[B! OpenSSL] drumscoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

drumsco id:drumsco

OpenSSLã«é–¢ã™ã‚‹drumscoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

OpenSSL 3.0.7 ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆæƒ…å ± | äºŒæœ¬æ¾ å“²ä¹Ÿ
2014å¹´ã®â€Heartbleedâ€œä»¥æ¥ã®Criticalãª CVE ã¨è¨€ã‚ã‚Œã¦ãŠã‚Šã€ OpenSSL 3.0.7 ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã¯2022å¹´11æœˆ2æ—¥ 0:42ï¼ˆæ°´ï¼‰ã«å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ãªãŠé‡è¦åº¦ã¯Criticalã‹ã‚‰Highã¸æ ¼ä¸‹ã’ã•ã‚Œã€ OpenSSL 3.0 ã‚ˆã‚Šå‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«ã¯å½±éŸ¿ã—ã¾ã›ã‚“ã€‚ å…·ä½“çš„ã«ã¯ã€Wiz Labsã®ã€Œã©ã‚Œã ã‘ã®çµ„ç¹”ãŒå±é™ºã«ã•ã‚‰ã•ã‚Œã¦ã„ã‚‹ã®ã‹ï¼Ÿã€ã«ã‚ˆã‚Œã°OpenSSLã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã®1.5%ã®ã¿ãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚ã‚Šã€98.5%ã¯å½±éŸ¿ã‚’å—ã‘ãªã„å¤ã„ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®æ¨¡æ§˜ã§ã™ã€‚ The upcoming critical OpenSSL vulnerability: Everything you need to know | WIZ Labs OpenSSL ãƒªãƒªãƒ¼ã‚¹æ¡ˆå†… https://www.openssl.org/news/cl30.txt ### 3.0
drumsco 2022/10/31
security

OpenSSL

OSS
ãƒªãƒ³ã‚¯
Let's Encryptã®ãƒ«ãƒ¼ãƒˆCAæœŸé™åˆ‡ã‚Œã§ OpenSSL 1.0.2ãŒæ€ã‚ã¬äº‹æ•…ã‚’èµ·ã“ã™ä»¶
ã“ã‚Œã¯ã€Let's Encryptã‚’æ”¯ãˆã‚‹ã“ã®äºŒäººã®ãƒ«ãƒ¼ãƒˆCAã¨ OpenSSLã®ç‰©èªžã§ã‚ã‚‹ã€‚ DST Root CA X3 (2000-2021) ISRG Root X1 (2015-2035) ã€œ2021å¹´1æœˆã€œ ISRG Root X1ã€Œã„ã¾ã¾ã§ä¸€ç·’ã«ã‚„ã£ã¦ããŸDST Root CA X3ã•ã‚“ã®å¯¿å‘½ãŒé–“è¿‘ãƒ»ãƒ»ãƒ»ã“ã®ã¾ã¾ã ã¨åƒ•ã‚’ä¿¡é ¼ã—ã¦ãã‚Œã¦ã„ãªã„ãƒ™ãƒ†ãƒ©ãƒ³ã®ï¼ˆå…·ä½“çš„ã«ã„ã†ã¨2016å¹´ãã‚‰ã„ã¾ã§ã®ï¼‰å¤ã„ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŸã¡ã¯ Let's Encryptã•ã‚“ã‚’ä¿¡ç”¨ã—ã¦ãã‚Œãªããªã£ã¡ã‚ƒã†ãƒ»ãƒ»ãƒ»ã©ã†ã—ã‚ˆã†ã€ DST Root CA X3ã€Œã©ã‚Œã€ã‚ã—ãŒæ»ã¬å‰ã«(æœ‰åŠ¹æœŸé™ãŒåˆ‡ã‚Œã‚‹å‰ã«)ãŠå‰ãŒä¿¡é ¼ã«å€¤ã™ã‚‹æ—¨ã‚’ä¸€ç†æ›¸ã„ã¦æ®‹ã›ã°ã„ã„ã˜ã‚ƒã‚ã†ã€‚ã‚µãƒ©ã‚µãƒ©ã€ Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3 Validity Not Bef
drumsco 2021/10/02
TLS

