[B! SSL] no8410ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

no8410 id:no8410

SSLã«é–¢ã™ã‚‹no8410ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (15)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãªã‚‰çŸ¥ã£ã¦ãŠããŸã„ã€çµµã§è¦‹ã¦ã‚ã‹ã‚‹ã‚»ã‚ãƒ¥ã‚¢é€šä¿¡ã®åŸºæœ¬ - Qiita
TLS 1.3ã¯ç¾åœ¨ç–å®šä¸ã§ã™ãŒã€ å‰æ–¹ç§˜åŒ¿æ€§ ã®å•é¡Œã‹ã‚‰ RSAã®ã¿ ã‚’ç”¨ã„ãŸéµå§”å…±æœ‰ãŒç¦æ¢ã«ãªã‚‹è¦‹è¾¼ã¿ã§ã™ã€‚(è©³ç´°ã¯å¾Œè¿°ã—ã¾ã™) HTTPSã¨ã¯ æ¬¡ã«ã€HTTPSã§ã™ã€‚ HTTPS - Wikipedia HTTPSï¼ˆHypertext Transfer Protocol Secureï¼‰ã¯ã€HTTPã«ã‚ˆã‚‹é€šä¿¡ã‚’å®‰å…¨ã«ï¼ˆã‚»ã‚ãƒ¥ã‚¢ã«ï¼‰è¡Œã†ãŸã‚ã®ãƒ—ãƒãƒˆã‚³ãƒ«ãŠã‚ˆã³URIã‚¹ã‚ãƒ¼ãƒ ã§ã‚ã‚‹ã€‚ åŽ³å¯†ã«è¨€ãˆã°ã€HTTPSè‡ªä½“ã¯ãƒ—ãƒãƒˆã‚³ãƒ«ã§ã¯ãªãã€SSL/TLSãƒ—ãƒãƒˆã‚³ãƒ«ã«ã‚ˆã£ã¦æä¾›ã•ã‚Œã‚‹ ã‚»ã‚ãƒ¥ã‚¢ãªæŽ¥ç¶šã®ä¸Šã§HTTPé€šä¿¡ã‚’è¡Œã†ã“ã¨ ã‚’HTTPSã¨å‘¼ã‚“ã§ã„ã‚‹ã€‚ ã¨ã®ã“ã¨ã§ã™ã€‚ HTTPã®èª¬æ˜Žã‚’å‰²æ„›ã™ã‚‹ã¨ã™ã‚Œã°ã€ã€ŒSSL/TLSã§ã‚»ã‚ãƒ¥ã‚¢ã«HTTPã‚’ã‚„ã‚‹ã€ã¨ã„ã†ã ã‘ã®èª¬æ˜Žã§æ¸ˆã‚“ã§ã—ã¾ã„ã¾ã™ã€‚ æœ€è¿‘ã§ã¯å€‹äººæƒ…å ±ç‰ã®è¦³ç‚¹ã‹ã‚‰å…¨ã¦ã®ã‚µã‚¤ãƒˆã‚’HTTPSã«ã™ã‚‹ã‚ˆã†ãªå‹•ããŒè¦‹ã‚‰ã‚Œã¾ã™ãŒã€å…ƒã€…HTTPSãŒä½¿ã‚ã‚Œã‚„ã™ã‹ã£ãŸ
no8410 2016/08/03
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

