[B! openssl] ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ionis id:ionis

opensslã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€ŽOpenSSLã‚¯ãƒƒã‚¯ãƒ–ãƒƒã‚¯ã€æä¾›é–‹å§‹ã®ãŠçŸ¥ã‚‰ã›
ã”æ¥åº—ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ æœ¬æ—¥ã‚ˆã‚Šã€ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ï¼ˆ2017å¹´3æœˆç™ºè¡Œï¼‰ã‹ã‚‰ã‚¹ãƒ”ãƒ³ã‚ªãƒ•ã—ãŸãƒŸãƒ‹ãƒ–ãƒƒã‚¯ã€ŽOpenSSLã‚¯ãƒƒã‚¯ãƒ–ãƒƒã‚¯ã€ã®æä¾›ã‚’é–‹å§‹ã—ã¾ã—ãŸã€‚è³¼å…¥ãƒšãƒ¼ã‚¸ã‹ã‚‰ã‚«ãƒ¼ãƒˆã«è¿½åŠ ã—ã¦ã„ãŸã ãã“ã¨ã§ã€ã©ãªãŸã§ã‚‚ç„¡å„Ÿã§ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãŒå¯èƒ½ã§ã™ï¼ˆã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã¯ä¸è¦ã§ã™ãŒã€ç›´è²©ã‚µã‚¤ãƒˆã®è³¼å…¥ãƒ•ãƒãƒ¼ã‚’çµŒç”±ã™ã‚‹é–¢ä¿‚ã§ã€ãŠåå‰ã®æ¬„ã¨ä½æ‰€ã®æ¬„ã¸ã®å…¥åŠ›ã¯ãŠé¡˜ã„ã„ãŸã—ã¾ã™ï¼‰ã€‚ åŒæ›¸ã¯ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ã®åŽŸæ›¸ã§ã‚ã‚‹â€ŸBulletproof SSL and TLSâ€ã‹ã‚‰OpenSSLã«é–¢ã™ã‚‹ç« ã‚’æŠœãå‡ºã—ã¦å†ç·¨ã•ã‚ŒãŸâ€ŸOpenSSL Cookbookâ€ã®ç¿»è¨³ã«ç›¸å½“ã—ã€ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ã®ã€Œç¬¬11ç« OpenSSLã€ã¨ã€Œç¬¬12ç« OpenSSLã«ã‚ˆã‚‹ãƒ†ã‚¹ãƒˆã€åŠ ãˆã€SSL Labsã§å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ â€ŸSSL/TLS Deployment Best Pra
ionis 2018/02/08
openssl

æœ¬

ssl
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§(CVE-2017-3733)ã«è¦‹ã‚‰ã‚Œã‚‹ä»•æ§˜ã¨castã®è½ã¨ã—ç©´ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ OpenSSL-1.1.0dã«è„†å¼±æ€§(CVE-2017-3733)ãŒè¦‹ã¤ã‹ã‚Šã€Encrypt-Then-Mac ã¨ renegotiation ã‚’çµ„ã¿åˆã‚ã›ã¦ crashã•ã›ã‚‹ã“ã¨ãŒã§ãã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã¯ã€ä»•æ§˜ã®æº–æ‹ ä¸è¶³ã‚„ä¸é©åˆ‡ãªå¤‰æ•°ã® cast ãªã©ãŒåŽŸå› ã§ã—ãŸã€‚ TLS1.3ã§ã¯ã“ã†ã„ã†è½ã¨ã—ç©´ãŒå°‘ãªããªã‚‹ã‚ˆã†æ©Ÿèƒ½ã®æ ¹æœ¬çš„ãªè¦‹ç›´ã—ãŒè¡Œã‚ã‚Œã¦ã„ã¾ã™ã€‚ 1. ã¯ã˜ã‚ã« å…ˆé€± OpenSSL-1.1.0d ã«å¯¾ã—ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãŒã‚ã‚Šã€ Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)ã¨ã„ã†è„†å¼±æ€§(Severity: High)ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ å¯¾è±¡ã¨ãªã£ãŸ 1.1.0 ã¯ã€æ˜¨å¹´2016å¹´8æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸOpenSSLã®æ–°ã—ã„ãƒªãƒªãƒ¼ã‚¹ãƒ–ãƒ©ãƒ³ãƒã§ã™ã€‚1.1.0ã§ã¯APIã®å¤§å¹…å¤‰æ›´ã‚‚ã‚ã‚Šã€ã¾ã ã‚ã¾ã‚Šæ™®åŠ
ionis 2017/02/20
è„†å¼±æ€§