OpenSSL

Let'sEncrypt
ãƒªãƒ³ã‚¯
Blogger
Google ã®ã‚¦ã‚§ãƒ–ãƒã‚°å…¬é–‹ãƒ„ãƒ¼ãƒ«ã‚’ä½¿ã£ã¦ã€ãƒ†ã‚ã‚¹ãƒˆã€å†™çœŸã€å‹•ç”»ã‚’å…±æœ‰ã§ãã¾ã™ã€‚
drumsco 2016/09/30
security

OpenSSL

SSL

Apache
ãƒªãƒ³ã‚¯
Redirecting to ssl-config.mozilla.org...
Mozilla SSL Configuration Generator Redirecting to the updated SSL Configuration Generatorâ€¦
drumsco 2016/09/30
Apache

OpenSSL

SSL

security

generator

TLS
ãƒªãƒ³ã‚¯
A better SSL configuration for Apache 2
RC4 with TLS has been broken for quite some time now, but I did not yet manage to make the switch. Having a little time on my hands, I decided to future-proof my Apache configuration. Basically, what I want to do is: Disable ciphers for SSL that have known weaknesses. RC4, I am looking at you. DES, yes, you are meant as well. This includes ciphers that are marked EXPORT. Use TLS 1.2 instead of the
drumsco 2016/09/09
security

Apache

https

OpenSSL

RC4

DES

encryption
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§CVE-2016-800(DROWN)ã‚„CVE-2016-0702(CacheBleed)ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2016å¹´3æœˆ1æ—¥(ç¾åœ°æ™‚é–“)ã€OpenSSL ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯è„†å¼±æ€§ã®æ„›ç§°ã€ŒDROWNã€ã‚„ã€ŒCacheBleedã€ã‚’å«ã‚€8ä»¶ã®è„†å¼±æ€§æƒ…å ±ã‚’å…¬é–‹ã—ã€ã“ã‚Œã‚‰å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚‚ã®ã®ä¿®æ£ã‚’è¡Œã£ãŸæœ€æ–°ç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§æƒ…å ±æ¦‚è¦ æ³¨æ„å–šèµ· OpenSSL ã®è¤‡æ•°ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ· - JPCERT/CC SSLv2 DROWN Attack - US-CERT OpenSSL Projectã®å…¬é–‹æƒ…å ± Forthcoming OpenSSL releases OpenSSL Security Advisory ï¼»1st March 2016ï¼½ OpenSSL version 1.0.1s published OpenSSL version 1.0.2g published An OpenSSL Userâ€™s Guide to DROWN 2016å¹´3æœˆ1æ—¥å…¬
drumsco 2016/03/02
security

OpenSSL

vulnerability
ãƒªãƒ³ã‚¯
SSLã®è„†å¼±æ€§ã§æ—¥æœ¬ã®å¤§æ‰‹ã‚µã‚¤ãƒˆã‚’å«ã‚€å…¨ä¸–ç•Œ1100ä¸‡ä»¥ä¸Šã®HTTPSã‚µã‚¤ãƒˆãŒæ”»æ’ƒã‚’å—ã‘å¾—ã‚‹ã¨åˆ¤æ˜Ž
SSL/TLSã«ã‚ˆã£ã¦é€šä¿¡ã‚’æš—å·åŒ–ã—ã¦ã„ã‚‹HTTPSã‚µã‚¤ãƒˆã«ç°¡å˜ã«æ”»æ’ƒã•ã‚Œã‚‹è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã«ã‚ˆã£ã¦ç™ºè¡¨ã•ã‚Œã¾ã—ãŸã€‚ã“ã®è„†å¼±æ€§ã‚’ã¤ã„ãŸæ”»æ’ƒã€ŒDROWNã€ã‚’å—ã‘ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã‚µã‚¤ãƒˆã«ã¯ã€æ¯Žæ—¥æ–°èžã€ä»»å¤©å ‚ã€ã¯ã¦ãªã€LINEãªã©ã®æ—¥æœ¬ã®å¤§æ‰‹ã‚µã‚¤ãƒˆã‚‚å«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ DROWN: Breaking TLS using SSLv2.pdf (PDFãƒ•ã‚¡ã‚¤ãƒ«)https://drownattack.com/drown-attack-paper.pdf DROWN Attack https://drownattack.com/ ã€ŒDecrypting RSA with Obsolete and Weakened eNcryption(DROWN)ã€ã¯SSLv2ã«å«ã¾ã‚Œã‚‹è„†å¼±æ€§ã§ã€ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚Œã‚‹ã¨ã‚¯ãƒã‚¹ãƒ—ãƒãƒˆã‚³ãƒ«æ”»æ’ƒã«ã‚ˆã£ã¦TLSã‚»ãƒƒã‚·ãƒ§ãƒ³ã®æš—å·åŒ–ãŒè§£é™¤(å¾©å·)ã•ã‚Œã¦é€šä¿¡ãŒå‚å—
drumsco 2016/03/02
security