HTTP

SSL

TLS
ãƒªãƒ³ã‚¯
Dellè£½PCã§ç¢ºèªã•ã‚ŒãŸeDellRootè¨¼æ˜Žæ›¸ã®é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
Dellè£½PCã§ç¢ºèªã•ã‚ŒãŸå‹æ‰‹ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸å•é¡Œï¼ˆSuperfish2.0ã¨ã‚‚å‘¼ç§°ã•ã‚Œã¦ã„ã‚‹ï¼‰ã®é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ Dellã®å…¬å¼è¦‹è§£ãƒ»ã‚µãƒãƒ¼ãƒˆæƒ…å ± æ›´æ–°ï¼šå¼Šç¤¾PCè¨¼æ˜Žæ›¸è„†å¼±æ€§ã«ã¤ã„ã¦ï¼ˆeDellRootè¨¼æ˜Žæ›¸ãªã‚‰ã³ã«DSDTestProviderè¨¼æ˜Žæ›¸ï¼‰ å¼Šç¤¾PCè¨¼æ˜Žæ›¸è„†å¼±æ€§ã«ã¤ã„ã¦ï¼ˆeDellRootè¨¼æ˜Žæ›¸ï¼‰ Dell System Detect Security Update Response to Concerns Regarding eDellroot Certificate Information on the eDellRoot certificate and how to remove it from your Dell PC Information on the eDellRoot and DSDTestProvider certificates and how to
no8410 2015/11/25
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL
ãƒªãƒ³ã‚¯
GoogleãŒWebã§ã®SHA-1ã®åˆ©ç”¨åœæ¢ã‚’æ€¥ãç†ç”± | POSTD
no8410 2015/02/04
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ssl
ãƒªãƒ³ã‚¯
SSL/TLSã‚’ç„¡æ–™ãƒ»ç°¡å˜ã«ã€Webå…¨ä½“ã®æš—å·åŒ–ã‚’ç›®æŒ‡ã™ã€ŒLet's Encryptã€ç™ºè¡¨
é›»åãƒ•ãƒãƒ³ãƒ†ã‚£ã‚¢è²¡å›£(Electronic Frontier Foundation: EFF)ã¯11æœˆ18æ—¥(ç±³å›½æ™‚é–“)ã€SSL/TLSã®æŽ¡ç”¨ã‚’ä¿ƒé€²ã™ã‚‹èªè¨¼äº‹æ¥è€…(CA)ã‚¤ãƒ‹ã‚·ã‚¢ãƒãƒ–ã€ŒLet's Encryptã€ã‚’ç™ºè¡¨ã—ãŸã€‚ãƒ‰ãƒ¡ã‚¤ãƒ³æ‰€æœ‰è€…ãŒç°¡å˜ãªãƒ—ãƒã‚»ã‚¹ã§DVè¨¼æ˜Žæ›¸ã®ç™ºè¡Œã‚’ç„¡æ–™ã§å—ã‘ã‚‰ã‚Œã‚‹ã‚ˆã†ã«ã—ã€Webã‚¢ã‚¯ã‚»ã‚¹ã§ã‚„ã‚Šå–ã‚Šã™ã‚‹å…¨ã¦ã®ãƒ‡ãƒ¼ã‚¿ã®æš—å·åŒ–å®Ÿç¾ã‚’ç›®æŒ‡ã™ã€‚2015å¹´å¤ã«é‹ç”¨é–‹å§‹ã™ã‚‹äºˆå®šã€‚ Letâ€™s Encryptã¯ã€Mozillaã€Cisco Systemsã€Akamai Techno logiesã€EFFã€IdenTrustã€ãƒŸã‚·ã‚¬ãƒ³å¤§å¦ã®ç ”ç©¶è€…ãªã©ã«ã‚ˆã‚‹å”åŒã®å–ã‚Šçµ„ã¿ã§ã€æ–°ãŸã«è¨ç«‹ã•ã‚ŒãŸéžå–¶åˆ©çµ„ç¹”Internet Security Research Group (ISRG)ã«ã‚ˆã£ã¦é‹å–¶ã•ã‚Œã‚‹ã€‚ ãªã‚Šã™ã¾ã—ã‚„ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°ã€å€‹äººãƒ‡ãƒ¼ã‚¿ã®ç›—ç”¨ã‚„æ‚ªç”¨ã¨ã„ã£ãŸè¢«å®³ã‚’æ¸›ã‚‰ã™ãŸã‚ã«ã€SSL/TL
no8410 2014/11/19
SSL

