[B! SSL] midnightseminarã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

midnightseminar id:midnightseminar

SSLã«é–¢ã™ã‚‹midnightseminarã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

å€‹äººè¨¼æ˜Žæ›¸ã‚’ä½œã‚ã†ï½žS/MIMEã§ãƒ¡ãƒ¼ãƒ«ã«é›»åç½²åã¨æš—å·åŒ–ã‚’ã€ã‚µãƒ¼ãƒãƒ¼ã«ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆèªè¨¼ã‚’ï½ž
ï½žS/MIMEã§ãƒ¡ãƒ¼ãƒ«ã«é›»åç½²åã¨æš—å·åŒ–ã‚’ã€ã‚µãƒ¼ãƒãƒ¼ã«ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆèªè¨¼ã‚’ï½ž å€‹äººè¨¼æ˜Žæ›¸ã‚’ä½œæˆã—ã¾ã—ã‚‡ã†ã€‚ ã“ã®å€‹äººè¨¼æ˜Žæ›¸ã§é›»åãƒ¡ãƒ¼ãƒ«ã®ä»£è¡¨çš„ãªæš—å·åŒ–æ–¹å¼S/MIME(Secure MIME)ã‚’åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ Postfixã®SSLåŒ–ã§ã‚‚ãƒ¡ãƒ¼ãƒ«ã®æš—å·åŒ–ã¯è¡Œã‚ã‚Œã¾ã—ãŸãŒã€S/MIMEã¨ã¯æœ¬è³ªãŒé•ã„ã¾ã™ã€‚ ãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ãƒãƒ¼ã®SSLåŒ–ã¨ã„ã†ã®ã¯ã€ã‚ãã¾ã§ã‚‚ãƒ¡ãƒ¼ãƒ«çµŒè·¯ã®æš—å·åŒ–ã«éŽãŽã¾ã›ã‚“ã€‚ ã§ã™ã‹ã‚‰ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ã‚µãƒ¼ãƒãƒ¼é–“ã¯æš—å·åŒ–ã§ãã¾ã™ãŒã€ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ç›¸æ‰‹ã‚µãƒ¼ãƒãƒ¼ã€ç›¸æ‰‹ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ãƒ¡ãƒ¼ãƒ«ã®é€ä¿¡ç›¸æ‰‹ã¾ã§ã®çµŒè·¯ã¯æš—å·åŒ–ã•ã‚Œã¦ã„ãªã‹ã£ãŸã‚ã‘ã§ã™ã€‚ ã“ã‚Œã«å¯¾ã—S/MIMEã®å ´åˆã¯ãƒ¡ãƒ¼ãƒ«ãã®ã‚‚ã®ã‚’æ·»ä»˜ãƒ•ã‚¡ã‚¤ãƒ«ã¾ã§å«ã‚ã¦æš—å·åŒ–ã—ã¾ã™ã‹ã‚‰ã€ç›¸æ‰‹ãŒå¾©å·ã™ã‚‹ã¾ã§ã¯å®Œå…¨ã«æš—å·åŒ–ã•ã‚Œã¦ã„ã¾ã™ã€‚ S/MIMEã‚’åˆ©ç”¨ã§ãã‚Œã°ã€ãƒ¡ãƒ¼ãƒ«æœ¬æ–‡ã«é–¢ã—ã¦ã¯Postfixã®SSLåŒ–ã¯å¿…è¦ãªã„ã¨è¨€ãˆã¾ã™ã€‚ï¼ˆã§ã‚‚SMTP-AUT
midnightseminar 2015/12/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

