[B! tls][ssl] fujyaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

fujya id:fujya

tlsã¨sslã«é–¢ã™ã‚‹fujyaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

diffie-hellman dhe
ãªã‚“ã‹ã€è³ªå•å—ã‘ã¦ãŸã‚“ã§ã™ã‚ˆãã€ãã£ã¨ DH ã¨ DHE ã£ã¦ä½•ãŒé•ã†ã®? ã£ã¦è©±ã«ãªã£ãŸã‚“ã§æ¤œç´¢ã—ã¾ã—ãŸ å¤œã§ã‚‚ã‚¢ãƒƒã‚µãƒ : SSL(TLS)ã®DHã¨DHEã®é•ã„ ãªã‚“ã‹ã‚‚ã‰ã€ã—ã£ã‹ã‚Šæ›¸ã„ã¦ã‚ã‚Šã¾ã—ãŸã‚ˆDHEã®Eã¯ã€Ephemeralã®Eã€‚DHEã¯ã€DHãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’é€šä¿¡æ™‚ã«å‹•ä½œã«ä½œæˆã™ã‚‹ã€‚DHã¯ã€DHãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã¯è¨¼æ˜Žæ›¸ã«æ›¸ã‹ã‚Œã¦ã„ã‚‹ç‰©ã‚’ä½¿ã†ã€‚ã‚ˆã£ã¦ã€static DHã¨ã‚‚å‘¼ã°ã‚Œã‚‹ã€‚DH-RSAã¯ã€è¨¼æ˜Žæ›¸ã«CAãŒRSAã§ç½²åã—ãŸã¨ã„ã†äº‹ã€‚è¨¼æ˜Žæ›¸ã«RSAéµãŒå…¥ã£ã¦ã„ã‚‹ã‚ã‘ã§ã¯ãªã„ã€‚DHE-RSAã¯ã€è¨¼æ˜Žæ›¸ã«RSAéµãŒå…¥ã£ã¦ã„ã‚‹ã€‚ ã§ãã€æ°—ã«ãªã‚‹ã®ã§åŽŸå…¸ã‚’ã‚ãŸã‚‹ã‚ã‘ã§ã™ã‚ˆã€ è‹±èªžã ã¨è¾›ã„ã‹ã‚‰å’Œè¨³ã§ã™ã‘ã© The TLS Protocol Version 1.0 DH ã¯ã€èªè¨¼å±€(CA)ã«ã‚ˆã£ã¦ç½²åã•ã‚ŒãŸã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã«å«ã¾ã‚Œã¦ã„ã‚‹Diffie-Hellman ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚’ä½¿ç”¨ã—ãŸæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’ç¤º
fujya 2014/02/20
å®Ÿã¯ä»Šã¾ã§ã“ã®è¾ºã‚Šå¾®å¦™ã«æµã—ã¦ãŸ

ssl

security

tls
ãƒªãƒ³ã‚¯
http://www.carbonwind.net/TLS_Cipher_Suites_Project/tls_ssl_cipher_suites_annex_a1_main.htm
fujya 2012/10/30
openssl

SSL

Apache

tls
ãƒªãƒ³ã‚¯
SSL/SPDYã‚’æ”»æ’ƒã™ã‚‹CRIMEã¯BEASTã®æ£çµ±ãªå¾Œç¶™è€…ã
ã¯ã˜ã‚ã« ä»¥å‰ã®ã‚¨ãƒ³ãƒˆãƒªã§SSLã«å¯¾ã™ã‚‹æ–°ã—ã„æ”»æ’ƒæ‰‹æ³•ã€ŒBEASTã€ã‚’ç´¹ä»‹ã—ã¾ã—ãŸãŒã€ä»Šå›žã¯BEASTã‚’ã•ã‚‰ã«ç™ºå±•ã•ã›ãŸã€ŒCRIMEã€ã¨ã„ã†æ”»æ’ƒã«ã¤ã„ã¦ç°¡å˜ã«ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ä¸€æ¬¡æƒ…å ±æºã¨ã—ã¦ã“ã¡ã‚‰ã®ã‚¹ãƒ©ã‚¤ãƒ‰ï¼ˆè‹±èªžï¼‰ãŒé–²è¦§ã§ãã¾ã™ã®ã§ã€æ™‚é–“ãŒã‚ã‚‹æ–¹ã¯ãœã²ç›®ã‚’é€šã—ã¦ã¿ã¦ãã ã•ã„ã€‚ CRIMEã®æ„å‘³ CRIMEã¯ "Compression Ratio Info-Leak Made Easy" ã‚ã‚‹ã„ã¯ "Compression Ratio Info-Leak Mass Exploitation" ã®é æ–‡å—ã§ã€SSLã‚„SPDYï¼ˆã‚ã‚‹ã„ã¯HTTPãƒœãƒ‡ã‚£éƒ¨ã®gzipåœ§ç¸®ï¼‰ã§ä½¿ã‚ã‚Œã‚‹åœ§ç¸®ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã«æ³¨ç›®ã—ãŸæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã›ã‚“ãŒSSLã«ã¯åœ§ç¸®æ©Ÿèƒ½ãŒå˜åœ¨ã—ã¦ãŠã‚Šã€ã‚µãƒ¼ãƒå´ãƒ»ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´åŒæ–¹ãŒåœ§ç¸®æ©Ÿèƒ½ã‚’ONã«ã—ã¦ã„ã‚‹å ´åˆã«ã€ãƒ‡ãƒ¼ã‚¿ãŒåœ§ç¸®ã•ã‚Œã¾ã™ã€‚ BEASTã¨ã®é–¢ä¿‚ CRIMEã¯B
fujya 2012/10/30
SSL