TLS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§(CVE-2014-3511)ã§TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®åŸºç¤Žã‚’å¦ã¶ - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã«ã€ æ˜¨æ—¥ OpenSSLã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã€ï¼™ã¤ã®è„†å¼±æ€§ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã®æ•°æ—¥å‰ã«OpenSSLã®æ¬¡æœŸãƒªãƒªãƒ¼ã‚¹äºˆå‘ŠãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã¦ã„ã¾ã—ãŸãŒã€ã¡ã‚‡ã†ã© BlackHat é–‹å‚¬åˆæ—¥ã«ã‚ãŸã‚‹ã“ã¨ã‚‚ã‚ã‚Šã€ãªã‚“ã‹ã¾ãŸé‡å¤§ãªè„†å¼±æ€§ã®ä¿®æ£ãŒå…¥ã‚‹ã‚“ã˜ã‚ƒãªã„ã‹ã¨ãƒ‰ã‚ãƒ‰ã‚ã—ã¦ã„ã¾ã—ãŸã€‚è“‹ã‚’é–‹ã‘ã¦ã¿ã‚‹ã¨HeatBleedç¨‹ã®å¤§äº‹ã§ã¯ãªããƒ›ãƒƒãƒˆã²ã¨å®‰å¿ƒã§ã™ã€‚ æ˜¨æ—¥å…¬é–‹ã•ã‚ŒãŸOpenSSLã®ï¼™ã¤ã®è„†å¼±æ€§ã®ã†ã¡ã€TLS ãƒ—ãƒãƒˆã‚³ãƒ«ãƒ€ã‚¦ãƒ³ã‚°ãƒ¬ãƒ¼ãƒ‰æ”»æ’ƒ (CVE-2014-3511)ã®ä¿®æ£ã‚’è¦‹ã¦ã„ãŸã¨ã“ã‚ã€ã“ã‚Œã¯TLSãƒ—ãƒãƒˆã‚³ãƒ«ã‚’å¦ã¶ã„ã„é¡Œæã«ãªã‚‹ãªãã¨ãµã¨æ€ã„ã¤ãã€è©¦ã—ã«ã“ã®Opensslã®è„†å¼±æ€§ã®è©³ç´°ã‚’TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®åŸºç¤Žã«åˆã‚ã›ã¦æ›¸ã„ã¦ã¿ã¾ã—ãŸã€‚ ã¡ã‚‡ã£ã¨é•·ã„ã§ã™ãŒã€TLSãƒ—ãƒãƒˆã‚³ãƒ«ã®ä»•çµ„ã¿ï¼ˆã®ä¸€éƒ¨ï¼‰ã‚’çŸ¥ã‚ŠãŸã„æ–¹ã¯ãŠèªã¿ãã ã•ã„ã€‚ 2. OpenSSLã®è„†å¼±æ€§
no8410 2014/08/08
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

TLS

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§ã§æƒ³å®šã•ã‚Œã‚‹ãƒªã‚¹ã‚¯ - ã‚ã‚‚ãŠãã°
JVNã‚„JPCERT/CCã®è¨˜äº‹ãŒã‚ã¾ã‚Šã«ã‚‚ã•ã‚‰ã£ã¨æ›¸ã‹ã‚Œã¦ã„ã¦ã€å…·ä½“çš„ãªãƒªã‚¹ã‚¯ãŒæƒ³åƒã—ã¥ã‚‰ã„ã¨æ€ã†ã®ã§èª¬æ˜Žã—ã¾ã™ã€‚ ä»ŠåŒ—ç”£æ¥ (ä»Šãƒ‹ãƒ¥ãƒ¼ã‚¹è¦‹ã¦æ¥ãŸã‹ã‚‰ä¸‰è¡Œã§æ•™ãˆã¦æ¬²ã—ã„ã¨ã„ã†äººå‘ã‘ã®ã¾ã¨ã‚) ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã®ã€Œæš—å·åŒ–ã€ã«ä½¿ã‚ã‚Œã¦ã„ã‚‹OpenSSLã¨ã„ã†ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒ2å¹´é–“å£Šã‚Œã¦ã„ã¾ã—ãŸã€‚ ã“ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯ä¾¿åˆ©ãªã®ã§ã€Facebookã ã¨ã‹YouTubeã ã¨ã‹ã€ã‚ã¡ã“ã¡ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã§ä½¿ã£ã¦ã„ã¾ã—ãŸã€‚ ä»–ã®äººã®å…¥åŠ›ã—ãŸIDã¨ã‹ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¨ã‹ã‚¯ãƒ¬ã‚«ç•ªå·ã¨ã‹ã‚’ã€æ‚ªã„äººãŒè¦‹ã‚‹ã“ã¨ãŒã§ãã¦ã—ã¾ã„ã¾ã™ã€‚(å®Ÿéš›ã«æ¼ã‚Œã¦ã‚‹ä¾‹) ä»–ã«ã‚‚è‰²ã€…æ¼ã‚Œã¦ã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ä»¥å¤–ã®äººãŒè¦šãˆã¦ãŠãã¹ãã¯ã“ã“ã¾ã§ã§OKã§ã™ã€‚ã‚‚ã†å°‘ã—åˆ†ã‹ã‚Šã‚„ã™ã„æƒ…å ±ãŒä»¥ä¸‹ã«ã‚ã‚Šã¾ã™ã€‚ OpenSSL ã®è„†å¼±æ€§ã«å¯¾ã™ã‚‹ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆåˆ©ç”¨è€…ï¼ˆä¸€èˆ¬ãƒ¦ãƒ¼ã‚¶ï¼‰ã®å¯¾å¿œã«ã¤ã„ã¦ ã¾ã ç›´ã£ã¦ã„ãªã„ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚‚ã‚ã‚Œã°ã€å…ƒã€…å£Šã‚Œã¦ã„ãªã„ã‚¦ã‚§ãƒ–
no8410 2014/04/10
OpenSSL

SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security
ãƒªãƒ³ã‚¯
Heart Bleedã‚’èªã‚“ã - The first cry of Atom
int dtls1_process_heartbeat(SSL *s) { unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned short hbtype; unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ heartbeatã¨ã„ã†æ©Ÿèƒ½ã®è©³ã—ã„ã“ã¨ã¯èª¿ã¹ã‚‰ã‚Œã¦ã„ãªã„ã‘ã‚Œã©ã©ã†ã‚„ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ¼ã‚µãƒ¼ãƒåž‹ã®æ©Ÿèƒ½ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚ ã¤ã¾ã‚Šä½•ã‚‰ã‹ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘å–ã£ã¦ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’è¿”ã™ã‚ˆã†ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚dtls1_process_heartbeatã§å¤§äº‹ãªã®ã¯ ãƒã‚¤ãƒ³ã‚¿pã ã€‚ã“ã‚Œã¯ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã‚’å—ã‘å–ã£ã¦æ ¼ç´ã—ã¦ã„ã‚‹ã€‚ã“ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã¯æ§‹é€ ä½“ã«ãªã£ã¦ã„ã¦ã€ä»¥ä¸‹ã®ã‚ˆã†ã«è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ã€‚ typedef struct
no8410 2014/04/09
SSL

security

openssl
ãƒªãƒ³ã‚¯
Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping
Hundreds of open source packages, including the Red Hat, Ubuntu, and Debian distributions of Linux, are susceptible to attacks that circumvent the most widely used techno logy to prevent eavesdropping on the Internet, thanks to an extremely critical vulnerability in a widely used cryptographic code library. The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer
no8410 2014/03/05
Linux

