[B! OpenSSL] wata88ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

wata88 id:wata88

OpenSSLã«é–¢ã™ã‚‹wata88ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

è„†å¼±æ€§å¯¾å¿œï¼ˆHeartbleedï¼‰ã®è²¬ä»»ã®æ‰€åœ¨ã€€æ±äº¬åœ°åˆ¤ä»¤å…ƒ.12.20ï¼ˆå¹³29ãƒ¯6203ï¼‰ - ITãƒ»ã‚·ã‚¹ãƒ†ãƒ åˆ¤ä¾‹ãƒ¡ãƒ¢
ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±æ¼ãˆã„äº‹æ•…ã«é–¢ã—ï¼Œãã®åŽŸå› ã®ä¸€ã¤ã¨è€ƒãˆã‚‰ã‚Œã‚‹è„†å¼±æ€§å¯¾å¿œãŒé‹ç”¨ä¿å®ˆæ¥å‹™ã«å«ã¾ã‚Œã¦ã„ãŸã‹å¦ã‹ãŒäº‰ã‚ã‚ŒãŸäº‹ä¾‹ã€‚ äº‹æ¡ˆã®æ¦‚è¦ Xã¯ï¼ŒXã®é‹å–¶ã™ã‚‹é€šè²©ã‚µã‚¤ãƒˆï¼ˆæœ¬ä»¶ã‚µã‚¤ãƒˆï¼‰ã‚’ç¬¬ä¸‰è€…ã«é–‹ç™ºå§”è¨—ã—ï¼Œé‹ç”¨ã—ã¦ã„ãŸãŒï¼Œãã®å¾Œï¼Œ2013å¹´1æœˆã“ã‚ã¾ã§ã«ï¼ŒYã«å¯¾ã—ï¼Œæœ¬ä»¶ã‚µã‚¤ãƒˆã®é‹ç”¨æ¥å‹™ã‚’æœˆé¡20ä¸‡å††ã§å§”è¨—ã—ãŸï¼ˆæœ¬ä»¶å¥‘ç´„ï¼‰ã€‚æœ¬ä»¶ã‚µã‚¤ãƒˆã¯EC-CUBEã§ä½œã‚‰ã‚Œã¦ã„ãŸã€‚ãªãŠï¼ŒXã‹ã‚‰Yã¸ã®æ¥å‹™å§”è¨—ã«é–¢ã—ï¼Œå¥‘ç´„æ›¸ã¯ä½œæˆã•ã‚Œã¦ãŠã‚‰ãšï¼Œæ³¨æ–‡æ›¸ã«ã¯ã€Œæœ¬ä»¶ã‚µã‚¤ãƒˆã®é‹ç”¨ï¼Œä¿å®ˆç®¡ç†ã€ã€Œï¼¥ï¼£ï¼ï¼£ï¼µï¼¢ï¼¥ã‚«ã‚¹ã‚¿ãƒžã‚¤ã‚ºã€ã¨ã—ã‹è¨˜è¼‰ã•ã‚Œã¦ã„ãªã„ã€‚ 2014å¹´4æœˆã«ã¯ï¼ŒOpenSSL*1ã®è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ãŒå…¬è¡¨ã•ã‚ŒãŸãŒ*2ï¼Œæœ¬ä»¶ã‚µã‚¤ãƒˆã§ã¯ï¼ŒOpenSSLãŒç”¨ã„ã‚‰ã‚Œã¦ã„ãŸã€‚ 2015å¹´5æœˆã“ã‚ï¼ŒXã¯ï¼Œæ±ºæ¸ˆä»£è¡Œä¼šç¤¾ã‹ã‚‰æœ¬ä»¶ã‚µã‚¤ãƒˆã‹ã‚‰Xã®é¡§å®¢æƒ…å ±ï¼ˆã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’å«ã‚€ï¼‰ãŒæ¼ãˆã„ã—ã¦ã„ã‚‹æ‡¸å¿µãŒã‚ã‚‹ã¨ã®é€£çµ¡ã‚’å—ã‘ï¼ˆæœ¬ä»¶æƒ…å ±æ¼ãˆã„ï¼‰
wata88 2021/03/03
OpenSSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
QUICã‚€ã‘ã«AES-GCMå®Ÿè£…ã‚’æœ€é©åŒ–ã—ãŸè©± (1/2)
4æœˆæœ«ã«ã€ä¼šç¤¾ã®ã»ã†ã§ã€ŒCan QUIC match TCPâ€™s computational efficiency?ã€ã¨ã„ã†ãƒ–ãƒã‚°ã‚¨ãƒ³ãƒˆãƒªã‚’æ›¸ãã¾ã—ãŸã€‚æˆ‘ã€…ãŒé–‹ç™ºä¸ã®QUICå®Ÿè£…ã§ã‚ã‚‹quiclyã®ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°ã‚’é€šã—ã¦ã€QUICã®CPUè² è·ã¯TLS over TCPä¸¦ã«ä½Žæ¸›å¯èƒ½ã§ã‚ã‚ã†ã¨æŽ¨è«–ã—ãŸè¨˜äº‹ã§ã™ã€‚ã“ã®è¨˜äº‹ã‚’æ›¸ãéš›ã«ã¯ã€Stay Homeã¨ã„ã†çŠ¶æ³ã®ä¸ã§ã€æ‰‹å…ƒã«ã‚ã£ãŸå®‰ã„ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ã‚’ä½¿ã£ãŸã®ã§ã™ãŒã€ãã®å¾Œã€10gbe NICã‚’å…¥æ‰‹ã—ã€ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ã«ã‚ˆã‚‹UDP GSOã‚ªãƒ•ãƒãƒ¼ãƒ‰ç’°å¢ƒã§ã®ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ã‚’ç¢ºèªã—ã¦ã„ãã¨ã€OpenSSLã®AES-GCMå®Ÿè£…ãŒãƒœãƒˆãƒ«ãƒãƒƒã‚¯ã«ãªã‚‹ã“ã¨ãŒã‚ã‹ã£ã¦ãã¾ã—ãŸã€‚ TCPä¸Šã§é€šä¿¡ã™ã‚‹TLSã§ã¯ã€ä¸€èˆ¬ã«ã€ãƒ‡ãƒ¼ã‚¿ã‚’16KBå˜ä½ã§AEADãƒ–ãƒãƒƒã‚¯ã«åˆ†å‰²ã—ã¦ã€AES-GCMã‚’ç”¨ã„ã¦AEADæš—å·åŒ–ã—ã¾ã™æ³¨ã€‚ä¸€æ–¹ã€UDPã‚’ç”¨ã„ã‚‹QUICã§ã¯ã€ãƒ‘ã‚±ãƒƒãƒˆæ¯Žã«AES-GC
wata88 2020/06/15
æ°—ã«ãªã‚‹

