[B! OpenSSL] reika221ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

reika221 id:reika221

OpenSSLã«é–¢ã™ã‚‹reika221ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (29)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

JVNVU#91973538: OpenSSL ã«ãŠã‘ã‚‹æš—å·é€šä¿¡ã‚’è§£èªå¯èƒ½ãªè„†å¼±æ€§ (Raccoon Attack)
OpenSSL 1.0.2w ã‚ˆã‚Šå‰ã® OpenSSL 1.0.2 ç³»ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ ãªãŠã€é–‹ç™ºè€…ã«ã‚ˆã‚‹ã¨ã€OpenSSL 1.1.1 ã¯æœ¬è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘ãªã„ã¨ã®ã“ã¨ã§ã™ã€‚ OpenSSL Project ã‚ˆã‚Šã€OpenSSL Security Advisory [09 September 2020]Â ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ æ·±åˆ»åº¦ - ä½Ž (Severity: Low) Raccoon Attack ã®å•é¡Œ - CVE-2020-1968 Diffie-Hellman éµäº¤æ›ã‚’è¡Œã†ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ä½¿ç”¨ã—ãŸå ´åˆã€ä¸é–“è€…æ”»æ’ƒãŒå¯èƒ½ãªç’°å¢ƒã§ TLS ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯æ™‚ã«ä½¿ç”¨ã™ã‚‹ pre-master secret ãŒè§£ã‹ã‚Œã€ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆé–“ã§ã‚„ã‚Šå–ã‚Šã•ã‚Œã‚‹é€šä¿¡å†…å®¹ã‚’è§£èªã•ã‚Œã‚‹ (Raccoon Attack) å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã™ã‚‹ OpenSSL 1.0.2 ã¯ã‚µãƒãƒ¼ãƒˆãŒçµ‚äº†ã—ã¦
reika221 2020/09/13
OpenSSL
ãƒªãƒ³ã‚¯
ã€ŽOpenSSLã‚¯ãƒƒã‚¯ãƒ–ãƒƒã‚¯ã€æä¾›é–‹å§‹ã®ãŠçŸ¥ã‚‰ã›
ã”æ¥åº—ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ æœ¬æ—¥ã‚ˆã‚Šã€ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ï¼ˆ2017å¹´3æœˆç™ºè¡Œï¼‰ã‹ã‚‰ã‚¹ãƒ”ãƒ³ã‚ªãƒ•ã—ãŸãƒŸãƒ‹ãƒ–ãƒƒã‚¯ã€ŽOpenSSLã‚¯ãƒƒã‚¯ãƒ–ãƒƒã‚¯ã€ã®æä¾›ã‚’é–‹å§‹ã—ã¾ã—ãŸã€‚è³¼å…¥ãƒšãƒ¼ã‚¸ã‹ã‚‰ã‚«ãƒ¼ãƒˆã«è¿½åŠ ã—ã¦ã„ãŸã ãã“ã¨ã§ã€ã©ãªãŸã§ã‚‚ç„¡å„Ÿã§ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ãŒå¯èƒ½ã§ã™ï¼ˆã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã¯ä¸è¦ã§ã™ãŒã€ç›´è²©ã‚µã‚¤ãƒˆã®è³¼å…¥ãƒ•ãƒãƒ¼ã‚’çµŒç”±ã™ã‚‹é–¢ä¿‚ã§ã€ãŠåå‰ã®æ¬„ã¨ä½æ‰€ã®æ¬„ã¸ã®å…¥åŠ›ã¯ãŠé¡˜ã„ã„ãŸã—ã¾ã™ï¼‰ã€‚ åŒæ›¸ã¯ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ã®åŽŸæ›¸ã§ã‚ã‚‹â€ŸBulletproof SSL and TLSâ€ã‹ã‚‰OpenSSLã«é–¢ã™ã‚‹ç« ã‚’æŠœãå‡ºã—ã¦å†ç·¨ã•ã‚ŒãŸâ€ŸOpenSSL Cookbookâ€ã®ç¿»è¨³ã«ç›¸å½“ã—ã€ã€Žãƒ—ãƒãƒ•ã‚§ãƒƒã‚·ãƒ§ãƒŠãƒ«SSL/TLSã€ã®ã€Œç¬¬11ç« OpenSSLã€ã¨ã€Œç¬¬12ç« OpenSSLã«ã‚ˆã‚‹ãƒ†ã‚¹ãƒˆã€åŠ ãˆã€SSL Labsã§å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ â€ŸSSL/TLS Deployment Best Pra
reika221 2018/02/07
OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§CVE-2016-800(DROWN)ã‚„CVE-2016-0702(CacheBleed)ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2016å¹´3æœˆ1æ—¥(ç¾åœ°æ™‚é–“)ã€OpenSSL ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã¯è„†å¼±æ€§ã®æ„›ç§°ã€ŒDROWNã€ã‚„ã€ŒCacheBleedã€ã‚’å«ã‚€8ä»¶ã®è„†å¼±æ€§æƒ…å ±ã‚’å…¬é–‹ã—ã€ã“ã‚Œã‚‰å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚‚ã®ã®ä¿®æ£ã‚’è¡Œã£ãŸæœ€æ–°ç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§æƒ…å ±æ¦‚è¦ æ³¨æ„å–šèµ· OpenSSL ã®è¤‡æ•°ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ· - JPCERT/CC SSLv2 DROWN Attack - US-CERT OpenSSL Projectã®å…¬é–‹æƒ…å ± Forthcoming OpenSSL releases OpenSSL Security Advisory ï¼»1st March 2016ï¼½ OpenSSL version 1.0.1s published OpenSSL version 1.0.2g published An OpenSSL Userâ€™s Guide to DROWN 2016å¹´3æœˆ1æ—¥å…¬
reika221 2016/03/02
OpenSSL
ãƒªãƒ³ã‚¯
ã€ŒOpenSSLã€ã«2ä»¶ã®è„†å¼±æ€§ã€ä¿®æ£ã‚’æ–½ã—ãŸæœ€æ–°ç‰ˆãŒå…¬é–‹
reika221 2016/01/30
OpenSSL