SSL

TLS
ãƒªãƒ³ã‚¯
Appleå²ä¸Šæœ€æ‚ªã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚°ã‹ã€iOSã¨OS Xã®SSLæŽ¥ç¶šã«å±é™ºã™ãŽã‚‹è„†å¼±æ€§ãŒç™ºè¦šâ”€â”€åŽŸå› ã¯ã‚¿ã‚¤ãƒ—ãƒŸã‚¹ï¼Ÿ
Appleã¯21æ—¥ã€iOSã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆ7.0.6ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€‚ iOS 7.1ãŒæ—©ã‘ã‚Œã°3æœˆä¸æ—¬ã«ã‚‚ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹ã¨ã¿ã‚‰ã‚Œã¦ã„ãŸãŒã€SSLæŽ¥ç¶šã®æ¤œè¨¼ã«é–¢ã—ã¦ã€åŠæœˆä»¥ä¸Šã‚‚å¾…ã¤ã“ã¨ãŒã§ããªã„é‡å¤§ãªãƒã‚°ãŒè¦‹ã¤ã‹ã£ãŸãŸã‚ã ã€‚ SSLã¨ã¯ã€ã€Œã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã§å…¥åŠ›ã™ã‚‹å€‹äººæƒ…å ±ã‚„ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ãªã©ã‚’æš—å·åŒ–ã—ã€å®‰å…¨ã«é€å—ä¿¡ã™ã‚‹æŠ€è¡“ã€ï¼ˆSymantecï¼‰ã ã€‚ãƒ‡ãƒ¼ã‚¿ã‚’å®‰å…¨ã«ã‚„ã‚Šã¨ã‚Šã™ã‚‹ãŸã‚ã«åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹éžå¸¸ã«é‡è¦ãªæŠ€è¡“ã¨ãªã£ã¦ã„ã‚‹ã€‚ ãã—ã¦ä»Šå›žã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆï¼ˆãƒ¦ãƒ¼ã‚¶å´ï¼‰ã¨ã‚µãƒ¼ãƒï¼ˆã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆå´ï¼‰ã®é–“ã‚’SSLæŽ¥ç¶šã™ã‚‹éš›ã®ãƒ—ãƒã‚°ãƒ©ãƒ ã«ã€ã€ŒBASICåˆå¿ƒè€…ã§ã‚‚ä¸€ç›®ã§åˆ†ã‹ã‚‹ã‚ˆã†ãªãƒŸã‚¹ã€ï¼ˆWiredï¼‰ãŒè¦‹ã¤ã‹ã‚Šã€ä¿®æ£ã•ã‚Œã‚‹ã“ã¨ã«ãªã£ãŸã‚ˆã†ã ã€‚ãƒŸã‚¹ãŒã‚ã£ãŸã®ã¯ã€ä»¥ä¸‹ã®éƒ¨åˆ†ã€‚ AppleãŒå…¬é–‹ã—ã¦ã„ã‚‹ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ ã€Œgoto fail;ã€ãŒ2è¡Œç¶šã‘ã¦è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ç®‡æ‰€ã«æ³¨ç›®ã—ã¦ã»ã—ã„ã€‚2è¡Œç›®ã®ã€Œgot
no8410 2014/02/24
SSL

Apple

ios
ãƒªãƒ³ã‚¯
ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ã®è£ã§èµ·ãã¦ã„ãŸSSLç§˜å¯†éµã‚’å·¡ã‚‹æˆ¦ã„:Geekãªãºãƒ¼ã˜
ä»Šæœˆ7æ—¥ã‹ã‚‰9æ—¥ã«ã‚¢ãƒªã‚¾ãƒŠå·žã§é–‹å‚¬ã•ã‚ŒãŸNANOG 59ã§ã€Ladar Levisonæ°ãŒFBIã«ã‚µãƒ¼ãƒ“ã‚¹å…¨ä½“ã®SSLç§˜å¯†éµã‚’è¦æ±‚ã•ã‚ŒãŸè©±ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚ Ladar Levisonæ°ãŒé‹å–¶ã—ã¦ã„ãŸã€Lavabitã¨ã„ã†é›»åãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ãƒ“ã‚¹ã¯ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ã«é–¢é€£ã—ã¦çªå¦‚8æœˆ8æ—¥ã«é–‰éŽ–ã•ã‚Œã¦ã„ã¾ã™ã€‚ é–‰éŽ–æ™‚ã«ã¯è©³ç´°ãŒæ›¸ã‹ã‚Œã¦ãŠã‚‰ãšã€æ§˜ã€…ãªæ†¶æ¸¬ãŒèªžã‚‰ã‚Œã¦ã„ã¾ã—ãŸãŒã€ä¸–ç•Œä¸ã‹ã‚‰å¤šæ•°ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒé›†ã¾ã‚‹NANOGã§ã€ãã®ä¸€éƒ¨å§‹çµ‚ãŒèªžã‚‰ã‚Œã¾ã—ãŸã€‚ ã“ã®ç™ºè¡¨ã¯ã€NANOG 59ãŒé–‹å§‹ã•ã‚Œã‚‹å‰ã®é€±ã«ã€è£åˆ¤æ‰€ãŒèª¿æŸ»å¯¾è±¡ã®æ°åä»¥å¤–ã‚’æ©Ÿå¯†è§£é™¤ã—ãŸã“ã¨ã«ã‚ˆã£ã¦å®Ÿç¾ã—ã¦ã„ã¾ã™ã€‚ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã§æä¾›ã•ã‚Œã¦ã„ã‚‹ã‚µãƒ¼ãƒ“ã‚¹äº‹æ¥è€…ã«SSLç§˜å¯†éµã‚’æå‡ºã•ã›ã€ã‹ã¤ã€ãã®äº‹å®Ÿã®å…¬è¡¨ãŒé•æ³•è¡Œç‚ºã¨ãªã‚‹ã‚ˆã†ã«ã•ã‚Œã¦ã—ã¾ã£ã¦ã„ã‚‹ä¸€æ–¹ã§ã€ã“ã†ã„ã£ãŸå†…å®¹ã‚’å…¬çš„ã«èªžã‚Œã‚‹ã‚ˆã†ã«è£åˆ¤æ‰€ã§æˆ¦ã£ã¦ã€å®Ÿéš›ã«ãã‚Œã‚’å‹ã¡å–ã‚‹ã¨ã„ã†ã®ã¯å‡„
no8410 2013/10/18
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆ

SSL
ãƒªãƒ³ã‚¯
JVNVU#94916481: HTTPS ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‹ã‚‰æš—å·åŒ–ã•ã‚ŒãŸãƒ‡ãƒ¼ã‚¿ã®ä¸€éƒ¨ã‚’æŽ¨æ¸¬å¯èƒ½ãªè„†å¼±æ€§ (BREACH)
åœ§ç¸®ã•ã‚ŒãŸ HTTPS ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã®é•·ã•ã‚’è¦³æ¸¬ã™ã‚‹ã“ã¨ã§ã€æ”»æ’ƒè€…ã¯ HTTPS ã‚¹ãƒˆãƒªãƒ¼ãƒ ã®æš—å·æ–‡ã‹ã‚‰ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®èªè¨¼éµãªã© (secret) ã‚’æŽ¨æ¸¬ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ã€‚ Salesforce.com ã® Angelo Prado æ°ã¯ã€ä¸‹è¨˜ã®é€šã‚Šå ±å‘Šã—ã¦ã„ã¾ã™ã€‚ Extending the CRIME vulnerability presented at Ekoparty 2012, an attacker can target HTTPS responses to recover data from the response body. While the CRIME attack is currently believed to be mitigated by disabling TLS/SSL/level compression, compressed HTTP respons
no8410 2013/08/06
SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãƒ™ãƒªã‚µã‚¤ãƒ³ã€RSAã‚ˆã‚Šã‚‚è² è·ãŒè»½ã„ECCï¼ˆæ¥•å††æ›²ç·šæš—å·ï¼‰ã‚’SSLè¨¼æ˜Žæ›¸ã«æŽ¡ç”¨
æ—¥æœ¬ãƒ™ãƒªã‚µã‚¤ãƒ³ã¯2013å¹´2æœˆ14æ—¥ã€SSLã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ç™ºè¡Œã‚µãƒ¼ãƒ“ã‚¹ã€Œãƒžãƒãƒ¼ã‚¸ãƒ‰PKI for SSLã€ã§é¸æŠžå¯èƒ½ãªå…¬é–‹éµæš—å·æ–¹å¼ã‚’æ‹¡å……ã™ã‚‹ã¨ç™ºè¡¨ã—ãŸï¼ˆå†™çœŸï¼‰ã€‚2013å¹´ä¸ŠåŠæœŸï¼ˆ2æœˆ26æ—¥ã‚’ç›®æ¨™ï¼‰ã‹ã‚‰ã€å¾“æ¥ã®RSAï¼ˆç´ å› æ•°åˆ†è§£ã«ã‚ˆã‚‹å…¬é–‹éµæš—å·æ–¹å¼ï¼‰ã«åŠ ãˆã¦ECCï¼ˆæ¥•å††æ›²ç·šã«ã‚ˆã‚‹å…¬é–‹éµæš—å·æ–¹å¼ï¼‰ã¨DSAï¼ˆé›¢æ•£å¯¾æ•°ã«ã‚ˆã‚‹å…¬é–‹éµæš—å·æ–¹å¼ï¼‰ã‚’é¸æŠžã§ãã‚‹ã‚ˆã†ã«ã™ã‚‹ã€‚ç™ºè¡Œæ–™é‡‘ã¯RSA/ECC/DSAã®ã„ãšã‚Œã‚‚é¸ã‚“ã§ã‚‚åŒä¸€ã§ã‚ã‚‹ã»ã‹ã€RSAè¨¼æ˜Žæ›¸ï¼ˆ1æžšï¼‰ã®ç™ºè¡Œæ–™é‡‘ã ã‘ã§RSA/ECC/DSAã®3ç¨®é¡žã®è¨¼æ˜Žæ›¸ï¼ˆ3æžšåˆ†ã®è¨¼æ˜Žæ›¸ï¼‰ã‚’åŒæ™‚ã«ç™ºè¡Œã§ãã‚‹ã€‚ RSAä»¥å¤–ã®å…¬é–‹éµæš—å·ã‚’ç”¨ã„ãŸè¨¼æ˜Žæ›¸ç™ºè¡Œã‚µãƒ¼ãƒ“ã‚¹ã¯ã€å•†ç”¨ã‚µãƒ¼ãƒ“ã‚¹ã¨ã—ã¦ã¯åˆã‚ã¦ã€ã¨ã—ã¦ã„ã‚‹ã€‚ECCã‚„DSAã®è¨¼æ˜Žæ›¸ã¯ã€ã“ã‚Œã‚‰ã‚’åˆ©ç”¨å¯èƒ½ãªSSLè£½å“ï¼ˆWebã‚µãƒ¼ãƒãƒ¼/Webãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ãªã©ï¼‰ã«ãŠã„ã¦åˆ©ç”¨ã§ãã‚‹ã€‚æ—¥æœ¬ãƒ™ãƒªã‚µã‚¤ãƒ³ã«ã‚ˆã‚Œã°ã€ç¾åœ¨ã®ä¸»è¦ãªWebã‚µãƒ¼ãƒãƒ¼/ãƒ–
no8410 2013/02/14
SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãªãœã‚ãªãŸãŒã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’HTTPSåŒ–ã™ã‚‹ã¨ã‚µã‚¤ãƒˆãŒé…ããªã£ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒé€ƒã’ã¦ã„ãã®ã‹ - å°„æ’ƒã—ã¤ã¤å‰è»¢ æ”¹
å®Œå…¨ã«é‡£ã‚Šã‚¿ã‚¤ãƒˆãƒ«ã§ã™ã‘ã©ä¸èº«ã¯çœŸé¢ç›®ã«æ›¸ãã‚ˆã€‚ è¿‘å¹´ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®HTTPSåŒ–ãŒæµè¡Œã®ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã€‚ç§ã®çŸ¥ã‚‹é™ã‚Šã€Googleã®å„ç¨®ã‚µãƒ¼ãƒ“ã‚¹ã‚„Twitterã€Facebookãªã©ãŒå®Œå…¨ã«HTTPSã§é€šä¿¡ã‚’è¡Œã†ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã€‚HTTPSã€ã¤ã¾ã‚ŠSSLã«ã‚ˆã‚‹é€šä¿¡ã®æš—å·åŒ–ã«ã‚ˆã£ã¦ã€ãƒ¦ãƒ¼ã‚¶ã«ã“ã‚Œã¾ã§ã‚ˆã‚Šã‚‚å®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’æä¾›ã§ãã‚‹ã€‚ ã—ã‹ã—ã€ã‚ãªãŸãŒä½œã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã‚’ãµã¨æ€ã„ã¤ãã§HTTPSåŒ–ã—ã¦ã—ã¾ã†ã¨ã€ãŸã¶ã‚“ã€ã“ã‚Œã¾ã§ã‚ˆã‚Šã‚‚ã‚µã‚¤ãƒˆãŒé…ããªã‚‹ã€‚ã“ã“ã§ã¯ã€HTTPSã§é€šä¿¡ã™ã‚‹å ´åˆã®å•é¡Œã‚’è§£èª¬ã™ã‚‹ã€‚ ãªãœé…ããªã‚‹ã®ã‹ HTTPã§é€šä¿¡ã™ã‚‹å ´åˆã€ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒã‚µãƒ¼ãƒã¸ã¨æŽ¥ç¶šã™ã‚‹ãŸã‚ã«ã¯TCP/IPã®3ã‚¦ã‚§ã‚¤ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã¨ã„ã†æ‰‹é †ãŒå¿…è¦ã«ãªã‚‹ã€‚ã‚ã‚“ã©ãã•ã„ã®ã§ã“ã“ã§ã¯è©³ã—ãã¯èª¬æ˜Žã—ãªã„ãŒã€è¦ã™ã‚‹ã«ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’æŠ•ã’ã‚‹å‰ã«ãƒ‘ã‚±ãƒƒãƒˆã‚’ï¼‘å¾€å¾©ã•ã›ãªã„ã¨ã„ã‘ãªã„ã®ã§ã‚ã‚‹ã€‚ãƒ‘ã‚±ãƒƒãƒˆã®å¾€å¾©
no8410 2013/01/08
SSL