PKI
ãƒªãƒ³ã‚¯
ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’opensslã§ä½œã‚‹ï¼ˆè©³ç´°ç‰ˆï¼‰ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
å‰å›žã®opensslã§RSAæš—å·ã¨éŠã¶ã§RSAæš—å·ã‚„ç§˜å¯†éµã«ã¤ã„ã¦ä¸èº«ã‚’è‰²ã€…ã¨ã„ã˜ã£ã¦ã¿ãŸã€‚ç¶šã„ã¦ä»Šå›žã¯ã€Apacheã§ä½¿ã†ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œã£ã¦ã¿ã‚‹ã€‚ ç´°ã‹ã„ã“ã¨ã¯ã„ã„ã‹ã‚‰ã€ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’ä½œã‚‹ã‚³ãƒžãƒ³ãƒ‰ã ã‘çŸ¥ã‚ŠãŸã„ ãŠæ€¥ãŽã®æ–¹ã¯ã€ä»¥ä¸‹3ã¤ã ã‘ã‚„ã‚Œã°è‰¯ã„ã€‚ã“ã‚Œã§10å¹´é–“(3650æ—¥)æœ‰åŠ¹ãªã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ãŒã§ãã‚ãŒã‚‹ã€‚ $ openssl genrsa 2048 > server.key $ openssl req -new -key server.key > server.csr $ openssl x509 -days 3650 -req -signkey server.key < server.csr > server.crtã§ãã‚ãŒã£ãŸserver.crtã¨server.keyã‚’ã€ä¾‹ãˆã°/etc/httpd/conf/ é…ä¸‹ã®ssl.crt/ ã¨ ssl.key/ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã«è¨ç½®
midnightseminar 2015/12/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

PKI
ãƒªãƒ³ã‚¯
opensslã§RSAæš—å·ã¨éŠã¶ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
opensslã¨RSAæš—å·ã«ã¤ã„ã¦ã¡ã‚‡ã£ã¨èª¿ã¹ã¦ã¿ã‚ˆã†ã‹ãªã€ã¨æ€ã£ãŸã€‚ ã¾ãšRSAæš—å·ã¨ã¯ã€ å…¬é–‹éµæš—å·æ–¹å¼ã®å®Ÿè£…ã®ã²ã¨ã¤ã§ã‚ã‚‹ 2ã¤ã®ç´ æ•°ã®ç©(ã‚±ã‚¿æ•°ãŒå¤§ãã„å ´åˆã®ç´ å› æ•°åˆ†è§£ã®å›°é›£ã•)ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ ã£ã¦ã“ã¨ã‚’ç†å±ˆã¨ã—ã¦ã¯ç†è§£ã—ã¦ã„ã‚‹ã‘ã©ã€å®Ÿéš›ã«opensslã‚³ãƒžãƒ³ãƒ‰ã§ä½œã£ãŸéµãƒ•ã‚¡ã‚¤ãƒ«ã®ä¸èº«ãŒã©ã†ãªã£ã¦ã„ã‚‹ã®ã‹? ã¨ã„ã†ã“ã¨ã¾ã§è¸ã¿è¾¼ã‚“ã ã“ã¨ãŒç„¡ã‹ã£ãŸã€‚ ã¨ã„ã†ã‚ã‘ã§ã€ã¡ã‚‡ã£ã¨ãã®è¾ºã‚’ã‚³ãƒžãƒ³ãƒ‰å©ããªãŒã‚‰éŠã‚“ã§ã¿ã‚‹ã“ã¨ã«ã™ã‚‹ã€‚ ã¯ã˜ã‚ã«ï¼šopensslã®æ“ä½œã«ã¤ã„ã¦ opensslã‚³ãƒžãƒ³ãƒ‰ã¯å¢—ç¯‰ã«å¢—ç¯‰ã‚’é‡ãã™ãŽã¦ãŠã‚Šã€ã‚‚ã¯ã‚„ãã³ãˆç«‹ã¤Ã—Ã—ã®ã‚ˆã†ã§ã‚ã‚‹ã€‚ãƒ¤ãƒ´ã‚¡ã„ã“ã¨ã«ãªã£ãŸãƒ¬ãƒ™ãƒ«ã§æ©Ÿèƒ½ã¦ã‚“ã“ç››ã‚Šã®ã‚³ãƒžãƒ³ãƒ‰ãªã®ã§ã€ã‚µãƒ–ã‚³ãƒžãƒ³ãƒ‰ã¨ã—ã¦æ©Ÿèƒ½åã‚’æŒ‡å®šã—ã¦ä½¿ã†ã“ã¨ã«ãªã‚‹ã€‚ openssl command [ command_opts ] [ command_args ]ä¸Šä¾‹ã®ã€Œcommandã€ã«ã¯ã€R
midnightseminar 2015/12/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