security

TLS

SPDY

CRIMEæ”»æ’ƒ
ãƒªãƒ³ã‚¯
SSL/TLS Supported CipherSuites
Revision: 3.0 (Initial Release: 2010-Mar-05 Â Revised: 2011-Aug-02) SSL Server (Web Server, Application Server) SSL Server (Web Server, Application Server)
fujya 2011/10/04
chipersã®å¯¾å¿œçŠ¶æ³ã®ãƒžãƒˆãƒªã‚¯ã‚¹ã€‚ã“ã‚Œè¦‹ãªãŒã‚‰Apacheãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°ã™ã‚‹ã§ã™ã€‚

tls

SSL

security

openssl

ssl
ãƒªãƒ³ã‚¯
InfoQ: HTTPSã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ã®æœ€åˆã®æ•°ãƒŸãƒªç§’
ã»ã¨ã‚“ã©ã®äººãŒHTTPSã¨SSL (Secure Sockets Layer) ã‚’çµã³ã¤ã‘ã¦è€ƒãˆã¾ã™ã€‚SSLã¯1990å¹´ä»£åŠã°ã«Netscapeç¤¾ãŒé–‹ç™ºã—ãŸä»•çµ„ã¿ã§ã™ãŒã€ä»Šã§ã¯ã“ã®äº‹å®Ÿã¯ã‚ã¾ã‚Šæ£ç¢ºã§ãªã„ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚Netscapeç¤¾ãŒå¸‚å ´ã®ã‚·ã‚§ã‚¢ã‚’å¤±ã†ã«ã—ãŸãŒã£ã¦ã€SSLã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“ã‚¿ã‚¹ã‚¯ãƒ•ã‚©ãƒ¼ã‚¹(IETF)ã¸ç§»ç®¡ã•ã‚Œã¾ã—ãŸã€‚Netscapeç¤¾ã‹ã‚‰ç§»ç®¡ã•ã‚Œã¦ä»¥é™ã®åˆã‚ã¦ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯Transport Layer Security (TLS)1.0ã¨åä»˜ã‘ã‚‰ã‚Œã€1999å¹´1æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚TLSãŒä½¿ã‚ã‚Œã ã—ã¦10å¹´ã‚‚çµŒã£ã¦ã„ã‚‹ã®ã§ã€ç´”ç²‹ãª"SSL"ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’è¦‹ã‚‹ã“ã¨ã¯ã»ã¨ã‚“ã©ã‚ã‚Šã¾ã›ã‚“ã€‚ Client Hello TLSã¯ã™ã¹ã¦ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ç•°ãªã‚‹ã‚¿ã‚¤ãƒ—ã®"ãƒ¬ã‚³ãƒ¼ãƒ‰"ã§åŒ…ã¿ã¾ã™ã€‚ãƒ–ãƒ©ã‚¦ã‚¶ãŒå‡ºã™å…ˆé ã®ãƒã‚¤ãƒˆå€¤ã¯16é€²æ•°è¡¨è¨˜ã§0x16 = 22ã€‚ ã“ã‚Œã¯
fujya 2010/02/26
ã‚ã¨ã§èªã‚€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

ssl

https

security

ãŠã‚‚ã—ã‚

tls

web
ãƒªãƒ³ã‚¯
1