys being visible to others, use of weak algorithms, kernel subversion, etc. Study the source; know the code. Esta experiência mostra que o IPsec <emphasis>parece</emphasis> estar distribuindo os dados de carga <emphasis>uniformemente</emphasis>, como a criptografia deveria. No entanto, o experimento descrito aqui <emphasis>não pode</emphasis> detectar muitas das falhas possíveis em um sistema (nenhum dos quais eu tenho qualquer evidência para). Estes incluem geração ou troca deficiente de chaves, dados ou chaves sendo visíveis para outros, uso de algoritmos fracos, subversão do kernel, etc. Estude a fonte; conheça o código.
IPsec---Definition IPsec --- Definição

Loading…

No matching activity found.

Browse all component changes

Glossary

English Portuguese (Brazil)
No related strings found in the glossary.

Source information

Source string comment
(itstool) path: sect2/para
Source string location
article.translate.xml:80
String age
a year ago
Source string age
a year ago
Translation file
articles/pt_BR/ipsec-must.po, string 19