PKI
ãƒªãƒ³ã‚¯
ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
midnightseminar 2015/12/02
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

â˜…â˜…
ãƒªãƒ³ã‚¯
Androidã‚¢ãƒ—ãƒªã®å¤šãã«SSLã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ - MITMæ”»æ’ƒãŒå¯èƒ½ãªçŠ¶æ…‹
FireEyeã¯8æœˆ20æ—¥(ç±³å›½æ™‚é–“)ã€ã€ŒSSL Vulnerabilities: Who listens when Android applications talk?ï½œFireEye Blogã€ã«ãŠã„ã¦ã€äººæ°—ã®ã‚ã‚‹Androidã‚¢ãƒ—ãƒª1,000å€‹ã«é–¢ã—ã¦èª¿æŸ»ã‚’å®Ÿæ–½ã—ãŸã¨ã“ã‚ã€ãã®ã†ã¡ç´„68%ã«SSLé–¢é€£ã®ä½•ã‚‰ã‹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ãŒå˜åœ¨ã—ã¦ã„ãŸã¨ä¼ãˆãŸã€‚ã“ã‚Œã‚‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ã‚’åˆ©ç”¨ã•ã‚Œã‚‹ã¨Man-in-the-Middleæ”»æ’ƒ(MITM)ã‚’å—ã‘ã‚‹å±é™ºæ€§ãŒã‚ã‚‹ã¨ã•ã‚Œã¦ã„ã‚‹ã€‚ ã‚¢ãƒ—ãƒªã®ä¸ã«ã¯æ©Ÿèƒ½ã‚„åˆ©ä¾¿æ€§ã‚’å„ªå…ˆã•ã›ã‚‹ãŸã‚ã«ãƒ›ã‚¹ãƒˆåã®ãƒã‚§ãƒƒã‚¯ã‚’ç„¡åŠ¹ã«ã—ã¦ã„ã‚‹ã‚‚ã®ãŒã‚ã£ãŸã‚ŠSSLé–¢é€£ã®ã‚¨ãƒ©ãƒ¼ã‚’ç„¡è¦–ã—ã¦ã„ã‚‹ã‚‚ã®ãŒã‚ã£ãŸã¨èª¬æ˜ŽãŒã‚ã‚‹ã€‚Man-in-the-Middleæ”»æ’ƒã‚’å—ã‘ã‚‹ã¨ã€æ”»æ’ƒè€…ã¯é€šä¿¡å†…å®¹ã‚’å‚å—ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã»ã‹ã€æŽ¥ç¶šå…ˆã‚’ã»ã‹ã®ã‚µã‚¤ãƒˆã¸å¤‰æ›´ã™ã‚‹ã¨ã„ã£ãŸã“ã¨ãŒã§ãã‚‹ã€‚ è¨˜äº‹ã§ã¯ã“ã†ã—ãŸå•
midnightseminar 2014/08/26
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

