[B! SHA-1] TsuSUZUKIã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

TsuSUZUKI id:TsuSUZUKI

SHA-1ã«é–¢ã™ã‚‹TsuSUZUKIã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (19)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Firefoxã¨Thunderbirdã®ã€Œãƒžã‚¹ã‚¿ãƒ¼ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã€ã¯1åˆ†ã§ç ´ã‚‹ã“ã¨ãŒå¯èƒ½ã¨æŒ‡æ‘˜ã•ã‚Œã‚‹
Mozillaã®ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶Firefoxã¨ãƒ¡ãƒ¼ãƒ«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆThunderbirdã«ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’å‘ä¸Šã™ã‚‹ã¨ã„ã†ç›®çš„ã§ã€ã€Œãƒžã‚¹ã‚¿ãƒ¼ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã€ã¨ã„ã†æ©Ÿèƒ½ãŒã‚ã‚Šã¾ã™ã€‚ã“ã®æ©Ÿèƒ½ã¯ã€ã‚ã‚‰ã‹ã˜ã‚ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæ¯Žã«è¨å®šã—ã¦ãŠã„ãŸå€‹åˆ¥ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã€Œãƒžã‚¹ã‚¿ãƒ¼ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã€ã‚’å…¥åŠ›ã—ãªã„ã¨ã€ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®å‹•ä½œã‚’åˆ¶é™ã™ã‚‹ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚ã—ã‹ã—ã€ã“ã®ãƒžã‚¹ã‚¿ãƒ¼ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ã‚ˆã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å‘ä¸Šã«ç–‘å•ã‚’æŒã£ã¦ã„ã‚‹å°‚é–€å®¶ãŒã„ã‚‹ã¨BleepingComputer.comãŒä¼ãˆã¦ã„ã¾ã™ã€‚ Wladimir Palant's notes: Master password in Firefox or Thunderbird? Do not bother! https://palant.de/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-b
TsuSUZUKI 2018/03/21
cf. http://blog.f-secure.jp/archives/50564743.html

Firefox

Mozilla

SHA-1

SHA-2

PBKDF2

Bcrypt

HMAC
ãƒªãƒ³ã‚¯
CRYPTREC SHA-1ã®å®‰å…¨æ€§ä½Žä¸‹ã«ã¤ã„ã¦
ãƒˆãƒ”ãƒƒã‚¯ã‚¹ SHA-1ã®å®‰å…¨æ€§ä½Žä¸‹ã«ã¤ã„ã¦ å¹³æˆ29å¹´3æœˆ1æ—¥ CRYPTRECæš—å·æŠ€è¡“è©•ä¾¡å§”å“¡ä¼š 2017å¹´2æœˆ23æ—¥ã«ã€CWI Amsterdamã¨Google Researchã®å…±åŒç ”ç©¶ãƒãƒ¼ãƒ ãŒã€ãƒãƒƒã‚·ãƒ¥é–¢æ•°SHA-1ã®è¡çªç™ºè¦‹ã«åˆã‚ã¦æˆåŠŸã—ãŸã¨ç™ºè¡¨ã—ã¾ã—ãŸ[1]ã€‚ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã¨ã¯ã€å…¥åŠ›ãƒ‡ãƒ¼ã‚¿ã«å¯¾ã—ã¦å›ºå®šé•·ã®ãƒãƒƒã‚·ãƒ¥å€¤ã‚’å‡ºåŠ›ã™ã‚‹ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã§ã€é›»åç½²åç‰å¤šãã®ç”¨é€”ã§åˆ©ç”¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®è¡çªã‚’ç™ºè¦‹ã™ã‚‹ã¨ã„ã†ã“ã¨ã¯ã€åŒã˜ãƒãƒƒã‚·ãƒ¥å€¤ã‚’å‡ºåŠ›ã™ã‚‹è¤‡æ•°ã®ç•°ãªã‚‹å…¥åŠ›ãƒ‡ãƒ¼ã‚¿ã‚’è¦‹ã¤ã‘ã‚‹ã¨ã„ã†ã“ã¨ã§ã€å®‰å…¨ãªãƒãƒƒã‚·ãƒ¥é–¢æ•°ã«å¯¾ã—ã¦ã¯ç¾å®Ÿçš„ãªè¨ˆç®—é‡ã§ã¯è¡çªãŒè¦‹ã¤ã‘ã‚‰ã‚Œãªã„ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ä»Šå›žã®ç™ºè¡¨ã§ã¯ã€å…¨æ•°æŽ¢ç´¢ã®è¨ˆç®—é‡(280)ã‚ˆã‚Šã‚‚10ä¸‡å€é€Ÿã„263.1å›žã®SHA-1ã®è¨ˆç®—é‡ã§è¡çªã‚’ç™ºè¦‹ã—ãŸã¨å ±å‘Šã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã‚Œã¯CPU 6500å¹´åˆ†ã¨GPU 100å¹´åˆ†ã‚’åˆã‚ã›ãŸè¨ˆç®—é‡ã«ç›¸å½“ã™ã‚‹ã¨ã®ã“ã¨ã§
TsuSUZUKI 2017/03/12
cf. http://www.jnsa.org/notice/2017/170302.html , https://www.antiphishing.jp/news/info/sha1shatterd20170307.html , https://www.antiphishing.jp/news/info/sha1shatterd20170307.html

