[B! openssl] shoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

sho id:sho

opensslã«é–¢ã™ã‚‹shoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OpenSSLã®è„†å¼±æ€§CVE-2016-800(DROWN)ã‚„CVE-2016-0702(CacheBleed)ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2016å¹´3æœˆ1æ—¥(ç¾åœ°æ™‚é–“)ã€OpenSSL ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯è„†å¼±æ€§ã®æ„›ç§°ã€ŒDROWNã€ã‚„ã€ŒCacheBleedã€ã‚’å«ã‚€8ä»¶ã®è„†å¼±æ€§æƒ…å ±ã‚’å…¬é–‹ã—ã€ã“ã‚Œã‚‰å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚‚ã®ã®ä¿®æ£ã‚’è¡Œã£ãŸæœ€æ–°ç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§æƒ…å ±æ¦‚è¦ æ³¨æ„å–šèµ· OpenSSL ã®è¤‡æ•°ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ· - JPCERT/CC SSLv2 DROWN Attack - US-CERT OpenSSL Projectã®å…¬é–‹æƒ…å ± Forthcoming OpenSSL releases OpenSSL Security Advisory ï¼»1st March 2016ï¼½ OpenSSL version 1.0.1s published OpenSSL version 1.0.2g published An OpenSSL Userâ€™s Guide to DROWN 2016å¹´3æœˆ1æ—¥å…¬
sho 2016/03/02
ã©ã‚“ãªå ±é“ã‚ˆã‚Šã‚‚piyologãŒå‚è€ƒã«ãªã‚‹ä»¶

security

openssl

drown

cachebleed
ãƒªãƒ³ã‚¯
è¯éº—ãªã‚‹å› æ•°åˆ†è§£:FREAKæ”»æ’ƒã®ä»•çµ„ã¿ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã« ã¡ã‚‡ã†ã©ä»Šæœ OpenSSLã‚’ã¯ã˜ã‚ã¨ã—ãŸæ§˜ã€…ãªTLSå®Ÿè£…ã®è„†å¼±æ€§ã®è©³ç´°ãŒå…¬è¡¨ã•ã‚Œã¾ã—ãŸã€‚ ã“ã® Inriaã¨MSRã®ã‚°ãƒ«ãƒ¼ãƒ—ã¯ä»¥å‰ã‹ã‚‰TLSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã—ã¦éžå¸¸ã«ã‚¢ã‚¯ãƒ†ã‚£ãƒ–ã«èª¿æŸ»ãƒ»æ¤œè¨¼ã‚’ã—ã¦ã„ã‚‹ã‚°ãƒ«ãƒ¼ãƒ—ã§ã€ä»Šå›žã‚‚é©šãã®å†…å®¹ã§ã—ãŸã€‚ ã“ã®ã‚°ãƒ«ãƒ¼ãƒ—ã¯ã€TLSã®ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯æ™‚ã®çŠ¶æ…‹é·ç§»ã‚’åŽ³å¯†ã«ãƒã‚§ãƒƒã‚¯ã™ã‚‹ãƒ„ãƒ¼ãƒ«ã‚’é–‹ç™ºã—ã€æ§˜ã€…ãªTLSå®Ÿè£…ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ãƒ»å ±å‘Šã‚’è¡Œã£ã¦ã„ãŸã‚ˆã†ã§ã™ã€‚ ç‰¹ã«FREAKã¨å‘¼ã°ã‚Œã‚‹OpenSSLã®è„†å¼±æ€§(CVE-2015-0204)ã«é–¢ã—ã¦ã¯ã€ã¡ã‚‡ã†ã©ä¿®æ£ç›´å¾Œã®1æœˆåˆã‚ã« Only allow ephemeral RSA keys in export ciphersuites ã§è¦‹ã¦ã„ã¾ã—ãŸãŒã€å…·ä½“çš„ã«ã©ã®ã‚ˆã†ã«æ”»æ’ƒã™ã‚‹ã®ã‹ã•ã£ã±ã‚Šã‚¤ãƒ¡ãƒ¼ã‚¸ã§ããšã€ã‚ã®ã‚°ãƒ«ãƒ¼ãƒ—ã ã‹ã‚‰ã¾ãŸè¶…çµ¶å¤‰æ…‹ãªæ‰‹æ³•ã ã‚ã†ãŒã€ã¾ããã‚Œã»ã©æ·±åˆ»ã˜ã‚ƒãªã„ã ã‚ã†ã¨è¦‹è¾¼ã‚“ã§ã„ã¾ã—ãŸã€‚ ä»Šå›ž
sho 2015/03/05
security