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
OpenSSL: The Open Source toolkit for SSL/TLS
Welcome to OpenSSL! The OpenSSL Project develops and maintains the OpenSSL software - a robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication. The projectâ€™s technical decision making is managed by the OpenSSL Technical Committee (OTC) and the project governance is managed by the OpenSSL Management Committee (OMC). The project operates under forma
reika221 2016/01/30
OpenSSL

ã‚·ã‚¹ãƒ†ãƒ é–‹ç™º å¤§é˜ª
ãƒªãƒ³ã‚¯
ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
reika221 2015/12/02
ssl

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§(CVE-2015-1793)ã«ã‚ˆã‚‹Altãƒã‚§ãƒ¼ãƒ³è¨¼æ˜Žæ›¸å½é€ ã®ä»•çµ„ã¿ - ã¼ã¡ã¼ã¡æ—¥è¨˜
TL;DR ã‚„ã£ã±ã‚Šæ›¸ã„ã¦ã„ãŸã‚‰é•·æ–‡ã«ãªã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã‚ã¾ã‚Šã¡ã‚ƒã‚“ã¨æŽ¨æ•²ã™ã‚‹æ°—åŠ›ãŒãªã„ã®ã§ã€å¤‰ãªæ–‡ç« ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ã”äº†æ‰¿ã„ãŸã ã‘ã‚‹æ–¹ã®ã¿ãŠèªã¿ãã ã•ã„ã€‚ 1. ã¯ã˜ã‚ã« æ˜¨æ™©æœªæ˜Žã«OpenSSL-1.0.2d, 1.0.1pãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚äº‹å‰ã«äºˆå‘Šã•ã‚Œã¦ã„ãŸé€šã‚Šæ·±åˆ»åº¦é«˜ã®è„†å¼±æ€§CVE-2015-1793ãŒä¿®æ£ã•ã‚Œã¦ã„ã¾ã™ã€‚Advisoryã‚’è¦‹ã‚‹ã¨ã€ã“ã®è„†å¼±æ€§ãŒiojs/Nodeã«å½±éŸ¿ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ãŒåˆ¤æ˜Žã—ãŸã®ã§ç›´ã¡ã«iojs/Nodeã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’è¡Œã„ã€ä»Šæœæœªæ˜Žã«ç„¡äº‹è„†å¼±æ€§å¯¾å¿œç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ ä»Šå›žãŒåˆã‚ã¦ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€æ·±å¤œã«æ—¥æ¬§ç±³ã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒgithubä¸Šã§äº’ã„ã«é€£æºã—ãªãŒã‚‰é€Ÿã‚„ã‹ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒªãƒªãƒ¼ã‚¹ä½œæ¥ã‚’è¡Œã†ã“ã¨ã¯ä½•å›žã‚„ã£ã¦ã‚‚ãªã‹ãªã‹ã—ã³ã‚Œã‚‹çµŒé¨“ã§ã™ã€‚æ™‚å·®ã‚‚ã‚ã‚Šãªã‹ãªã‹ä½“åŠ›çš„ã«ã¯è¾›ã„ã‚‚ã®ãŒã‚ã‚Šã¾ã™ãŒã€ä¸–ç•Œã®è¶…ä¸€æµã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨å…±åŒã§ãƒªã‚¢
reika221 2015/07/11
OpenSSL
ãƒªãƒ³ã‚¯
ãƒ¡ãƒ¢ã€‚ã‚ªãƒ¬ã‚ªãƒ¬è¨¼æ˜Žæ›¸ã‚’opensslã§ä½œã‚‹ï¼ˆè©³ç´°ç‰ˆï¼‰ - ã‚ã°é›»åãŒè©°ã¾ã£ã¦ã„ã‚‹ - mobile hack æ¥½ã—ã„ç”Ÿæ´»æƒ…å ±ã‚’æºå¸¯ã—ã‚ˆã†
d.hatena.ne.jp
reika221 2015/06/30
OpenSSL
ãƒªãƒ³ã‚¯
sslscanã§ã‚µãƒ¼ãƒã®SSL/TLSçŠ¶æ…‹ã‚’ç°¡å˜ã«ãƒã‚§ãƒƒã‚¯ã™ã‚‹ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
æœ€è¿‘ã¯SSL/TLSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡ŒãŒå¤šç™ºã—ã¦ã„ã‚‹ãŸã‚ã€è‡ªåˆ†ã§é‹ç”¨ã—ã¦ã„ã‚‹ã‚µãƒ¼ãƒã®SSL/TLSã®è¨å®šã‚’ãƒ†ã‚¹ãƒˆã—ãŸã„ã¨ã„ã†äººã¯å¤šã„ã¨æ€ã„ã¾ã™ã€‚ SSL/TLSã®çŠ¶æ…‹ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ã«ã¯ã€Qualys SSL Labsã®SSL Server TestãŒã‚ˆãä½¿ã‚ã‚Œã¾ã™ã€‚ã—ã‹ã—ã“ã‚Œã¯å¤–éƒ¨ã‹ã‚‰ç¬¬ä¸‰è€…ã«ã‚¹ã‚ãƒ£ãƒ³ã•ã›ã‚‹ã‚ã‘ã§ã™ã‹ã‚‰ã€(å¿ƒç†çš„ãƒ»ç¤¾å†…æ”¿æ²»çš„ãª)æ•·å±…ãŒé«˜ã„ã¨ã„ã†ç‚¹ã‚‚ã‚ã‚Šã¾ã™ã—ã€ãã‚‚ãã‚‚ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆå´ã‹ã‚‰ç›´æŽ¥æŽ¥ç¶šã§ããªã„ç’°å¢ƒã®ãƒ†ã‚¹ãƒˆãŒè¡Œãˆã¾ã›ã‚“ã€‚ ãã“ã§ã€IPã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’æŒ‡å®šã™ã‚‹ã ã‘ã§ã‚ˆã‚ã—ãå¯¾è±¡ã®SSL/TLSã‚µãƒ¼ãƒã®çŠ¶æ…‹ã‚’ãƒã‚§ãƒƒã‚¯ã—ã¦ãã‚Œã‚‹ãƒ„ãƒ¼ãƒ«ãŒã‚ã‚‹ã¨ä¾¿åˆ©ã ãªã€ã¨ã„ã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚æœ¬ç¨¿ã§ã¯ã€ã“ã®ã‚ˆã†ãªç›®çš„ã«åˆ©ç”¨ã•ã‚Œã‚‹sslscanã¨ã„ã†ã‚³ãƒžãƒ³ãƒ‰ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ sslscanã¯Linuxã§å‹•ä½œã—ã€ãƒšãƒãƒˆãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ†ã‚¹ãƒˆç”¨ã«ä½¿ã‚ã‚Œã‚‹Kali Linuxã«ã‚‚ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ãŠæ‰‹è»½ãªSS
reika221 2015/03/21
ssl