SHAttered

SHA-1

å±æ®†åŒ–

Google

hashtabshlex

HashTab

Fasthash

SHA-2
ãƒªãƒ³ã‚¯
GoogleãŒãƒãƒƒã‚·ãƒ¥é–¢æ•°ã€ŒSHA-1ã€ã‚’ç ´ã‚‹ã“ã¨ã«æˆåŠŸã€90æ—¥å¾Œã«æ‰‹æ³•ã‚’å…¬é–‹äºˆå®š
TLS/SSLã‚„OpenPGPãªã©ã§ä½¿ã‚ã‚Œã‚‹æš—å·çš„ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã€ŒSHA-1ã€ã‚’ç ´ã‚‹ã“ã¨ã«ã€Googleã¨ã‚ªãƒ©ãƒ³ãƒ€ã®CWIç ”ç©¶ãŒæˆåŠŸã—ã¾ã—ãŸã€‚ã“ã‚Œã¾ã§ã€Œç†è«–ä¸Šã¯ç ´ã‚‰ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€ã¨æŒ‡æ‘˜ã•ã‚Œã¦ã„ãŸSHA-1ãŒç¾å®Ÿã«ç ´ã‚‰ã‚Œã‚‹ã“ã¨ã«ãªã£ãŸãŸã‚ã€ã‚ˆã‚Šå®‰å…¨ãªãƒãƒƒã‚·ãƒ¥ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã¸ã®ç§»è¡ŒãŒå¿…é ˆã«ãªã£ãŸã‚ˆã†ã§ã™ã€‚ Google Online Security Blog: Announcing the first SHA1 collision https://security.google blog.com/2017/02/announcing-first-sha1-collision.html SHAttered http://shattered.io/ ã€ŒSHA-1ã€ç ´ã‚Šã«æˆåŠŸã—ãŸã®ã¯CWIã¨Googleã€‚2å¹´ã®ç ”ç©¶ã®æœ«ã«æˆåŠŸã—ãŸã¨ã®ã“ã¨ã€‚ ç´„20å¹´å‰ã«å®Ÿç”¨åŒ–ã•ã‚ŒãŸSHA-1ã®æŠ€è¡“çš„ãªã‚¢ã‚¤ãƒ‡ã‚¢ã¯ã€ãƒ‡ã‚¸
TsuSUZUKI 2017/02/25
cf. http://jp.wsj.com/articles/SB11107114851997343508104582640500898320654 , https://sect.iij.ad.jp/d/2017/02/271993.html ,http://www.st.ryukoku.ac.jp/~kjm/security/memo/2017/02.html#20170228__sha1 ("6,500 å€‹ã® CPU ã‚’ 1 å¹´é–“""GPU 1å€‹ Ã— 110 å¹´" "GPU 4 å€‹å…¥ã‚Šç®± Ã— 110 å°ãªã‚‰ 3 ã‹æœˆ")

