X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=README;h=ec7653baa9d006f648dc6e94434eba61b7bdea07;hb=61006ced88e1bf62e8883216cabc636f2d4cb12a;hp=77057b07765d90df910de3be301eb17a00fff235;hpb=e4f65db89726ac06ba7e787d420db4422d9a6e98;p=tinc diff --git a/README b/README index 77057b07..ec7653ba 100644 --- a/README +++ b/README @@ -1,7 +1,7 @@ -This is the README file for tinc version 1.1pre1. Installation +This is the README file for tinc version 1.1pre2. Installation instructions may be found in the INSTALL file. -tinc is Copyright (C) 1998-2011 by: +tinc is Copyright (C) 1998-2012 by: Ivo Timmermans, Guus Sliepen , @@ -29,45 +29,24 @@ protocol is not fixed yet. Security statement ------------------ -In August 2000, we discovered the existence of a security hole in all versions -of tinc up to and including 1.0pre2. This had to do with the way we exchanged -keys. Since then, we have been working on a new authentication scheme to make -tinc as secure as possible. The current version uses the OpenSSL library and -uses strong authentication with RSA keys. - -On the 29th of December 2001, Jerome Etienne posted a security analysis of tinc -1.0pre4. Due to a lack of sequence numbers and a message authentication code -for each packet, an attacker could possibly disrupt certain network services or -launch a denial of service attack by replaying intercepted packets. The current -version adds sequence numbers and message authentication codes to prevent such -attacks. - -On September the 15th of 2003, Peter Gutmann contacted us and showed us a -writeup describing various security issues in several VPN daemons. He showed -that tinc lacks perfect forward security, the connection authentication could -be done more properly, that the sequence number we use as an IV is not the best -practice and that the default length of the HMAC for packets is too short in -his opinion. We do not know of a way to exploit these weaknesses, but we will -address these issues in tinc 2.0. - -Cryptography is a hard thing to get right. We cannot make any -guarantees. Time, review and feedback are the only things that can -prove the security of any cryptographic product. If you wish to review -tinc or give us feedback, you are stronly encouraged to do so. +This version uses an experimental and unfinished cryptographic protocol. Use +it at your own risk. Compatibility ------------- -Version 1.1pre1 is compatible with 1.0pre8, 1.0 and later, but not with older +Version 1.1pre2 is compatible with 1.0pre8, 1.0 and later, but not with older versions of tinc. +When the ExperimentalProtocol option is used, tinc is still compatible with +1.0.X and 1.1pre2 itself, but not with any other 1.1preX version. + Requirements ------------ -Either OpenSSL (http://www.openssl.org/) or libgcrypt -(http://www.gnupg.org/download/#libgcrypt). +OpenSSL (http://www.openssl.org/) version 1.0.0 or later. The zlib library is used for optional compression. You can find it at http://www.gzip.org/zlib/.