freak

openssl
ãƒªãƒ³ã‚¯
è„†å¼±æ€§è¨ºæ–ãƒ»ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®GMOã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ byã‚¤ã‚¨ãƒ©ã‚¨
â€»1 å½“ç¤¾èª¿ã¹ â€»2 SECCON CTF 13 Finalsï¼šå›½å†…1ä½ â€»3 2023å¹´ï½ž2025å¹´ DEF CON Cloud Village CTFï¼šä¸–ç•Œ1ä½
sho 2014/06/06
security

openssl

coq
ãƒªãƒ³ã‚¯
ï¼¯ï½ï½…ï½Žï¼³ï¼³ï¼¬ï¼šäº‹å‰èª¿æ•´é–“ã«åˆã‚ãšã€€æ¬ é™¥å…¬è¡¨ã®èˆžå°è£ | æ¯Žæ—¥æ–°èž
è¦å¯ŸåºãŒç¢ºèªã—ãŸOpenSSLã®æ¬ é™¥ã‚’æ¨™çš„ã¨ã™ã‚‹ã‚¢ã‚¯ã‚»ã‚¹ã®æŽ¨ç§»ã€‚æœ€å¤§æ™‚ã§ã¯ï¼‘ç§’é–“ã«ï¼’å›žç¨‹åº¦ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒè¡Œã‚ã‚Œã¦ã„ã‚‹ï¼ˆè¦å¯Ÿåºæä¾›ï¼‰ æš—å·åŒ–ã‚½ãƒ•ãƒˆã€Œï¼¯ï½ï½…ï½Žï¼³ï¼³ï¼¬ã€ã§è¦‹ä»˜ã‹ã£ãŸæ·±åˆ»ãªæ¬ é™¥ã€Œï¼¨ï½…ï½ï½’ï½”ï½‚ï½Œï½…ï½…ï½„ï¼ˆå¿ƒè‡“å†…å‡ºè¡€ï¼‰ã€ã€‚é–‹ç™ºè€…ãŒæ¬ é™¥ã‚’å…¬è¡¨ã™ã‚‹å‰ã®ï¼”æœˆï¼–æ—¥å¤œã€æ—¥æœ¬ã®æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼çµ„ç¹”ã«æµ·å¤–ã‹ã‚‰â€œç¬¬ä¸€å ±â€ãŒå…¥ã‚Šã€æ”»æ’ƒè€…ã«çŸ¥ã‚‰ã‚Œã‚‹å‰ã«ä¿®æ£å¯¾å¿œã‚’è¡Œã†ã€Œäº‹å‰èª¿æ•´ã€ã«å‘ã‘ãŸæº–å‚™ãŒç§˜å¯†è£ã«é€²ã‚ã‚‰ã‚Œã¦ã„ãŸã“ã¨ãŒã‚ã‹ã£ãŸã€‚ã ãŒã€ã“ã®è©¦ã¿ã¯ã€çµå±€é–“ã«åˆã‚ãšã€æ”»æ’ƒå´ã¨é˜²å¾¡å´ã®ç«¶äº‰ã¯ã€æ¬ é™¥ã®å…¬è¡¨ã‚’â€œåˆå›³â€ã«å§‹ã¾ã£ãŸã€‚ã€å°¾æ‘æ´‹ä»‹ï¼ãƒ‡ã‚¸ã‚¿ãƒ«å ±é“ã‚»ãƒ³ã‚¿ãƒ¼ã€‘
sho 2014/05/13
security

openssl

heartbleed
ãƒªãƒ³ã‚¯
LibreSSL
LibreSSL 4.2.1 released Oct 30th, 2025 LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of modernizing the codebase, improving security, and applying best practice development processes. Primary development occurs inside the OpenBSD source tree with the usual care the project is known for. On a regular basis the code is re-packaged for porta ble use by other ope
sho 2014/04/22
OpenSSLã®(OpenBSDã«ã‚ˆã‚‹)ãƒ•ã‚©ãƒ¼ã‚¯ã€‚æ—§IOpenOpenSSL? åå‰ã‹ã‚‰ã—ã¦ãƒã‚¿ã£ã½ã„ã‘ã©ãƒžã‚¸ãªã‚“ã ã‚ã†ãªã€‚