SHAttered

SHA-1

å±æ®†åŒ–

Google

hashtabshlex

HashTab

Fasthash

SHA-2
ãƒªãƒ³ã‚¯
çŸ¥ã‚‰ã‚Œã–ã‚‹æš—å·ã®â€œ2017å¹´å•é¡Œâ€ã€å®‰å…¨ã‚µã‚¤ãƒˆãŒçªå¦‚è¦å‘Šã‚µã‚¤ãƒˆã«
ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°å¯¾ç–ã®æ¥ç•Œå›£ä½“ã§ã‚ã‚‹ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°å¯¾ç–å”è°ä¼šã¯2017å¹´1æœˆã€TLS/SSLã‚’ä½¿ã£ã¦ã„ã‚‹Webã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€æ£è¦ã®ã‚µã‚¤ãƒˆã§ã‚ã£ã¦ã‚‚ã€Œä¿¡é ¼ã§ããªã„ã‚µã‚¤ãƒˆã§ã™ã€ã¨ã„ã£ãŸè¦å‘ŠãŒè¡¨ç¤ºã•ã‚Œã‚‹å ´åˆãŒã‚ã‚‹ã¨ã—ã¦æ³¨æ„ã‚’å‘¼ã³ã‹ã‘ãŸã€‚ã€ŒSHA-1ã€ã¨å‘¼ã°ã‚Œã‚‹æš—å·æŠ€è¡“ã‚’ä½¿ã£ã¦ã„ã‚‹ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ãŒã€Œå®‰å…¨ã§ã¯ãªã„ã‚µã‚¤ãƒˆã®è¨¼æ˜Žæ›¸ã€ã¨è¦‹ãªã•ã‚Œã‚‹ã‚ˆã†ã«ãªã£ãŸãŸã‚ã ã€‚ å®‰å…¨ã§ãªã„ã‚µã‚¤ãƒˆã¨è¦‹ãªã•ã‚Œã‚‹ã¨ã€Webãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ã«ã‚ˆã£ã¦ã¯è¦å‘Šã®è¡¨ç¤ºã©ã“ã‚ã‹ã€ã‚¢ã‚¯ã‚»ã‚¹ã®ç¶šè¡Œã™ã‚‰ã§ããªã„ã€‚å›½å†…ã«ã‚‚ãã‚“ãªWebã‚µã‚¤ãƒˆãŒæ•°ï¼…æ®‹ã£ã¦ã„ã‚‹ã®ã ã€‚ ã€ŒSHA-1ã€ã¯å®‰å…¨ã§ã¯ãªã„ SHA-1ã¨ã¯ã€ä»»æ„ã®ãƒ‡ãƒ¼ã‚¿ã‚’å›ºå®šé•·ã®ãƒ‡ãƒ¼ã‚¿ã«å¤‰æ›ã™ã‚‹æš—å·å¦çš„ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ä¸€ç¨®ã€‚ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã®ç½²åï¼ˆãƒ‡ã‚¸ã‚¿ãƒ«ç½²åï¼‰ã‚’ä½œæˆã™ã‚‹éš›ãªã©ã«ä½¿ã‚ã‚Œã¦ã„ã‚‹ã€‚ç±³å›½å®¶å®‰å…¨ä¿éšœå±€ï¼ˆNSAï¼‰ãŒè¨è¨ˆã—ã€ç±³å›½ç«‹æ¨™æº–æŠ€è¡“ç ”ç©¶æ‰€ï¼ˆNISTï¼‰ã«ã‚ˆã£ã¦1995å¹´ã«ã€ŒFIPS PUB
TsuSUZUKI 2017/02/17
SHA-1