Android
ãƒªãƒ³ã‚¯
å²ä¸Šæœ€æ‚ªã®ãƒãƒƒãƒˆã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å±æ©Ÿã¨é¨’ãŒã‚Œã¦ã‚‹ã€ŒHeartbleedã€å•é¡Œã«é–¢ã™ã‚‹ãƒ¡ãƒ¢ï¼ˆã‚ˆãã‚ã‹ã£ã¦ã„ãªã„ç´ äººãƒ¬ãƒ™ãƒ«ï¼‰ - The Midnight Seminar
â€»2014/4/15 ã™ã“ã—è¿½è¨˜ æ•°æ—¥å‰ã‹ã‚‰è©±é¡Œã«ãªã‚Šã¾ãã£ã¦ã„ã‚‹ã‚ˆã†ã«ã€Heartbleedã¨å‘¼ã°ã‚Œã‚‹ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆå²ä¸Šæœ€æ‚ªã¨ã‚‚ã„ã‚ã‚Œã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å±æ©ŸãŒèµ·ãã¦ã„ã‚‹ã‚‰ã—ã„ã€‚ ç§ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æŠ€è¡“ã‚’ã‚ˆãåˆ†ã‹ã£ã¦ãªã„ã®ã§ã€å…·ä½“çš„ã«ä½•ãŒã‚„ã°ãã¦ä½•ã‚’ã—ãŸã‚‰ã„ã„ã®ã‹ãŒã‚ã¾ã‚Šç†è§£ã§ããªã„ã®ã ãŒã€æ”¾ç½®ã™ã‚‹ã®ã‚‚ã‚ã‚Œãªã®ã§ã€é–¢é€£ã™ã‚‹ä¸€èˆ¬å‘ã‘ã®è¨˜äº‹ã ã‘ã¯èªã‚“ã§ã¿ãŸã€‚ ã§ã€çµå±€ã®ã¨ã“ã‚ã€ã‚ã‚Œã‚ã‚Œã«ã§ãã‚‹ã“ã¨ã¨ã—ã¦ã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å¤‰ãˆã‚‹ãã‚‰ã„ã—ã‹å¯¾ç–ã¯ãªãã€ã‚ã¨ã¯å°†æ¥ã«å‘ã‘ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ„è˜ã‚’é«˜ã‚ã¾ã—ã‚‡ã†ãã‚‰ã„ã®ã“ã¨ã—ã‹è¨€ãˆãªã„ã¿ãŸã„ãªã®ã§ã€æ·±ãè€ƒãˆã‚‹ã®ã¯ã‚„ã‚ãŸã®ã ãŒã€ã¨ã‚Šã‚ãˆãšèªã‚“ã ã‚‚ã®ã«ã¤ã„ã¦ã¯ã¾ã¨ã‚ã¦ãŠãã“ã¨ã«ã—ãŸã€‚ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã®å‰åŠã¯ãƒªãƒ³ã‚¯ã®ç¾…åˆ—ã§ã™ãŒã€å¾ŒåŠã¯ãƒ‰ç´ äººãŒè‡ªåˆ†ã®å¤§ã¾ã‹ãªç†è§£ã‚’ç¢ºèªã™ã‚‹ãŸã‚ã«æ›¸ã„ã¦ã‚‹ã‚ˆã†ãªæ„Ÿã˜ãªã®ã§ã€å†…å®¹ã¯ä¿¡ç”¨ã—ãªã„ã§ã€å°‚é–€å®¶ã®èª¬æ˜Žã‚’èªã¿ã«ã„ã£ã¦ãã ã•ã„ã€‚*1 ã¾ãšã€ã¨ã«ã‹
midnightseminar 2014/04/13
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Heartbleed

ã˜è‡ªåˆ†

SSL
ãƒªãƒ³ã‚¯
ã‚¦ã‚§ãƒ–ã‚’è¥²ã£ãŸæœ€æ‚ªã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç½å®³ã€ŒHeartbleedã€ã‹ã‚‰è‡ªåˆ†ã®èº«ã‚’å®ˆã‚‹æ–¹æ³• | readwrite.jp
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã§ã®è²·ã„ç‰©ã‚„è²¡ç”£ç®¡ç†ã€é›»åãƒ¡ãƒ¼ãƒ«ã®é€å—ä¿¡ãªã©ã«ãŠã‘ã‚‹ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ã‚’å®ˆã£ã¦ãã‚Œã‚‹ã¯ãšã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚½ãƒ•ãƒˆã«é–¢ã™ã‚‹é‡å¤§ãªãƒã‚°ã€ã€ŒHeartbleedã€ãŒæœ€è¿‘ç™ºè¦‹ã•ã‚ŒãŸã€‚ä»Šã®ã¨ã“ã‚ã€ã“ã®ãƒã‚°ã«ã‚ˆã‚‹å®Ÿéš›ã®ãƒ•ã‚¡ã‚¤ãƒŠãƒ³ã‚¹æƒ…å ±ã‚„ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ãã®ä»–ã«é–¢ã™ã‚‹å‚å—ã‚„ç›—é›£ã«ç¹‹ãŒã‚‹ã‚ˆã†ãªè¢«å®³ã¯å ±å‘Šã•ã‚Œã¦ã„ãªã„ãŒã€æã‚‰ããã‚Œã¯æ™‚é–“ã®å•é¡Œã ã€‚ è‰¯ã„ãƒ‹ãƒ¥ãƒ¼ã‚¹ã¯ã€ã“ã†ã—ãŸå‚å—ã‚„ç›—é›£ã‹ã‚‰è‡ªåˆ†ã®æƒ…å ±ã‚’ä¿è·ã™ã‚‹æ–¹æ³•ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ã€‚æ‚ªã„ãƒ‹ãƒ¥ãƒ¼ã‚¹ã¯ã€ãã‚Œã‚‰ã®å¯¾ç–ã¯å˜ç´”ã ãŒå¿…ãšã—ã‚‚ç°¡å˜ã§ã¯ãªã„ã¨ã„ã†ã“ã¨ã ã€‚ ãªãœ Heartbleed ã¯æ·±åˆ»ãªã®ã‹ã¾ãšç°¡å˜ã«èƒŒæ™¯ã‚’èª¬æ˜Žã—ã‚ˆã†ã€‚ãƒãƒƒã‚«ãƒ¼ãªã©ã®æ”»æ’ƒè€…ãŒ Heartbleed ãƒã‚°ã‚’æ‚ªç”¨ã—ãŸå ´åˆã€ã‚µã‚¤ãƒˆä¸Šã®ã‚¦ã‚§ãƒ–ãƒ»ã‚³ãƒŸãƒ¥ãƒ‹ã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä¿è·ã—ã¦ãã‚Œã‚‹ã¯ãšã®ã€OpenSSLã¨å‘¼ã°ã‚Œã‚‹ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®æš—å·åŒ–ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æŠ€è¡“ã‚’è¿‚å›žã§ãã¦ã—ã¾ã†ã€‚ã“ã®ãƒã‚°ã«ã‚ˆã£ã¦æ”»æ’ƒè€…ã¯ã‚¦ã‚§ãƒ–ã‚µ
midnightseminar 2014/04/12
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