openssl
ãƒªãƒ³ã‚¯
opensslã§RSAæš—å·ã¨éŠã¶ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
opensslã¨RSAæš—å·ã«ã¤ã„ã¦ã¡ã‚‡ã£ã¨èª¿ã¹ã¦ã¿ã‚ˆã†ã‹ãªã€ã¨æ€ã£ãŸã€‚ ã¾ãšRSAæš—å·ã¨ã¯ã€ å…¬é–‹éµæš—å·æ–¹å¼ã®å®Ÿè£…ã®ã²ã¨ã¤ã§ã‚ã‚‹ 2ã¤ã®ç´ æ•°ã®ç©(ã‚±ã‚¿æ•°ãŒå¤§ãã„å ´åˆã®ç´ å› æ•°åˆ†è§£ã®å›°é›£ã•)ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ ã£ã¦ã“ã¨ã‚’ç†å±ˆã¨ã—ã¦ã¯ç†è§£ã—ã¦ã„ã‚‹ã‘ã©ã€å®Ÿéš›ã«opensslã‚³ãƒžãƒ³ãƒ‰ã§ä½œã£ãŸéµãƒ•ã‚¡ã‚¤ãƒ«ã®ä¸èº«ãŒã©ã†ãªã£ã¦ã„ã‚‹ã®ã‹? ã¨ã„ã†ã“ã¨ã¾ã§è¸ã¿è¾¼ã‚“ã ã“ã¨ãŒç„¡ã‹ã£ãŸã€‚ ã¨ã„ã†ã‚ã‘ã§ã€ã¡ã‚‡ã£ã¨ãã®è¾ºã‚’ã‚³ãƒžãƒ³ãƒ‰å©ããªãŒã‚‰éŠã‚“ã§ã¿ã‚‹ã“ã¨ã«ã™ã‚‹ã€‚ ã¯ã˜ã‚ã«ï¼šopensslã®æ“ä½œã«ã¤ã„ã¦ opensslã‚³ãƒžãƒ³ãƒ‰ã¯å¢—ç¯‰ã«å¢—ç¯‰ã‚’é‡ãã™ãŽã¦ãŠã‚Šã€ã‚‚ã¯ã‚„ãã³ãˆç«‹ã¤Ã—Ã—ã®ã‚ˆã†ã§ã‚ã‚‹ã€‚ãƒ¤ãƒ´ã‚¡ã„ã“ã¨ã«ãªã£ãŸãƒ¬ãƒ™ãƒ«ã§æ©Ÿèƒ½ã¦ã‚“ã“ç››ã‚Šã®ã‚³ãƒžãƒ³ãƒ‰ãªã®ã§ã€ã‚µãƒ–ã‚³ãƒžãƒ³ãƒ‰ã¨ã—ã¦æ©Ÿèƒ½åã‚’æŒ‡å®šã—ã¦ä½¿ã†ã“ã¨ã«ãªã‚‹ã€‚ openssl command [ command_opts ] [ command_args ]ä¸Šä¾‹ã®ã€Œcommandã€ã«ã¯ã€R
ionis 2015/09/24
openssl

RSA

ssl
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§(CVE-2015-1793)ã«ã‚ˆã‚‹Altãƒã‚§ãƒ¼ãƒ³è¨¼æ˜Žæ›¸å½é€ ã®ä»•çµ„ã¿ - ã¼ã¡ã¼ã¡æ—¥è¨˜
TL;DR ã‚„ã£ã±ã‚Šæ›¸ã„ã¦ã„ãŸã‚‰é•·æ–‡ã«ãªã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã‚ã¾ã‚Šã¡ã‚ƒã‚“ã¨æŽ¨æ•²ã™ã‚‹æ°—åŠ›ãŒãªã„ã®ã§ã€å¤‰ãªæ–‡ç« ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ã”äº†æ‰¿ã„ãŸã ã‘ã‚‹æ–¹ã®ã¿ãŠèªã¿ãã ã•ã„ã€‚ 1. ã¯ã˜ã‚ã« æ˜¨æ™©æœªæ˜Žã«OpenSSL-1.0.2d, 1.0.1pãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚äº‹å‰ã«äºˆå‘Šã•ã‚Œã¦ã„ãŸé€šã‚Šæ·±åˆ»åº¦é«˜ã®è„†å¼±æ€§CVE-2015-1793ãŒä¿®æ£ã•ã‚Œã¦ã„ã¾ã™ã€‚Advisoryã‚’è¦‹ã‚‹ã¨ã€ã“ã®è„†å¼±æ€§ãŒiojs/Nodeã«å½±éŸ¿ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ãŒåˆ¤æ˜Žã—ãŸã®ã§ç›´ã¡ã«iojs/Nodeã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’è¡Œã„ã€ä»Šæœæœªæ˜Žã«ç„¡äº‹è„†å¼±æ€§å¯¾å¿œç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ ä»Šå›žãŒåˆã‚ã¦ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€æ·±å¤œã«æ—¥æ¬§ç±³ã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒgithubä¸Šã§äº’ã„ã«é€£æºã—ãªãŒã‚‰é€Ÿã‚„ã‹ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒªãƒªãƒ¼ã‚¹ä½œæ¥ã‚’è¡Œã†ã“ã¨ã¯ä½•å›žã‚„ã£ã¦ã‚‚ãªã‹ãªã‹ã—ã³ã‚Œã‚‹çµŒé¨“ã§ã™ã€‚æ™‚å·®ã‚‚ã‚ã‚Šãªã‹ãªã‹ä½“åŠ›çš„ã«ã¯è¾›ã„ã‚‚ã®ãŒã‚ã‚Šã¾ã™ãŒã€ä¸–ç•Œã®è¶…ä¸€æµã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨å…±åŒã§ãƒªã‚¢
ionis 2015/07/13
openssl