SHA-2

SHA-256

SSL

TLS

é›»åè¨¼æ˜Žæ›¸

ãƒ‡ã‚¸ã‚¿ãƒ«ç½²å

ã¾ãã¾ã
ãƒªãƒ³ã‚¯
/blog/2016/11/sha1countdown/
TsuSUZUKI 2016/11/26
SHA-1

Microsoft

IE11

IE

Edge

Windows

SHA1

SHA-2

SHA2

SHA-256
ãƒªãƒ³ã‚¯
SHA-1 deprecation countdown
The SHA-1 hash algorithm is no longer secure. Weaknesses in SHA-1 could allow an attacker to spoof content, execute phishing attacks, or perform man-in-the-middle attacks when browsing the web. Microsoft, in collaboration with other members of the industry, is working to phase out SHA-1. We have outlined our timeline for SHA-1 deprecation in earlier posts, most recently in April. This post is to c
TsuSUZUKI 2016/11/21
"February 14th, 2017" cf. http://internet.watch.impress.co.jp/docs/news/1031081.html / 2017å¹´ã®ãƒãƒ¬ãƒ³ã‚¿ã‚¤ãƒ³ã‚ºãƒ‡ã‚¤ã¯ Microsoft Update ã®æ—¥ã§ã™ã‹ãƒ»ãƒ»ãƒ»ã€‚

SHA-1

Microsoft

IE11

IE

Edge

Windows

SHA1

SHA-2

SHA2

SHA-256
ãƒªãƒ³ã‚¯
SHA-1 Certificates in Chrome
The latest news and insights from Google on security and safety on the Internet
TsuSUZUKI 2016/11/18
SHA-1

Chrome

SHA-2

SHA-256
ãƒªãƒ³ã‚¯
2016å¹´ã«æä¾›ã‚’çµ‚äº†ã™ã‚‹æºå¸¯é›»è©±ç‰ˆã‚µãƒ¼ãƒ“ã‚¹ã«ã¤ã„ã¦ - ãƒ‹ãƒ¥ãƒ¼ã‚¹ - ãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾
ãƒ¤ãƒ•ãƒ¼æ ªå¼ä¼šç¤¾ã¯ã€2016å¹´12æœˆã¾ã§ã«ã€ä»¥ä¸‹ã«è¨˜è¼‰ã—ãŸæºå¸¯é›»è©±ï¼ˆiãƒ¢ãƒ¼ãƒ‰ã€EZwebã€Yahoo!ã‚±ãƒ¼ã‚¿ã‚¤ï¼‰ç‰ˆã‚µãƒ¼ãƒ“ã‚¹ã®æä¾›çµ‚äº†ã‚’äºˆå®šã—ã¦ã„ã¾ã™ã€‚ãªãŠã€è¨˜è¼‰ã—ãŸä»¥å¤–ã®æºå¸¯é›»è©±ï¼ˆiãƒ¢ãƒ¼ãƒ‰ã€EZwebã€Yahoo!ã‚±ãƒ¼ã‚¿ã‚¤ï¼‰ç‰ˆã‚µãƒ¼ãƒ“ã‚¹ã¯ã€å¼•ãç¶šãæä¾›ã„ãŸã—ã¾ã™ã€‚ ã€æºå¸¯é›»è©±ï¼ˆiãƒ¢ãƒ¼ãƒ‰ã€EZwebã€Yahoo!ã‚±ãƒ¼ã‚¿ã‚¤ï¼‰ç‰ˆã‚µãƒ¼ãƒ“ã‚¹ã€‘ â€»1ã€€ãƒ†ã‚ã‚¹ãƒˆã§ã®ã€ŒYahoo!æ¤œç´¢ã€ã¯ã€å¼•ãç¶šãã”åˆ©ç”¨ã„ãŸã ã‘ã¾ã™ã€‚ â€»2ã€€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒä¿æœ‰ã—ã¦ã„ã‚‹ï¼´ãƒã‚¤ãƒ³ãƒˆã‚„ã‚ãƒ£ãƒ³ãƒšãƒ¼ãƒ³ãŒä¸€è¦§ã§ãã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã§ã™ã€‚ â€»è©³ç´°ã¯é †æ¬¡ã€ã‚µãƒ¼ãƒ“ã‚¹ãƒšãƒ¼ã‚¸ã§ãŠçŸ¥ã‚‰ã›ã„ãŸã—ã¾ã™ã€‚ â€»ä¸Šè¨˜ã®æä¾›å½¢æ…‹ä»¥å¤–ã§ã¯ã€å¼•ãç¶šãã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã—ã¾ã™ã€‚ â€»çµ‚äº†æ—¥æ™‚ã¯äºˆå‘Šãªãå¤‰æ›´ã¨ãªã‚‹å ´åˆãŒã‚ã‚Šã¾ã™ã€‚
TsuSUZUKI 2016/09/01
cf. http://internet.watch.impress.co.jp/docs/news/1017783.html , "ãŸã ã—ã€50ä»£ã§ã¯45ï¼…ã€60ä»£ä»¥ä¸Šã§ã¯60ï¼…ãŒä¾ç„¶ã¨ã—ã¦ãƒ•ã‚£ãƒ¼ãƒãƒ£ãƒ¼ãƒ•ã‚©ãƒ³ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ã“ã¨ã«ãªã‚‹ã€‚â€