openssl

libressl
ãƒªãƒ³ã‚¯
Heartbleedæ¤œçŸ¥ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®ãƒã‚°ã«ã¤ã„ã¦
ä»¥ä¸‹ã®è¨˜äº‹ã‚’èªã¿ã¾ã—ãŸã€‚ Bugs in Heartbleed detection scripts. ã¡ã‚‡ã†ã©æ˜¨æ—¥ã€Heartbleedã®æ¤œçŸ¥ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’ã„ãã¤ã‹èªã‚“ã§ãƒ–ãƒã‚°ã¾ã§æ›¸ã„ãŸã®ã§éžå¸¸ã«èˆˆå‘³æ·±ã„å†…å®¹ã§ã—ãŸã€‚ ã“ã®è¨˜äº‹ã®å†…å®¹ã‚’ç°¡å˜ã«ç®‡æ¡æ›¸ãã—ã¾ã™ã€‚ Nessusã€Metasploitã€Nmapãªã©ã„ã‚ã„ã‚ãªã¨ã“ã‚ã‹ã‚‰Heartbleedã‚’æ¤œçŸ¥ã™ã‚‹æ‰‹æ®µ(ã‚¹ã‚¯ãƒªãƒ—ãƒˆ)ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã‚‹ãŒã€ãã®ã»ã¨ã‚“ã©ã«ãƒã‚°ãŒã‚ã‚‹ã€‚å®Ÿéš›ã¯è„†å¼±æ€§ãŒã‚ã‚‹(è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹)ã®ã«ã€ãªã„ã¨åˆ¤å®šã—ã¦ã—ã¾ã†ã€‚å®Ÿéš›ã«ã„ã‚ã„ã‚ãªã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’ä½¿ã£ã¦æ¤œè¨¼ã—ã¦ã„ãŸæ™‚ã«ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã«ã‚ˆã£ã¦åˆ¤å®šçµæžœãŒé•ã†ã“ã¨ã«æ°—ä»˜ã„ãŸã€‚ãã“ã§ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®å‡¦ç†ã‚’è¦‹ãŸã¨ã“ã‚ãƒã‚°ã‚’è¦‹ã¤ã‘ãŸã€‚Jared Staffordã•ã‚“ãŒæ›¸ã„ãŸPoCã«ã¯ã€â€œquick and dirty demonstrationâ€ ã¨æ›¸ã„ã¦ã‚ã‚‹ã€‚ã“ã®PoCãŒä»–ã®æ¤œçŸ¥
sho 2014/04/15
security

openssl

heartbleed
ãƒªãƒ³ã‚¯
OpenSSLã®â€œHeartbleedâ€è„†å¼±æ€§ã«ã‚ˆã‚‹è¢«å®³ãŒç™ºç”Ÿã€ã‚«ãƒŠãƒ€æ³å…¥åºãŒç™ºè¡¨ã€€
sho 2014/04/15
ã“ã®è¢«å®³ã€æœ¬å½“ã‹?

security

openssl

heartbleed
ãƒªãƒ³ã‚¯
Wiresharkã§SSLé€šä¿¡ã®ä¸èº«ã‚’è¦—ã„ã¦ã¿ã‚‹ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
OpenSSLã®è„†å¼±æ€§ã€ŒHeartbleedã€ãŒä¸–é–“ã‚’è³‘ã‚ã›ã¦ã„ã¾ã™ãŒã€è‰²ã€…ã¨ä¹—ã‚Šé…ã‚Œã¦ã—ã¾ã£ãŸæ„ŸãŒã‚ã‚‹ã®ã§ã€ã‚†ã‚‹ã‚†ã‚‹ã¨è½ã¡ç©‚æ‹¾ã„ã‚’ã—ã‚ˆã†ã‹ã¨æ€ã„ã¾ã™ã€‚ Heartbleedã§ç§˜å¯†éµã‚’æ‰‹ã«å…¥ã‚ŒãŸã‚‰SSLé€šä¿¡ã®ä¸èº«å…¨éƒ¨è¦‹ãˆã¡ã‚ƒã†ã˜ã‚ƒã‚“!! ã¨ã„ã†äº‹æ…‹ã«ãªã£ã¦ã„ã¾ã™ãŒã€ãªã‚“ã¨ãªãç†è«–çš„ã«ãã†ã ã‚ã†ãªã¨åˆ†ã‹ã‚‹ã‚‚ã®ã®ã‚¤ãƒžã‚¤ãƒå…·ä½“çš„ãªæ‰‹é †ãŒåˆ†ã‹ã‚‰ãªã„ã€‚ ã¨ã„ã†ã‚ã‘ã§ä»Šå›žã®ãƒ†ãƒ¼ãƒžã¨ã—ã¦ã€æ‰‹å…ƒã«ã‚µãƒ¼ãƒã®ç§˜å¯†éµã¨ã€SSLé€šä¿¡ã‚’ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã—ãŸpcapãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚ã‚‹ã¨ãã«ã€Wiresharkã§ã©ã‚“ãªæ„Ÿã˜ã§SSLé€šä¿¡ã‚’ã€Œã»ã©ãã€ã®ã‹â€¦â€¦ã¨ã„ã†å…·ä½“çš„ãªæ‰‹é †ã‚’ã€ãƒãƒžã‚Šæ‰€ã‚’å«ã‚ã¦ã¾ã¨ã‚ã¦ãŠã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ ã¨ã„ã†ã‹ã€ç§è‡ªèº«ãŒãƒãƒžã£ãŸã®ã§è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã§ã™ãªã€‚ãªãŠã“ã®æ–‡æ›¸ã§ã¯"SSL"ã¨ã ã‘è¨˜è¿°ã—ã€TLSã¯ç„¡è¦–ã—ã¦ã„ã¾ã™ã€‚ å‰ææ¡ä»¶ ã¨ã‚Šã‚ãˆãšä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã®æ¤œè¨¼ç’°å¢ƒã§è©¦ã—ã¾ã—ãŸã€‚ IPã‚¢ãƒ‰ãƒ¬ã‚¹ èª¬æ˜Ž ãƒ›ã‚¹ãƒˆO
sho 2014/04/14
openssl

