CURVETUN(8) netsniff-ng toolkit CURVETUN(8) (NAME) curvetun - ip4/6 curve25519 (SYNOPSIS) curvetun [] (DESCRIPTION) curvetun IP (ECDH) epoll(2) . TUN/TAP {IPv4, IPv6} {IPv4, IPv6} UDP TCP . IP (CPU) TCP . (end-to-end) Salsa20 Poly1305 ECDH Curve25519 . . "NaCl" . curvetun curvetun . curvetun obfsproxy Telex . curvetun (replay attacks) - (DH man-in-the-middle) . syslog . 1. obfsproxy (TOR) https://www.torproject.org/projects/obfsproxy.html.en 2. Telex https://telex.cc (OPTIONS) -d , --dev . curves{0,1,2,..} curvetun curvec{0,1,2,...} curvetun . -p , --port curvetun . curvetun . . -t , --stun STUN IP (punch a hole) . STUN ''--stun stunserver.org'' . -c[=alias], --client[=alias] curvetun . -k, --keygen . . -x, --export (stdout) . -C, --dumpc curvetun . -S, --dumps curvetun . -D, --nofork (fork ) . -s, --server curvetun . . -N, --no-logging curvetun. curvetun . . -u, --udp UDP TCP. TCP . . -4, --ipv4 IPv4 . IPv4 . . -6, --ipv6 IPv6 . . -v, --version . -h, --help . (USAGE EXAMPLES) curvetun --server -4 -u -N --port 6666 --stun stunserver.org curvetun IPv4 UDP. curvetun 6666 STUN stunserver.org . curvetun --client=ethz curvetun ''ethz'' ~/.curvetun/servers . curvetun --keygen ~/.curvetun/ curvetun --export curvetun. (CRYPTOGRAPHY) IP (VPN) . VPN . OpenVPN VTUN . VTUN TUN/TAP . VTUN . MD5 BlowFish ECB [1]. OpenSSL VTUN OpenVPN OpenVPN . : . . OpenSSL . (Tanja Lange) . (Daniel J. Bernstein) NaCl ( '''') . NaCl OpenSSL OpenSSL curvetun . . : " RSA : RSA . RSA . RSA ECM . . IEEE P1363 . NIST IEEE P1363 . (NSA) ''Suite B'' NIST ( ) RSA ." curvetun Curve25519 : Daniel J. Bernstein, ''Curve25519: new Diffie-Hellman speed records,'' pages 207-228 in Proceedings of PKC 2006, edited by Moti Yung, Yevgeniy Dodis, Aggelos Kiayias, and Tal Malkin, Lecture Notes in Computer Science 3958, Springer, 2006, ISBN 3-540-33851-9. IEEE P1363 . '' '' (side-channel immunity) '' '' (twist security) . Curve25519 NIST P-256 . Curve25519 1000000000000000000000000000 Curve25519 . RSA (3000-bit) RSA . 1. VTun http://www.off.net/~jme/vtun_secu.html 2. NaCl http://nacl.cr.yp.to (SETUP HOWTO) curvetun . NTP. (replay attacks) . /dev/net/tun . curvetun (root) ! . : curvetun -k . . 'mysrv1' 'myclient1' . ~/.curvetun . "priv.key" "pub.key" "username" "clients" "servers" . "clients" "servers" . "clients" . "servers" curvetun . . : curvetun -x : myclient1;11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11 \_______/ \_____________________________________________________________________________________________/ username 32 byte public key for 'myclient1' ( ) ''clients'' : server$ echo "myclient1;11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:" \ "11:11:11:11:11:11:11:11:11:11:11:11:11:11:11" >> ~/.curvetun/clients : server$ curvetun -C ''~/.curvetun/clients'' . Perl LDAP . ''myclient1'' . . IP 1.2.3.4 6666 UDP . NAT ''--stun'' . 1.2.3.4 6666 UDP . : server$ curvetun -x : mysrv1;22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22 \____/ \_____________________________________________________________________________________________/ username 32 byte public key for 'mysrv1' ^-- you need this public key IP . : client$ echo "myfirstserver;1.2.3.4;6666;udp;22:22:22:22:22:22:22:22:22:22:" \ "22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:" \ "22:22" >> ~/.curvetun/servers : client$ curvetun -S : server$ curvetun -s -p 6666 -u server# ifconfig curves0 up server# ifconfig curves0 10.0.0.1/24 : client$ curvetun -c=myfirstserver client# ifconfig curvec0 up client# ifconfig curvec0 10.0.0.2/24 syslog ! : client$ ping 10.0.0.1 ! (Routing): IP eth0 1.2.3.4 : server$ ... start curvetun server ... server# ifconfig curves0 up server# ifconfig curves0 10.0.0.1/24 server# echo 1 > /proc/sys/net/ipv4/ip_forward server# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE server# iptables -A FORWARD -i eth0 -o curves0 -m state --state RELATED,ESTABLISHED -j ACCEPT server# iptables -A FORWARD -i curves0 -o eth0 -j ACCEPT IP eth0 5.6.7.8 : client$ ... start curvetun client ... client# ... lookup your default gateway (e.g. via route, here: 5.6.7.9) ... client# ifconfig curvec0 up client# ifconfig curvec0 10.0.0.2/24 client# route add -net 1.2.3.0 netmask 255.255.255.0 gw 5.6.7.9 dev eth0 client# route add default gw 10.0.0.1 client# route del default gw 5.6.7.9 curvetun ! (NOTE) . . (BUGS) (Blackhole tunneling) . (LEGAL) curvetun 2.0 (GNU GPL) . (HISTORY) curvetun Daniel Borkmann netsniff-ng . Tobias Klauser Daniel Borkmann . (SEE ALSO) netsniff-ng(8), trafgen(8), mausezahn(8), bpfc(8), ifpps(8), flowtop(8), astraceroute(8) (AUTHOR) Daniel Borkmann . (COLOPHON) netsniff-ng . http://netsniff-ng.org . Linux 03 March 2013 CURVETUN(8)