[B! openssl][ssl] muddydixonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

muddydixon id:muddydixon

opensslã¨sslã«é–¢ã™ã‚‹muddydixonã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

æ›¸è©•ï¼šãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLS - ã¼ã¡ã¼ã¡æ—¥è¨˜
ã”ã‚ã‚“ãªã•ã„ã€æ›¸ã„ã¦ãŸã‚‰é•·ããªã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚é•·æ–‡å«Œã„ãªæ–¹ã¯é¿ã‘ã¦ä¸‹ã•ã„ã€‚ é¹¿é‡Žã•ã‚“ã®åå‰ã‚’é–“é•ãˆã¦ã¾ã—ãŸã€‚å¤§å¤‰å¤±ç¤¼ã—ã¾ã—ãŸã€‚ï¼ˆï¼¿Oï¼¿ï¼‰ 1. ã¯ã˜ã‚ã«ã€‚æ—¥æœ¬èªžç¿»è¨³ç‰ˆåˆŠè¡Œã«ã‚ˆã›ã¦ã€ æ˜¨å¹´10æœˆã€Vã•ã‚“ã‹ã‚‰ ã€Œ Bulletproof SSL and TLS ç¿»è¨³æœ¬ã®ãƒ¬ãƒ“ãƒ¥ãƒ¼ã—ã¾ã™ï¼Ÿæ™‚é›¨å ‚ãŒå‡ºè³‡ã—ã¦ã‚‹å‡ºç‰ˆä¼šç¤¾ãŒç¿»è¨³æ¨©ã‚’å‹ã¡å–ã£ãŸã®ã§ã™ã€‚ã€ ã¨ãŠèª˜ã„ã‚’å—ã‘ãŸã®ãŒã€ãã‚‚ãã‚‚ã®å§‹ã¾ã‚Šã§ã—ãŸã€‚ ã€Œã¨ã†ã¨ã†ã‚ã‚Œã®æ—¥æœ¬èªžç¿»è¨³ãŒå‡ºã‚‹ã®ã‹ã€ã§ã‚‚ãƒ›ãƒ³ãƒˆå¤§ä¸ˆå¤«ã‹ï¼Ÿ å†…å®¹ã®æ¿ƒã•ã‚‚ã•ã‚‹ã“ã¨ãªãŒã‚‰ã‚ã®åˆ†é‡ã¨ã‚¯ã‚ªãƒªãƒ†ã‚£ã€è¨˜è¿°ã®æ£ç¢ºã•ã‚„åŽ³å¯†ã•ã«å¯¾ã—ã¦ç‰¹ã«é«˜ã„ã‚‚ã®ãŒè¦æ±‚ã•ã‚Œã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åˆ†é‡Žã€‚ã—ã‹ã‚‚åˆå¿ƒè€…å‘ã‘ã§ã¯ãªã„ã‚¨ã‚ã‚¹ãƒ‘ãƒ¼ãƒˆå‘ã‘ã€‚ã“ã®æœ¬ã®ç¿»è¨³ã‚’å‡ºã™ã¨ã¯â€¦ ãªã‚“ã¨å¤§èƒ†ã€å°‘ã—ç„¡è¬€ãªã“ã¨ã§ã¯ãªã„ã‹ï¼Ÿã€ ã¨ã®æ€ã„ãŒæ£ç›´é ã‚’ã‚ˆãŽã‚Šã¾ã—ãŸã€‚ è‡ªåˆ†ã‚‚ã¡ã‚‡ã†ã©17å¹´åŠå‹¤ã‚ãŸå‰è·ã‚’è¾žã‚ã¦è»¢è·ã—ãŸç›´å¾Œã€‚æ–°ä»»æ—©ã€…ã“ã‚“ãªã“ã¨ã—ã¦ã‚‚è¨±ã•ã‚Œã‚‹ã®
muddydixon 2017/03/20
security