OpenSSL
ãƒªãƒ³ã‚¯
OS X 10.10.3ã§Rubyã‹ã‚‰ä¸€éƒ¨ã‚µã‚¤ãƒˆã¸ã®HTTPSæŽ¥ç¶šæ™‚ãŒã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ - Qiita
/Users/hideki/.rbenv/versions/2.2.1/lib/ruby/2.2.0/net/http.rb:923:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError) å‰ææ¡ä»¶ OS X 10.10.3 Homebrewã‹ã‚‰OpenSSLã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« (10.10.3ã«ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã—ã¦ã‹ã‚‰ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚ŒãŸã‚‚ã®) rbenvãªã©ã‹ã‚‰Homebrewã®OpenSSLã‚’ãƒªãƒ³ã‚¯ã—ã¦Rubyã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ« åŽŸå› Homebrewã‹ã‚‰OpenSSLã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ã¨ã€Keychainã‹ã‚‰/usr/local/etc/openssl/cert.pemã‚’ç”Ÿæˆã™ã‚‹ã‚ˆã†ã«
wata88 2016/09/06
Homebrew

OpenSSL

OS X
ãƒªãƒ³ã‚¯
openssl-1.0.2ã«ã‚ˆã‚‹æ€§èƒ½å‘ä¸Š
åˆç¨¿ã§ã¯AVX2ã«ã‚ˆã‚‹åŠ¹æžœã§ã¯ãªã„ã‹ã¨è¨˜è¿°ã‚’ã—ã¦ãŠã‚Šã¾ã—ãŸãŒã€stitchedã§ã¯ãªãã€multi bufferã®ã‚µãƒãƒ¼ãƒˆã‚„ãã®ä»–è¦å› ãŒæ··åˆã—ã¦ãŠã‚Šæ•°å€¤æ¤œè¨¼ãŒå®Œå…¨ã§ã¯ãªã„ã¨ã„ã†æŒ‡æ‘˜ã‚’ã„ãŸã ãã¾ã—ãŸã€‚ è¨˜äº‹å†…å®¹ã®è¨‚æ£ã‚’è¡Œã„ã¾ã™ã€‚æ¤œè¨¼ãŒä¸ååˆ†ãªã¾ã¾ã®æŽ²è¼‰ã¨ãªã‚Šç”³ã—è¨³ã”ã–ã„ã¾ã›ã‚“ã€‚ã¾ãŸã€æ•°å€¤ã‚„æŠ€è¡“çš„ãªè£ä»˜ã‘ã¯ä»Šå¾Œå†æ¤œè¨¼ã‚’é€²ã‚ã¦ã„ã“ã†ã¨ãŠã‚‚ã„ã¾ã™ã€‚ ã‚µã‚¤ãƒˆã‚ªãƒšãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³æœ¬éƒ¨ï¼ˆï¼Š1ï¼‰ã‚’å…¼å‹™ã•ã›ã¦ã„ãŸã ã„ã¦ã„ã‚‹åŒ¿åå¸Œæœ›ã®ç¤¾å“¡Mã§ã™ã€‚ ç§ã¯ãƒãƒ¼ãƒ‰ã‚¦ã‚¨ã‚¢ã¨ã‚½ãƒ•ãƒˆã‚¦ã‚¨ã‚¢ã®ä¸¡é¢ã‹ã‚‰æŒ‡æ•°é–¢æ•°çš„ã«å¢—ãˆã‚‹ãƒ‡ãƒ¼ã‚¿å‡¦ç†ã«ã‚³ãƒ„ã‚³ãƒ„å¯¾å¿œã™ã‚‹ä»•äº‹ã‚’ã‚„ã£ã¦ãŠã‚Šã¾ã™ã€‚ ä»Šå›žã®å–ã‚Šçµ„ã¿ã¯ä»¥ä¸‹ã®æŠ•ç¨¿ã«å½±éŸ¿ã‚’å—ã‘ãŸå–ã‚Šçµ„ã¿ã§ã™ã€‚ Accelerating SSL Load Balancers with IntelÂ® XeonÂ® v3 Processors https://software.intel.com/en-us/article
wata88 2016/04/19
intel