ã‚µãƒ¼ãƒ

é€šä¿¡

ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
security:sslã¯æš—å·åŒ–ã®ãŸã‚ã®ã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ [TenForward]
<fs 150%><color red>@kfujieda ã•ã‚“ã«ã‚ˆã‚‹ã‚‚ã£ã¨è‰¯ã„ç¿»è¨³ãŒç™»å ´ã—ã¾ã—ãŸï¼Žå‹‰å¼·ã«ãªã‚Šã¾ã™ï¼Žã“ã®ãƒšãƒ¼ã‚¸ã®ã‚‚ã®ã‚ˆã‚Šãã¡ã‚‰ã‚’ã”å‚ç…§ãã ã•ã„ï¼Ž</color>â†’ SSL is not about encryption</fs> <color red>è¨€ã„è¨³ã«ãªã‚Šã¾ã™ãŒï¼Œã‚‚ã¡ã‚ã‚“è—¤æžã•ã‚“ã®ãŠã£ã—ã‚ƒã‚‹ã‚ˆã†ãªã€ŒSSLã®ä¸»ç›®çš„ã¯æš—å·åŒ–ã§ã¯ãªã„ã€ã¨ã„ã†ã®ã¯ç†è§£ã—ã¦ã„ã¾ã™ï¼Žãã“ã‚’ã‚ãˆã¦ä»Šå›žã®ã‚ˆã†ãªã‚¿ã‚¤ãƒˆãƒ«ã«è¨³ã—ãŸã®ã¯ç§ãªã‚Šã®è€ƒãˆãŒã‚ã£ã¦ã®ã“ã¨ã§ã™ï¼ŽãŸã ï¼Œã€Œç¿»è¨³ã€ã¨ã„ã†ã‚‚ã®ãŒæœŸå¾…ã•ã‚Œã‚‹ã‚‚ã®ã‹ã‚‰ã™ã‚‹ã¨ä¸é©å½“ã ã£ãŸã‹ã‚‚çŸ¥ã‚Œã¾ã›ã‚“ï¼Ž</color> <color red>è‡ªåˆ†ãŒé€šä¿¡ã‚’ã—ãŸã„ç›¸æ‰‹ã§ã‚ã‚‹ã“ã¨ãŒãã¡ã‚“ã¨ç¢ºèªãŒå–ã‚ŒãŸç›¸æ‰‹ã¨æš—å·åŒ–é€šä¿¡ã‚’è¡Œã‚ãªã„ã¨æ„å‘³ãŒãªã„ã¨æ€ã„ã¾ã™ãŒï¼Œã€Œæš—å·åŒ–ã•ã‚Œã¦ã‚‹ã‹ã‚‰ã„ã„ã§ã—ã‚‡ã€ã¨ã„ã†ã‚ˆã†ãªäº‹ã‚’ä»Šã¾ã§ä½•åº¦ã‹èžã„ãŸäº‹ãŒã‚ã‚Šï¼Œãã‚Œã¯é•ã†ã ã‚ã†ã¨æ€ã£ãŸäº‹ãŒã‚ã‚Šã¾ã™ï¼Žã“ã®
no8410 2012/08/09
è€ƒãˆæ–¹

SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Hackers break SSL encryption used by millions of sites
Researchers have discovered a serious weakness in virtually all websites protected by the secure sockets layer protocol that allows attackers to silently decrypt data that's passing between a webserver and an end-user browser. The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer techno logy that serves as the internet's
no8410 2012/07/27
security

SSL
ãƒªãƒ³ã‚¯
1