tls

ssl

openssl

book
ãƒªãƒ³ã‚¯
éŒ†ã³ã¤ã„ãŸTLSã‚’æ»‘ã‚‰ã‹ã«ã€Googleã«ã‚ˆã‚‹GREASEè©¦é¨“ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ é•·ã„é–“ã€TLSã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ»ã‚µãƒ¼ãƒé–“ã§ä½¿ç”¨ã™ã‚‹TLSãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’åˆæ„ã™ã‚‹éš›ã«ã€ ä¸å®Œå…¨ãªã‚µãƒ¼ãƒå®Ÿè£…ã«ã‚ˆã£ã¦ version intolerance ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒå•é¡Œã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ TLS1.3ã§ã¯ã“ã® version intolerance ã®å½±éŸ¿ã‚’æœ€å°åŒ–ã™ã‚‹ãŸã‚ã€æ–°ã—ã„ version negotiation ã®ä»•çµ„ã¿ã‚’å–ã‚Šå…¥ã‚Œã¾ã—ãŸã€‚ Googleã¯ã€GREASE(Generate Random Extensions And Sustain Extensibility)ã¨ã„ã†ä»•æ§˜ã‚’Chromeã«å®Ÿè£…ã—ã€TLSã‚µãƒ¼ãƒã®ãƒã‚°ã§é€šã‚‰ãªã„æ‹¡å¼µã‚„ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰å€¤ã§å•é¡ŒãŒç™ºç”Ÿã—ãªã„ã‹è©¦é¨“ã‚’å§‹ã‚ã¾ã—ãŸã€‚ ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ãŒå¥½ããªäººã¯ã€ChromeãŒ 0x[0-f]a0x[0-f]a ã®è¦‹æ…£ã‚Œãªã„å€¤ã‚’CipherSuiteã‚„TLSæ‹¡å¼µã«ä½¿ã£ã¦ã„ã‚‹ã®ã‚’è¦‹ã¤ã‘ã¦ã‚‚é©šã‹ãªã„ã‚ˆã†æ°—ã‚’
muddydixon 2016/10/03
openssl

ssl

tls

security

google

grease

chrome
ãƒªãƒ³ã‚¯
ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
muddydixon 2015/12/04
ssl

tls

security

openssl
ãƒªãƒ³ã‚¯
æ³¨ç›®ã®é›†ã¾ã‚‹SNIå°Žå…¥ã®å¿…è¦æ€§ã¨ã¯
SSL/TLSã®æ‹¡å¼µä»•æ§˜ã®1ã¤ã§ã‚ã‚‹SNIï¼ˆServer Name Indicationï¼‰ã«æ³¨ç›®ãŒé›†ã¾ã£ã¦ã„ã¾ã™ã€‚ ã“ã‚Œã¾ã§ã¯ã€Œ1å°ã®ã‚µãƒ¼ãƒï¼ˆã‚°ãƒãƒ¼ãƒãƒ«IPã‚¢ãƒ‰ãƒ¬ã‚¹ï¼‰ã«ã¤ãSSLè¨¼æ˜Žæ›¸ã¯1ãƒ‰ãƒ¡ã‚¤ãƒ³ã€ã§ã—ãŸãŒã€SNIã‚’åˆ©ç”¨ã™ã‚Œã°ã€ã€Œ1å°ã®ã‚µãƒ¼ãƒã§ç•°ãªã‚‹è¨¼æ˜Žæ›¸ã€ã‚’ä½¿ã„åˆ†ã‘ã‚‹ã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ ãã‚Œã§ã¯ã€SNIã®åˆ©ç”¨æ–¹æ³•ã‚„ãã®å¿…è¦æ€§ã«ã¤ã„ã¦ç¢ºèªã—ã¦ã„ãã¾ã—ã‚‡ã†ã€‚ SNIï¼ˆServer Name Indicationï¼‰ã¨ã¯ä½•ã ã‚ã†ï¼Ÿ SSL/TLSã§ã¯ã€ŒåŒã˜ã‚µãƒ¼ãƒï¼ˆåŒã˜ã‚°ãƒãƒ¼ãƒãƒ«IPã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’åˆ©ç”¨ã™ã‚‹è¤‡æ•°ã®ãƒ¦ãƒ¼ã‚¶ï¼‰ã¯1ã¤ã®SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã—ã‹ä½¿ãˆãªã„ã€ã®ãŒåŸºæœ¬ã§ã™ã€‚ãã®ãŸã‚ã€ã“ã®ã¾ã¾ã ã¨ä¸ä¾¿ãªå ´åˆã‚‚ã‚ã‚Šã¾ã™ã€‚ ãŸã¨ãˆã°ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒã‚µãƒ¼ãƒ“ã‚¹ã‚’ä¾‹ã¨ã—ã¦è€ƒãˆã‚‹ã¨ã€ã€ŒåŒã˜ã‚µãƒ¼ãƒã‚’è¤‡æ•°ã®ãƒ¦ãƒ¼ã‚¶ãŒåˆ©ç”¨ã—ã€ãªãŠã‹ã¤ãƒ¦ãƒ¼ã‚¶ã”ã¨ã«ç•°ãªã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’åˆ©ç”¨ã™ã‚‹ã€ã¨ã„ã†å ´åˆã‚‚ã‚ã‚‹ã§ã—ã‚‡ã†ï¼ˆåå‰ãƒ™ãƒ¼ã‚¹ãƒãƒ¼ãƒãƒ£ãƒ«
muddydixon 2015/07/01
ssl