Yahoo

ã‚¬ãƒ©ã‚±ãƒ¼

æºå¸¯é›»è©±

SHA-1

SHA-2

SHA-256

TLS
ãƒªãƒ³ã‚¯
SHA-1 ãƒãƒƒã‚·ãƒ¥ ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã«ã‚ˆã£ã¦ç½²åã•ã‚ŒãŸè¨¼æ˜Žæ›¸ã®å»ƒæ¢ã«ã¤ã„ã¦
ã“ã‚“ã«ã¡ã¯ã€‚ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã‚µãƒãƒ¼ãƒˆã®å·¥è—¤ã§ã™ã€‚ æœ¬è¨˜äº‹ã«ã‚ˆã£ã¦æ¡ˆå†…ã‚’ã—ã¦ãŠã‚Šã¾ã—ãŸ SHA-1 ãƒãƒƒã‚·ãƒ¥ ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã«ã‚ˆã£ã¦ç½²åã•ã‚ŒãŸè¨¼æ˜Žæ›¸ã®å»ƒæ¢ã«é–¢ã™ã‚‹ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã¯ã€æƒ…å ±ãŒæ›´æ–°ã•ã‚ŒãŸãŸã‚ã€ä»¥ä¸‹ã®ã‚µã‚¤ãƒˆã‚’ã”ç¢ºèªãã ã•ã„ã¾ã™ã‚ˆã†ãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ TITLE: Windows Enforcement of SHA1 Certificates URL: https://social.tech net.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx?PageIndex=2 æ—¥æœ¬èªžç‰ˆã§ã¯ä»¥ä¸‹ã®ã‚µã‚¤ãƒˆæƒ…å ±ãŒæœ€æ–°ã¨ãªã‚Šã¾ã™ã€‚ TITLE: SHA-1 ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã¯ 2017 å¹´ï¼’æœˆã‹ã‚‰è¦å‘Šï¼ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆç®¡ç†è€…ã¯å½±éŸ¿ã®æœ€çµ‚ç¢ºèªã‚’ URL: https://blog
TsuSUZUKI 2016/01/26
SHA-1

