Neverbleed - RSAã®ç§˜å¯†éµæ¼”算を別プãƒã‚»ã‚¹ã«åˆ†é›¢ã™ã‚‹è©±æ©Ÿèƒ½æ¯Žã«ãƒ—ãƒã‚»ã‚¹ã‚’分割ã—ã€ãれらを別個ã®æ¨©é™ã®ã‚‚ã¨ã§å®Ÿè¡Œã™ã‚‹ã“ã¨ã§ã€è„†å¼±æ€§ãŒã‚ã£ãŸå ´åˆã®å½±éŸ¿ã‚’抑ãˆè¾¼ã‚€ã¨ã„ã†ã®ã¯ã€ä¸€å®šä»¥ä¸Šã®è¦æ¨¡ã‚’ã‚‚ã¤ãƒ—ãƒã‚°ãƒ©ãƒ ã§ã¯ã€ã—ã°ã—ã°è¦‹ã‚‰ã‚Œã‚‹ãƒ‡ã‚¶ã‚¤ãƒ³ãƒ‘ターンã§ã™ã€‚ qmailã¯ã€ãã®ã‚ˆã†ãªè¨è¨ˆãŒãªã•ã‚ŒãŸãƒ¡ãƒ¼ãƒ«é…é€ãƒ‡ãƒ¼ãƒ¢ãƒ³ã¨ã—ã¦å高ã„ã§ã™ã—ã€OpenSSHã‚‚ã¾ãŸã€èªè¨¼ãƒ—ãƒã‚»ã‚¹ã¨é€šä¿¡ãƒ—ãƒã‚»ã‚¹ã‚’分離ã™ã‚‹ã“ã¨ã§ã€å¤–部ã¨ã®é€šä¿¡ã‚’担当ã™ã‚‹ã‚³ãƒ¼ãƒ‰ã«ãƒã‚°ãŒã‚ã£ãŸã¨ã—ã¦ã‚‚ã€ãƒ«ãƒ¼ãƒˆæ¨©é™ãŒå¥ªã‚ã‚Œãªã„よã†ã«è¨è¨ˆã•ã‚Œã¦ã„ã¾ã™ï¼ˆå‚ç…§: Privilege Separated OpenSSH）。 一方ã§ã€OpenSSLã«ã¯ãã®ã‚ˆã†ãªæ¨©é™åˆ†é›¢ã¯å®Ÿè£…ã•ã‚Œã¦ã„ã¾ã›ã‚“。Heartbleedã®éš›ã«ã‚µãƒ¼ãƒã®ç§˜å¯†éµãŒæ¼æ´©ã—ãŸã®ã‚‚ã€ç§˜å¯†éµã®å–り扱ã„ã¨ã€ãã®ä»–ã®é€šä¿¡ã®å–り扱ã„ã‚’åŒä¸€ã®ãƒ¡ãƒ¢ãƒªç©ºé–“ã®ä¸ã§è¡Œã£ã¦ã„ãŸã‹ã‚‰ã ã¨è€ƒãˆã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ãªã„ã®ãªã‚‰ã€è‡ªåˆ†ã§ä½œã‚Œã°ã„ã„ã˜ã‚ƒãªã„…ã¨ã„ã†ã“ã¨ã§ä½œã‚Šã¾ã—ãŸã€‚ãã‚ŒãŒã€N
TLSæš—å·è¨å®šã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ 安全ãªã‚¦ã‚§ãƒ–サイトã®ãŸã‚ã«ï¼ˆæš—å·è¨å®šå¯¾ç–編） | æƒ…å ±ã‚»ã‚ュリティ | IPA 独立行政法人 æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
GoogleãŒWebã§ã®SHA-1ã®åˆ©ç”¨åœæ¢ã‚’急ãç†ç”± | POSTD
å¶ç„¶ã«ã‚‚500万個ã®SSH公開éµã‚’手ã«å…¥ã‚ŒãŸä¿ºãŸã¡ã¯ - slideshare
https://jp.techcrunch.com/2014/11/19/20141118mozilla-eff-and-others-band-together-to-provide-free-ssl-certificates/
日本国内ã§ã®LINE利用を韓国当局ãŒå‚å—ã™ã‚‹ã“ã¨ã¯å›°é›£ - 雑種路線ã§ã„ã“ã†
CCS Injection脆弱性(CVE-2014-0224)発見ã®çµŒç·¯ã«ã¤ã„ã¦ã®ç´¹ä»‹ - OpenSSL #ccsinjection Vulnerability
OpenSSL #ccsinjection Vulnerability
我々ã¯ã©ã®ã‚ˆã†ã«ã—ã¦å®‰å…¨ãªHTTPS通信をæä¾›ã™ã‚Œã°è‰¯ã„ã‹ - Qiita
https://jp.techcrunch.com/2014/04/25/20140424facebook-google-intel-microsoft-netapp-qualcomm-vmware-and-the-linux-foundation-form-new-initiative-to-stop-the-next-heartbleed-from-happening/
æš—å·åŒ–ã‚½ãƒ•ãƒˆæ¬ é™¥ã€ï¼®ï¼³ï¼¡ã¯ï¼’å¹´å‰ã‹ã‚‰èªè˜ï¼æƒ…å ±åŽé›†ã«åˆ©ç”¨ - Bloomberg
OpenSSL æƒ…å ±æ¼ãˆã„を許ã—ã¦ã—ã¾ã†è„†å¼±æ€§ ～Heartbleed å•é¡Œï½ž ã«ã¤ã„ã¦
CVE-2014-0160 OpenSSL Heartbleed 脆弱性ã¾ã¨ã‚ - ã‚ã‚‚ãŠãã°
httpsã ã‹ã‚‰ã¨ã„ã†ã ã‘ã§å®‰å…¨ï¼Ÿèª¿ã¹ãŸã‚‰æ€–ããªã£ã¦ããŸSSLã®è©±!？ - Qiita
日本ã®é‡‘èžæ©Ÿé–¢ã¯ãªãœã€Œå¸¸æ™‚SSLã€ã‚’実装ã—ãªã„ã®ã‹ï¼Ÿ
HTTPSを使ã£ã¦ã‚‚Cookieã®æ”¹å¤‰ã¯é˜²ã’ãªã„ã“ã¨ã‚’実験ã§è©¦ã—ã¦ã¿ãŸ
JVNVU#94916481: HTTPS レスãƒãƒ³ã‚¹ã‹ã‚‰æš—å·åŒ–ã•ã‚ŒãŸãƒ‡ãƒ¼ã‚¿ã®ä¸€éƒ¨ã‚’推測å¯èƒ½ãªè„†å¼±æ€§ (BREACH)
http://japan.internet.com/webtech/20130207/2.html
SSL is not about encryption
Tãƒã‚¤ãƒ³ãƒˆãƒ„ールãƒãƒ¼ã‚’å°Žå…¥ã™ã‚‹ã¨SSL通信ã®å±¥æ´ã¾ã§ã‚‚ãŒç›—è´å¯èƒ½ã«ãªã‚‹
{{#tags}}- {{label}}
{{/tags}}