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

ssl
ãƒªãƒ³ã‚¯
ç§ãŒæ„›ã—ãŸ openssl (SSL/TLS ç·¨) - ã—ã¦ã¿ã‚“ã¨ã¦
id:blooper:20120907 ã®ç¶šãã§ã™ãŒã€çš†æ§˜ã«ãŠã‹ã‚Œã¾ã—ã¦ã¯æ—¢ã«è¨¼æ˜Žæ›¸ãŒå¥½ãã§å¥½ãã§ãŸã¾ã‚‰ãªããªã£ã¦ã€HTTPS ã‚’åˆ©ç”¨ã—ãŸã‚µã‚¤ãƒˆã«è¡Œãã¨è¨¼æ˜Žæ›¸ã®æ‹¡å¼µã¾ã§èªã‚“ã å¾Œã§ãªãã¦ã¯è¨¼æ˜Žæ›¸ã®å†…å®¹ãŒæ°—ã«ãªã£ã¦ã‚µã‚¤ãƒˆã®æœ¬æ–‡ãŒèªã‚ãªããªã£ã¦ã„ã‚‹ã‹ã¨æ€ã„ã¾ã™ãŒå¦‚ä½•ãŠéŽã”ã—ã§ã—ã‚‡ã†ã‹ã€‚ SSL ã¯ Secure Sockets Layer ã®é æ–‡å—ã§ Netscape Communications ãŒ 1995 å¹´ã«ã€ã£ã¦ã®ã¯ wikipedia:Secure_Sockets_Layer ã§ã‚‚è¦‹ã‚Œã°è¼‰ã£ã¦ã‚‹ã®ã§è¦‹ã¦ãã€‚ã§ã€RFC ã«ã—ã‚ˆã†ã£ã¦ã“ã¨ã§ SSL ã¯ Netscape ã®ã§ã—ã‚‡? ã£ã¦ã“ã¨ã§ TLS (Transport Layer Security) ã«æ”¹åã—ãŸã€ã¨è¨˜æ†¶ã—ã¦ã‚‹ã‚“ã ã‘ã©æœ¬å½“ã ã£ã‘ãªã€‚ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯æ™‚ã®ãƒ¬ã‚³ãƒ¼ãƒ‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³è¦‹ã‚‹ã¨ SSLv3.0 ã¯ 3.0 TLSv1.0
ionis 2015/04/08
ssl

openssl
ãƒªãƒ³ã‚¯
ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’opensslã§ä½œã‚‹ï¼ˆè©³ç´°ç‰ˆï¼‰ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
å‰å›žã®opensslã§RSAæš—å·ã¨éŠã¶ã§RSAæš—å·ã‚„ç§˜å¯†éµã«ã¤ã„ã¦ä¸èº«ã‚’è‰²ã€…ã¨ã„ã˜ã£ã¦ã¿ãŸã€‚ç¶šã„ã¦ä»Šå›žã¯ã€Apacheã§ä½¿ã†ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œã£ã¦ã¿ã‚‹ã€‚ ç´°ã‹ã„ã“ã¨ã¯ã„ã„ã‹ã‚‰ã€ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œã‚‹ã‚³ãƒžãƒ³ãƒ‰ã ã‘çŸ¥ã‚ŠãŸã„ ãŠæ€¥ãŽã®æ–¹ã¯ã€ä»¥ä¸‹3ã¤ã ã‘ã‚„ã‚Œã°è‰¯ã„ã€‚ã“ã‚Œã§10å¹´é–“(3650æ—¥)æœ‰åŠ¹ãªã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ãŒã§ãã‚ãŒã‚‹ã€‚ $ openssl genrsa 2048 > server.key $ openssl req -new -key server.key > server.csr $ openssl x509 -days 3650 -req -signkey server.key < server.csr > server.crtã§ãã‚ãŒã£ãŸserver.crtã¨server.keyã‚’ã€ä¾‹ãˆã°/etc/httpd/conf/ é…ä¸‹ã®ssl.crt/ ã¨ ssl.key/ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«è¨ç½®
ionis 2015/03/05
ssl

è§£èª¬

openSSL

è¨¼æ˜Žæ›¸
ãƒªãƒ³ã‚¯
1