IE

InternetExplorer

Microsoft

Windows
ãƒªãƒ³ã‚¯
æº–å‚™OKï¼Ÿã€€EVã‚³ãƒ¼ãƒ‰ã‚µã‚¤ãƒ‹ãƒ³ã‚°è¨¼æ˜Žæ›¸ã®ç¾çŠ¶ã¨ãã®å®Ÿéš› | OSDN Magazine
Microsoftç¤¾ãŒè¡¨æ˜Žã—ãŸã‚³ãƒ¼ãƒ‰ã‚µã‚¤ãƒ‹ãƒ³ã‚°è¨¼æ˜Žæ›¸ã«ãŠã‘ã‚‹SHA-1ã®ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã®åˆ©ç”¨æœŸé™ãŒè¿«ã‚Šã€ã¾ãŸWindows 10ã«ãŠã„ã¦è¨¼æ˜Žæ›¸ã®è¦ä»¶ãŒå¤‰æ›´ã•ã‚Œã‚‹ãªã©ã€è¨¼æ˜Žæ›¸ã«é–¢é€£ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¼·åŒ–ã«å¤‰åŒ–ãŒèµ·ã“ã£ã¦ã„ã‚‹ã€‚æœ¬ç¨¿ã§ã¯ã€æ”¹ã‚ã¦è¨¼æ˜Žæ›¸ã‚’å–ã‚Šå·»ãç’°å¢ƒã‚’æ•´ç†ã™ã‚‹ã¨ã¨ã‚‚ã«ã€å¿…é ˆã¨ãªã‚Šã¤ã¤ã‚ã‚‹EVã‚³ãƒ¼ãƒ‰ã‚µã‚¤ãƒ‹ãƒ³ã‚°è¨¼æ˜Žæ›¸ã‚’å®Ÿéš›ã«ã‚°ãƒãƒ¼ãƒãƒ«ã‚µã‚¤ãƒ³ã‹ã‚‰å–å¾—ã—ãªãŒã‚‰è¨¼æ˜Žæ›¸ã®åˆ©ç”¨æ–¹æ³•ã‚’ã¾ã¨ã‚ã¦ã„ã“ã†ã€‚ SHA-1ã‹ã‚‰SHA-2ã¸ã®æœ¬æ ¼ç§»è¡Œé–‹å§‹ SSLè¨¼æ˜Žæ›¸ã‚„ã‚³ãƒ¼ãƒ‰ã‚µã‚¤ãƒ‹ãƒ³ã‚°è¨¼æ˜Žæ›¸ã«ãŠã‘ã‚‹ãƒãƒƒã‚·ãƒ¥ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã¨ã—ã¦ã€ã“ã‚Œã¾ã§ã¯SHA-1ãŒãƒ‡ãƒ•ã‚¡ã‚¯ãƒˆã‚¹ã‚¿ãƒ³ãƒ€ãƒ¼ãƒ‰ã¨ã—ã¦åˆ©ç”¨ã•ã‚Œã¦ããŸã€‚ã—ã‹ã—ã€SHA-1ã«å¯¾ã™ã‚‹æ”»æ’ƒæ³•ã¯10å¹´ã»ã©å‰ã«ç™ºè¦‹ã•ã‚Œã¦ãŠã‚Šã€ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã®æ¼”ç®—å‡¦ç†èƒ½åŠ›ã‚‚å‘ä¸Šã—ã¦ãã¦ã„ã‚‹ã“ã¨ã‹ã‚‰ã€SHA-1ã®å¼·åº¦ã¯ååˆ†ã§ã¯ãªã„çŠ¶æ³ã«ã‚ã‚‹ã€‚ã‚ˆã‚Šå¼·åŠ›ãªSHA-2ã¸ã®ç§»è¡Œã¯ã“ã‚Œã¾ã§ã‚‚æŽ¨å¥¨ã•ã‚Œã¦ããŸãŒã€æœ€è¿‘ã«ãª
TsuSUZUKI 2015/11/18
SHA-1