openssl

https

credential

sni
ãƒªãƒ³ã‚¯
CVE-2014-0160 OpenSSL Heartbleed è„†å¼±æ€§ã¾ã¨ã‚ - ã‚ã‚‚ãŠãã°
å¿…è¦ãªæƒ…å ±ã¯ http://heartbleed.com/ ã«ã¾ã¨ã¾ã£ã¦ã„ã‚‹ã®ã§ã™ãŒã€è‹±èªžã ã—é•·ã„ã—ã£ã¦äººã®ãŸã‚ã«æ‰‹çŸã«ã¾ã¨ã‚ã¦ãŠãã¾ã™ã€‚ ã©ã†ã™ã‚Œã°ã„ã„ã®ã‹ OpenSSL 1.0.1ã€œ1.0.1fã‚’ä½¿ã£ã¦ã„ãªã‘ã‚Œã°ã‚»ãƒ¼ãƒ• ã‚ã¦ã¯ã¾ã‚‹å ´åˆã«ã¯ã€ä¸€åˆ»ã‚‚æ—©ããƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã—ã¦ã€ã‚µãƒ¼ãƒã”ã¨å†èµ·å‹•(ã‚ã‹ã‚‹ã²ã¨ã¯ã‚µãƒ¼ãƒ“ã‚¹å˜ä½ã§ã‚‚OKã€ãŸã ã—reloadã§ã¯ã ã‚ãªã“ã¨ã‚‚) SSLè¨¼æ˜Žæ›¸ã§ã‚µãƒ¼ãƒã‚’å…¬é–‹ã—ã¦ã„ã‚‹ãªã‚‰ã€ç§˜å¯†éµã‹ã‚‰ä½œã‚Šç›´ã—ã¦è¨¼æ˜Žæ›¸ã‚’å†ç™ºè¡Œã—ã€éŽåŽ»ã®è¨¼æ˜Žæ›¸ã‚’å¤±åŠ¹ã•ã›ã‚‹(æœ«å°¾ã«é–¢é€£ãƒªãƒ³ã‚¯ã‚ã‚Š)ã€‚ ã‚µãƒ¼ãƒã‚’å…¬é–‹ã—ã¦ã„ãªã„å ´åˆã‚‚ã€å¤–éƒ¨ã¸ã®SSLé€šä¿¡ãŒã‚ã‚Œã°å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã§ã€è©³ã—ãç²¾æŸ»ã™ã‚‹ã€‚ PFS(perfect forward secrecy)ã‚’åˆ©ç”¨ã—ã¦ã„ãªã„å ´åˆã€éŽåŽ»ã®é€šä¿¡å†…å®¹ã‚‚å¾©å·ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ãŸã‚ã€è©³ã—ãç²¾æŸ»ã™ã‚‹ã€‚ æ¼æ´©ã™ã‚‹æƒ…å ±ã®å…·ä½“ä¾‹ã¯ã€OpenSSLã®è„†å¼±æ€§ã§æƒ³å®šã•ã‚Œã‚‹ãƒªã‚¹ã‚¯ã¨ã—ã¦
muddydixon 2014/04/09
openssl

security

ssl
ãƒªãƒ³ã‚¯
1