ssl

wireshark

security
ãƒªãƒ³ã‚¯
Heart Bleedã‚’èªã‚“ã - The first cry of Atom
int dtls1_process_heartbeat(SSL *s) { unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned short hbtype; unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ heartbeatã¨ã„ã†æ©Ÿèƒ½ã®è©³ã—ã„ã“ã¨ã¯èª¿ã¹ã‚‰ã‚Œã¦ã„ãªã„ã‘ã‚Œã©ã©ã†ã‚„ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ¼ã‚µãƒ¼ãƒåž‹ã®æ©Ÿèƒ½ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚ ã¤ã¾ã‚Šä½•ã‚‰ã‹ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘å–ã£ã¦ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’è¿”ã™ã‚ˆã†ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚dtls1_process_heartbeatã§å¤§äº‹ãªã®ã¯ ãƒã‚¤ãƒ³ã‚¿pã ã€‚ã“ã‚Œã¯ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã‚’å—ã‘å–ã£ã¦æ ¼ç´ã—ã¦ã„ã‚‹ã€‚ã“ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã¯æ§‹é€ ä½“ã«ãªã£ã¦ã„ã¦ã€ä»¥ä¸‹ã®ã‚ˆã†ã«è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ã€‚ typedef struct
sho 2014/04/10
"Cã‚ˆã‚Šã‚‚ã‚‚ã£ã¨secureãªè¨€èªžã‚’ä½¿ãŠã†"

security

openssl

ssl
ãƒªãƒ³ã‚¯
mixi Engineersâ€™ Blog Â» OpenSSLã®æš—å·æ–‡ã‚’Java/Perl/Rubyã§é–‹ã
ç§˜å¯†éµã‚„ãƒ—ãƒ©ã‚¤ãƒ™ãƒ¼ãƒˆãªæƒ…å ±ãªã©ã‚’ç§˜åŒ¿ã™ã‚‹ãŸã‚ã«ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã§ãƒ‡ãƒ¼ã‚¿ã‚’æš—å·åŒ–ãƒ»å¾©å·ã—ãŸã„å ´åˆãŒã‚ã‚Šã¾ã™ã€‚ã“ã®ã¨ãã€æš—å·åŒ–ã¨å¾©å·ã™ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãŒåŒã˜ã§ã‚ã‚Œã°ç°¡å˜ã§ã™ãŒã€ä¾‹ãˆã°Cã§æš—å·åŒ–ã—ã¦Javaã€Perlã€Rubyã§å¾©å·ã™ã‚‹ã¨ã„ã£ãŸé¢¨ã«ç•°ãªã‚‹ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã§æš—å·ãƒ‡ãƒ¼ã‚¿ã‚’ã‚„ã‚Šã¨ã‚Šã™ã‚‹å ´åˆã«ã¯ã€ã„ãã¤ã‹æ°— ã‚’ã¤ã‘ãªã‘ã‚Œã°ã„ã‘ãªã„ãƒã‚¤ãƒ³ãƒˆãŒã‚ã‚Šã¾ã™ã€‚ OpenSSLã«ã‚ˆã‚‹æš—å·åŒ– OpenSSLã¯Webã‚µãƒ¼ãƒã®SSL/TLSã‚µãƒãƒ¼ãƒˆã«åˆ©ç”¨ã•ã‚Œã¾ã™ãŒã€ãã®ä»–ã«ã‚‚ä»˜å±žã—ã¦ã„ã‚‹opensslã‚³ãƒžãƒ³ãƒ‰ã‹ã‚‰åŸºæœ¬çš„ãªæš—å·ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã‚’åˆ©ç”¨ã§ãã¾ã™ã€‚æ¬¡ã®ã‚ˆã†ãªç°¡å˜ãªã‚³ãƒžãƒ³ãƒ‰ã§ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦ãƒ‡ãƒ¼ã‚¿ã‚’æš—å·åŒ–ã—ãŸã‚Šå¾©å·ã—ãŸã‚Šã™ã‚‹ã“ã¨ãŒã§ãã¾ã™: $ echo 'Hello World!' | openssl enc -e -aes-128-cbc > cipher.txt enter aes-128-cbc
sho 2007/09/13
openssl

ruby

security

crypt
ãƒªãƒ³ã‚¯
1