SHA-2

EVè¨¼æ˜Žæ›¸

TLS

SSL
ãƒªãƒ³ã‚¯
Continuing to Phase Out SHA-1 Certificates â€“ Mozilla Security Blog
In our previous blog post about phasing out certificates with SHA-1 based signature algorithms, we said that we planned to take a few actions with regard to SHA-1 certificates: Add a security warning to the Web Console to remind developers that they should not be using a SHA-1 based certificates Show the â€œUntrusted Connectionâ€ error whenever a SHA-1 certificate issued after January 1, 2016, is enc
TsuSUZUKI 2015/10/22
"we are also considering the feasibility of having a cut-off date as early as July 1, 2016."

SHA-1

Mozilla

Hash

SSL

TLS

ãƒ‡ã‚¸ã‚¿ãƒ«ç½²å

é›»åè¨¼æ˜Žæ›¸
ãƒªãƒ³ã‚¯
ã€ŒSHA-1ã®å»ƒæ¢å‰å€’ã—ã‚’ã€ã€€å°‚é–€å®¶ãƒãƒ¼ãƒ ãŒæè¨€
SHA-1ãŒã“ã‚Œã¾ã§è€ƒãˆã‚‰ã‚Œã¦ã„ãŸã‚ˆã‚Šã‚‚å¤§å¹…ã«å®‰ã„ã‚³ã‚¹ãƒˆã§ç ´ã‚Œã‚‹ã“ã¨ãŒåˆ†ã‹ã‚Šã€çŠ¯ç½ªé›†å›£ã«æ‚ªç”¨ã•ã‚Œã‚‹å±é™ºãŒè¿«ã£ãŸã¨æŒ‡æ‘˜ã—ã¦ã„ã‚‹ã€‚ Webã‚µã‚¤ãƒˆã§ã®èªè¨¼ã‚„ãƒ‡ã‚¸ã‚¿ãƒ«ç½²åã«ä½¿ã‚ã‚Œã‚‹ãƒãƒƒã‚·ãƒ¥é–¢æ•°ã®ã€ŒSHA-1ã€ã«ã¤ã„ã¦ã€æš—å·è§£èªã®å›½éš›å°‚é–€å®¶ãƒãƒ¼ãƒ ãŒ10æœˆ8æ—¥ã€å»ƒæ¢ã®æ™‚æœŸã‚’ç¾åœ¨ã®ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚ˆã‚Šã‚‚å‰å€’ã—ã™ã‚‹å¿…è¦ãŒã‚ã‚‹ã¨å‹§å‘Šã—ãŸã€‚SHA-1ãŒã“ã‚Œã¾ã§è€ƒãˆã‚‰ã‚Œã¦ã„ãŸã‚ˆã‚Šã‚‚å¤§å¹…ã«å®‰ã„ã‚³ã‚¹ãƒˆã§ç ´ã‚Œã‚‹ã“ã¨ãŒåˆ†ã‹ã‚Šã€çŠ¯ç½ªé›†å›£ã«æ‚ªç”¨ã•ã‚Œã‚‹å±é™ºãŒè¿«ã£ãŸã¨æŒ‡æ‘˜ã—ã¦ã„ã‚‹ã€‚ SHA-1ã¯ä»¥å‰ã‹ã‚‰è„†å¼±æ€§ãŒæŒ‡æ‘˜ã•ã‚Œã€Microsoftã‚„Googleãªã©ä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¡ãƒ¼ã‚«ãƒ¼ã‚„é›»åè¨¼æ˜Žæ›¸ã®ç™ºè¡Œæ©Ÿé–¢ãŒæ®µéšŽçš„ãªå»ƒæ¢ã«å‘ã‘ãŸã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’å…¬è¡¨ã—ã¦ã„ã‚‹ã€‚ ã—ã‹ã—ç¾åœ¨ã®è¨ˆç”»ã§ã¯ã€SHA-1ã‚’ä½¿ã£ãŸè¨¼æ˜Žæ›¸ãŒä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ã§å®‰å…¨ã¨èªè˜ã•ã‚Œãªããªã‚‹ã®ã¯2017å¹´1æœˆä»¥é™ã€‚ã“ã‚Œã«å¯¾ã—ã¦ã‚ªãƒ©ãƒ³ãƒ€ã€ãƒ•ãƒ©ãƒ³ã‚¹ã€ã‚·ãƒ³ã‚¬ãƒãƒ¼ãƒ«ã®ç ”ç©¶ãƒãƒ¼ãƒ ã¯ã€SHA-1ã«å¯¾ã™ã‚‹
TsuSUZUKI 2015/10/15
SHA-1