OpenSSL
ãƒªãƒ³ã‚¯
æ¥•å††æ›²ç·šæš—å·ã« 512 bit ã¯å˜åœ¨ã—ãªã„ | ã¯ã£ãŸã‚Šã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®å‚™å¿˜éŒ²
æ–°ã—ã„ SSH éµã‚’ä½œã‚‹ãŸã‚ã« ssh-keygen ã®ãƒžãƒ‹ãƒ¥ã‚¢ãƒ«ã‚’èªã‚“ã§ã„ãŸã‚‰ã€ãŠã‚‚ã—ã‚ã„è¨˜è¿°ã‚’è¦‹ã¤ã‘ã¾ã—ãŸã€‚éµã®ãƒ“ãƒƒãƒˆé•·ã‚’æŒ‡å®šã™ã‚‹ b ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã®èª¬æ˜Žã§ã™ã€‚ For ECDSA keys, the -b flag determines they key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits. ã€ŒECDSA ã‚ãƒ¼ã®å ´åˆã€b ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã¯ 3 ã¤ã®æ¥•å††æ›²ç·šã‚µã‚¤ã‚ºã®ã„ãšã‚Œã‹ã‚’é¸æŠžã™ã‚‹ã“ã¨ã§ã‚ãƒ¼ã®é•·ã•ã‚’æ±ºå®šã™ã‚‹ã€ã€‚ã“ã“ã¾ã§ã¯ç†è§£ã§ãã‚‹ã®ã§ã™ãŒã€ç¤ºã•ã‚ŒãŸ 3 ã¤ç›®ã®ãƒ“ãƒƒãƒˆé•·ãŒ 521 bit ãªã‚“ã§ã™ã€‚ ã€Œãˆã£ã€2^9 ã® 512 bit ã˜ã‚ƒãªãã¦ 521 bit ãªã®ï¼Ÿã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãªã‚‰é•å’Œæ„Ÿã‚’æ„Ÿã˜ã¦ã€ã¾ãšã‚¿ã‚¤ãƒã‚’ç–‘ã„ã¾ã™ã‚ˆãã€‚è‡ªåˆ†ã‚‚ã‚¿ã‚¤ãƒã ã¨æ€ã£ã¦ Fedora ã§è©¦
drumsco 2015/10/02
security

OpenSSL

ssh

encryption

ecdsa
ãƒªãƒ³ã‚¯
GitHubãƒ¦ãƒ¼ã‚¶ãƒ¼ã®SSHéµ6ä¸‡å€‹ã‚’èª¿ã¹ã¦ã¿ãŸ - hnwã®æ—¥è¨˜
ï¼ˆ2015/1/30 è¿½è¨˜ï¼‰æ™‚æœŸã¯ä¸æ˜Žã§ã™ãŒã€ç¾æ™‚ç‚¹ã®github.comã¯Ed25519éµã«ã‚‚å¯¾å¿œã—ã¦ã„ã¾ã™ã€‚ ï¼ˆ2016/5/31 è¿½è¨˜ï¼‰ã€ŒGitHubã«ãƒã‚°å ±å‘Šã—ã¦è³žé‡‘$500ã‚’é ‚ã„ãŸè©±ã€ã§ç´¹ä»‹ã—ãŸé€šã‚Šã€æ—¢ã«å¼±ã„éµã¯GitHubã‹ã‚‰å‰Šé™¤ã•ã‚Œã€æ–°è¦ç™»éŒ²ã‚‚ã§ããªããªã£ã¦ã„ã¾ã™ã€‚ GitHub APIã‚’åˆ©ç”¨ã—ã¦ã€GitHubã®31661ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã«ç™»éŒ²ã•ã‚Œã¦ã„ã‚‹SSHå…¬é–‹éµ64404å€‹ã‚’å–å¾—ã—ã¦ã¿ã¾ã—ãŸã€‚æŠ½å‡ºæ–¹æ³•*1ãŒé©å½“ã™ãŽã¦åã‚ŠãŒã‚ã‚‹ã‚ˆã†ãªæ°—ã‚‚ã—ã¾ã™ãŒã€é¢ç™½ã„çµæžœãŒå¾—ã‚‰ã‚ŒãŸã¨æ€ã†ã®ã§ã¾ã¨ã‚ã¦ã¿ã¾ã™ã€‚ SSHéµã®ç¨®é¡ž éµã®ç¨®é¡ž å€‹æ•° å‰²åˆ RSAéµ 61749 (95.88%) DSAéµ 2647 (4.11%) ECDSAéµ 8 (0.01%) ç´„6ä¸‡å€‹ã®éµã®ã†ã¡ã€8å€‹ã ã‘ECDSAï¼ˆæ¥•å††DSAï¼‰éµãŒè¦‹ã¤ã‹ã‚Šã¾ã—ãŸï¼å¸¸ç”¨ã—ã¦ã„ã‚‹ã®ã‹è©¦ã—ã«ç™»éŒ²ã—ã¦ã¿ãŸã ã‘ãªã®ã‹ã¯ã‚ã‹ã‚Šã¾ã›ã‚“ãŒã€ä½•ã«ã›ã‚ˆ
drumsco 2015/10/02
security