OpenSSL
ãƒªãƒ³ã‚¯
ãã“ãã“æ¥½ã«ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹
ãƒšãƒ‘ãƒœç¤¾å†…ã§ã¡ã‚‰ã£ã¨æ›¸ã„ãŸå†…å®¹ãªã‚“ã§ã™ãŒã€ãã“ãã“ä¾¿åˆ©ã ã¨æ€ã†ã®ã§ãƒ–ãƒã‚°ã«ã‚‚æŠ•ä¸‹ã€‚ ãã“ãã“çŸã„å·¥æ•°ã§ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã™ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã§ã™ã€‚ COMMON_NAME=domain.iretene.com openssl req -new -newkey rsa:2048 -nodes -out $COMMON_NAME.csr -keyout $COMMON_NAME.key -subj "/C=/ST=/L=/O=/OU=/CN=$COMMON_NAME" openssl x509 -days 12000 -req -signkey $COMMON_NAME.key -in $COMMON_NAME.csr -out $COMMON_NAME.crt COMMON_NAME=ã«ãŠå¥½ããªãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’å…¥ã‚Œã¦ã„ãŸã ã‘ã‚Œã°ã€ç§˜å¯†éµã€csrã€crtãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã¾ã‚‹ã¾ã‚‹ã£ã¨åãå‡ºã™ã¾ã™ã€‚ man req
wata88 2015/11/11
OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§CCS Injection(CVE-2014-0224)ã®æ”»æ’ƒãŒè¡Œã‚ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’ãƒžãƒˆãƒªãƒƒã‚¯ã‚¹åŒ–ã—ã¦ã¿ãŸã€‚ - piyolog
lepidumç¤¾ã®èŠæ± æ°ãŒOpenSSLã®å®Ÿè£…ã«è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ã‚’ç™ºè¦‹ã—ã¾ã—ãŸã€‚ã“ã®è„†å¼±æ€§ã¯ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«æ¬ é™¥ãŒã‚ã‚‹ã‚‚ã®ã§ã€æ‚ªç”¨ã•ã‚ŒãŸå ´åˆã«æš—å·é€šä¿¡ã®æƒ…å ±ãŒæ¼ãˆã„ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã¨åŒç¤¾å…¬é–‹æƒ…å ±ã§ã¯èª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™ã€‚ å°šã€6æœˆ6æ—¥ã«ãƒ¬ãƒ”ãƒ€ãƒ ç¤¾ãŒã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®å½è£…ã‚’è¡Œã†æ”»æ’ƒãŒè¡Œã‚ã‚Œã‚‹æã‚Œã«ã¤ã„ã¦å±é™ºãŒãªã„ã“ã¨ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦è¨‚æ£ã‚’è¡Œã„ã¾ã—ãŸã€‚ãã‚Œã«ä¼´ã„ä»¥ä¸‹ã®å†…å®¹ã‚‚ä¿®æ£ã‚’åŠ ãˆã¦ã„ã¾ã™ã€‚(ä¿®æ£å‰ã®è¨˜äº‹ã¯éšæ‹“ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚) lepidumç¤¾ å…¬é–‹æƒ…å ± å½“ç¤¾ã§ç™ºè¦‹ã—å ±å‘Šã‚’ã—ãŸOpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0224 ï¼‰ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚æ—©æ€¥ãªæ›´æ–°ãŒæœ›ã¾ã‚Œã‚‹å†…å®¹ã ã¨è€ƒãˆã¦ã„ã¾ã™ã€‚ #ccsinjection #OpenSSL æ¦‚è¦ã¯ã“ã¡ã‚‰ã®ãƒšãƒ¼ã‚¸ã‚’ã”å‚ç…§ä¸‹ã•ã„ã€‚http://t.co/bhY7GpLZ2jâ€” lepidum (@lepidum) 2
wata88 2014/06/07
å¯¾å¿œã™ã‚‹æš‡ãŒç„¡ã„

OpenSSL

security
ãƒªãƒ³ã‚¯
bitbucketã®ä½¿ã„æ–¹
Elevate your software delivery from planning to production and beyond, with built-in AI, CI/CD, and a best-in-class Jira integration.
wata88 2013/08/02
Python
ãƒªãƒ³ã‚¯
1