Hash
ãƒªãƒ³ã‚¯
cryptrec_ciphers_list_2013.pdf
Loadingâ€¦
TsuSUZUKI 2013/05/09
cf. http://www.cryptrec.go.jp/list.html , http://itpro.nikkeibp.co.jp/article/Watcher/20130426/474102/ / ATOK ãˆã‚‰ã„ã€‚â†’ ç›£ç†ãƒã‚¹ãƒˆ

SHA-1

RC4

RIPEMD-160

æš—å·åŒ–

CRYPTREC
ãƒªãƒ³ã‚¯
SHA1 weakness benefits password crackers - The H Security: News and Features
Jens Steube, a co-author of the popular Hashcat password cracker, has discovered a weakness in the SHA1 cryptographic hashing technique that enables him to accelerate password cracking by about 20 per cent. SHA1 always processes blocks of 512 bits (64 bytes). However, this data is expanded to 2,048 bits when the SHA1 hash value is generated â€“ Steube calls this process "word expansion". Words are e
TsuSUZUKI 2012/12/10
SHA-1

SHA1

Hash
ãƒªãƒ³ã‚¯
ã€ã”æ³¨æ„ãã ã•ã„ã€‘ KDDIç¤¾ auç«¯æœ«ä¸Šã® EZã‚¢ãƒ—ãƒª(BREWÂ®) å‘ã‘ã‚µãƒ¼ãƒ“ã‚¹ã«ãŠã„ã¦ SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’ã”åˆ©ç”¨ã®å ´åˆã®æ³¨æ„ç‚¹
TsuSUZUKI 2010/06/28
MD2

SHA-1

VeriSign

SSL
ãƒªãƒ³ã‚¯
æ—¥æœ¬ãƒ™ãƒªã‚µã‚¤ãƒ³ - Enterprise & Internet Security Solutions
TsuSUZUKI 2010/06/28
cf. http://dennsya-nikki.cocolog-nifty.com/blog/2010/06/sslmd2-2efd.html

MD2

SHA-1

VeriSign

SSL
ãƒªãƒ³ã‚¯
SANS.edu Internet Storm Center - SANS Internet Storm Center
TsuSUZUKI 2010/02/16
Whitelist

Hash

MD5

SHA1

SHA-1

SANS

GoodSoftware

NIST
ãƒªãƒ³ã‚¯
SHA-1 collisions achievable
TsuSUZUKI 2009/06/11
cf. http://www.microsoft.com/japan/technet/security/advisory/961509.mspx , http://www.securityfocus.com/bid/12577/info , http://isc.sans.org/diary.html?storyid=6574

SHA-1

MD5

SHA-2

Hash

Collisions
ãƒªãƒ³ã‚¯
æ—¥æœ¬ãƒ™ãƒªã‚µã‚¤ãƒ³ - Enterprise & Internet Security Solutions
Discover Domain Names Explore Registry Services About Verisign Support
TsuSUZUKI 2007/12/21
ã‚µãƒ¼ãƒ

Apache

SSL

ä¸é–“è¨¼æ˜Žæ›¸

ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸

ç¬¬ï¼–ç¨®
ãƒªãƒ³ã‚¯
1