GitHub

ssh

OpenSSL

encryption
ãƒªãƒ³ã‚¯
OpenSSLã®é‡å¤§ãƒã‚°(CVE-2014-0160)ã¸ã®å¯¾å¿œ
ã“ã‚“ã«ã¡ã¯ã€‚å°å®®ã§ã™ã€‚ OpenSSLã®é‡å¤§ãƒã‚°ãŒç™ºè¦‹ã•ã‚ŒãŸã¨ã„ã†è¨˜äº‹ã‚’ã†ã‘ã¾ã—ã¦ã€ ã•ã™ãŒã«å½±éŸ¿ãŒå¤§ãã„ã‚ˆã†ãªã®ã§é–¢é€£æƒ…å ±ã‚’è¨˜éŒ²ã—ã¦ãŠãã¾ã™ã€‚ OpenSSLã®é‡å¤§ãƒã‚°ãŒç™ºè¦šã€‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®å¤§éƒ¨åˆ†ã«å½±éŸ¿ã®å¯èƒ½æ€§ | TechCrunch Japan JVNVU#94401838: OpenSSL ã® heartbeat æ‹¡å¼µã«æƒ…å ±æ¼ãˆã„ã®è„†å¼±æ€§ å½±éŸ¿ç¯„å›²ã¯openssl-1.0.1~1.0.1fã¨ã„ã†ã“ã¨ã§ã€ã¾ã˜ã‚ã«æœ€æ–°ã«ã—ã¦ã‚‹ã‚µã‚¤ãƒˆãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ã¨ã„ã†çš®è‚‰ãªã“ã¨ã«ã€‚ ã§ã‚‚ã¾ã‚å½±éŸ¿ç¯„å›²ãŒé™å®šçš„ãªã®ã¯è‰¯ã‹ã£ãŸã¨æ€ã„ã¾ã™ã€‚ å¼Šç¤¾ã§ã¯CentOS6.5ã¨Amazon Linuxã®ç’°å¢ƒãŒå½±éŸ¿ã‚’å—ã‘ã¾ã—ãŸã€‚ ã¾ãšä»¥ä¸‹ã‚’ã”è¦§ãã ã•ã„ã€‚ å¯¾ç–æ–¹æ³•ã‚’è¨˜ã—ã¦ã„ã‚‹ã‚µã‚¤ãƒˆï¼š AWS â€“ EC2ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã®OpenSSLã®Hartbleed Bugå¯¾å¿œ â€“ Qiita opensslã®TLS heartbea
drumsco 2014/04/14
security

OpenSSL
ãƒªãƒ³ã‚¯
Test your server for Heartbleed (CVE-2014-0160)
If there are probl ems, head to the FAQ Results are now cached globally for up to 6 hours. Enter a URL or a hostname to test the server for CVE-2014-0160. This test has been discontinued in March 2019. You can use the open-source command line tool or the SSL Labs online test. All good, seems fixed or unaffected! Uh-oh, something went wrong: Check what it means at the FAQ. It might mean that the ser
drumsco 2014/04/14
security

OpenSSL

Testing
ãƒªãƒ³ã‚¯
1