Heartbleed
ãƒªãƒ³ã‚¯
ãƒãƒƒãƒˆä¸Šã®ã‚µã‚¤ãƒˆã®ç´„66ï¼…ãŒä½¿ç”¨ã™ã‚‹OpenSSLã«é‡å¤§ãªãƒã‚°ãŒç™ºè¦‹ã•ã‚Œã‚‹
By Nguyen Hung Vu ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã§æ¨™æº–çš„ã«åˆ©ç”¨ã•ã‚Œã‚‹æš—å·é€šä¿¡ãƒ—ãƒãƒˆã‚³ãƒ«ã®SSL/TLSã‚’å®Ÿè£…ã—ãŸã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒOpenSSLã€ã«ã€SSL/TLSã®æš—å·åŒ–ã«ã‚ˆã£ã¦ä¿è·ã•ã‚Œã¦ã„ã‚‹æƒ…å ±ãŒç‰¹æ®Šãªç’°å¢ƒä¸‹ã§ãªãã¦ã‚‚ç›—ã¾ã‚Œã¦ã—ã¾ã†è„†å¼±æ€§ãŒç™ºè¦šã—ã¾ã—ãŸã€‚ Heartbleed Bug http://heartbleed.com/ ã€ŒHeartbleed Bugã€ã¨åä»˜ã‘ã‚‰ã‚ŒãŸè„†å¼±æ€§ã¯ã€OpenSSLã®1.0.1ã‹ã‚‰1.0.1fã¾ã§ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ç™ºè¦‹ã•ã‚ŒãŸã‚‚ã®ã§ã€è„†å¼±æ€§ãŒæ‚ªç”¨ã•ã‚Œã‚‹ã¨ã€ã“ã‚Œã‚‰ã®OpenSSLã§ä¿è·ã•ã‚ŒãŸã‚·ã‚¹ãƒ†ãƒ ã®ãƒ¡ãƒ¢ãƒªãŒèª°ã§ã‚‚é–²è¦§ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ãƒ¡ãƒ¢ãƒªãŒé–²è¦§ã•ã‚Œã‚‹ã“ã¨ã«ã‚ˆã£ã¦ã€ã‚µãƒ¼ãƒ“ã‚¹ãƒ—ãƒãƒã‚¤ãƒ€ã‚’è˜åˆ¥ã—ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ãƒ»åå‰ãƒ»ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãªã©ã®æƒ…å ±ã‚’æš—å·åŒ–ã™ã‚‹ç§˜å¯†éµãŒå±é™ºã«ã•ã‚‰ã•ã‚Œã€æ‚ªæ„ã®ã‚ã‚‹æ”»æ’ƒè€…ãŒã‚µãƒ¼ãƒ“ã‚¹ã‚„ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ç›´æŽ¥é€šä¿¡ã‚’å‚å—ã—ãŸã‚Šã€ãƒ‡ãƒ¼
midnightseminar 2014/04/09
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

Heartbleed
ãƒªãƒ³ã‚¯
CVE-2014-0160 OpenSSL Heartbleed è„†å¼±æ€§ã¾ã¨ã‚ - ã‚ã‚‚ãŠãã°
å¿…è¦ãªæƒ…å ±ã¯ http://heartbleed.com/ ã«ã¾ã¨ã¾ã£ã¦ã„ã‚‹ã®ã§ã™ãŒã€è‹±èªžã ã—é•·ã„ã—ã£ã¦äººã®ãŸã‚ã«æ‰‹çŸã«ã¾ã¨ã‚ã¦ãŠãã¾ã™ã€‚ ã©ã†ã™ã‚Œã°ã„ã„ã®ã‹ OpenSSL 1.0.1ã€œ1.0.1fã‚’ä½¿ã£ã¦ã„ãªã‘ã‚Œã°ã‚»ãƒ¼ãƒ• ã‚ã¦ã¯ã¾ã‚‹å ´åˆã«ã¯ã€ä¸€åˆ»ã‚‚æ—©ããƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã—ã¦ã€ã‚µãƒ¼ãƒã”ã¨å†èµ·å‹•(ã‚ã‹ã‚‹ã²ã¨ã¯ã‚µãƒ¼ãƒ“ã‚¹å˜ä½ã§ã‚‚OKã€ãŸã ã—reloadã§ã¯ã ã‚ãªã“ã¨ã‚‚) SSLè¨¼æ˜Žæ›¸ã§ã‚µãƒ¼ãƒã‚’å…¬é–‹ã—ã¦ã„ã‚‹ãªã‚‰ã€ç§˜å¯†éµã‹ã‚‰ä½œã‚Šç›´ã—ã¦è¨¼æ˜Žæ›¸ã‚’å†ç™ºè¡Œã—ã€éŽåŽ»ã®è¨¼æ˜Žæ›¸ã‚’å¤±åŠ¹ã•ã›ã‚‹(æœ«å°¾ã«é–¢é€£ãƒªãƒ³ã‚¯ã‚ã‚Š)ã€‚ ã‚µãƒ¼ãƒã‚’å…¬é–‹ã—ã¦ã„ãªã„å ´åˆã‚‚ã€å¤–éƒ¨ã¸ã®SSLé€šä¿¡ãŒã‚ã‚Œã°å½±éŸ¿ã‚’å—ã‘ã‚‹ã®ã§ã€è©³ã—ãç²¾æŸ»ã™ã‚‹ã€‚ PFS(perfect forward secrecy)ã‚’åˆ©ç”¨ã—ã¦ã„ãªã„å ´åˆã€éŽåŽ»ã®é€šä¿¡å†…å®¹ã‚‚å¾©å·ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ãŸã‚ã€è©³ã—ãç²¾æŸ»ã™ã‚‹ã€‚ æ¼æ´©ã™ã‚‹æƒ…å ±ã®å…·ä½“ä¾‹ã¯ã€OpenSSLã®è„†å¼±æ€§ã§æƒ³å®šã•ã‚Œã‚‹ãƒªã‚¹ã‚¯ã¨ã—ã¦
midnightseminar 2014/04/09
SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Heartbleed

ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“
ãƒªãƒ³ã‚¯
3æ™‚é–“ã§åˆ†ã‹ã‚‹ã“ã‚Œã‹ã‚‰ã®é›»åèªè¨¼â€”Internet Week 2009ãƒ¬ãƒãƒ¼ãƒˆ | ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒãƒ¼å®Œå…¨ã‚¬ã‚¤ãƒ‰
midnightseminar 2012/04/27
PKI

SSL

ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“
ãƒªãƒ³ã‚¯
1