TLS

OpenSSL

Linux

security
ãƒªãƒ³ã‚¯
OpenSSL Security Advisory [19 Mar 2015]
reika221 2015/03/20
OpenSSL
ãƒªãƒ³ã‚¯
r/crypto - OpenSSL bug allows RSA 1024 key factorization in 20 minutes
Thankfully it's very easy to tell whether it's real. If anyone can publish the two, non-trivial factors of this number (where neither is 1!) then they'll have my attention: 0xe5c30e1286c41c7137dc06194199dde641120de591c1b7392de35ef6a961d6d29faa3bcdb7603d42768a90322197a7a46fa2cf23f6f10de5554db6e7322ba35e858f576f840347c795c8782c3f4ef9f530d2fd1f6b5c275ce49404958f0decddd0b53386d12c745891d5eeca1f265bdf8
reika221 2014/10/06
OpenSSL

security
ãƒªãƒ³ã‚¯
KMIoT-ãƒšãƒ¼ã‚¸ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆ
æœ¬ã‚µã‚¤ãƒˆã¯ç§»è»¢ã—ã¾ã—ãŸã€‚3ç§’å¾Œã«ã‚¸ãƒ£ãƒ³ãƒ—ã—ã¾ã™ã€‚ ã‚¸ãƒ£ãƒ³ãƒ—ã—ãªã„å ´åˆã¯ã€ä»¥ä¸‹ã®URLã‚’ã‚¯ãƒªãƒƒã‚¯ã—ã¦ãã ã•ã„ã€‚ ç§»è»¢å…ˆã®ãƒšãƒ¼ã‚¸
reika221 2014/09/13
Gmail

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã®æ–°ãŸãªè„†å¼±æ€§ CCS Injection ãŒç™ºè¦‹ã•ã‚Œã‚‹
OpenSSLã®æ–°ãŸãªè„†å¼±æ€§ CCSã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ (CVE-2014-0224) ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚OpenSSLãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‹ã‚‰ã¯ä»–ã®è„†å¼±æ€§(6ã¤ã‚ã‚Šã¾ã™)ã¸ã®å¯¾å¿œã‚‚å«ã‚“ã 0.9.8zaã€1.0.0mã€1.0.1hãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®ã¾ã¨ã‚ã§ã¯ä¸»ã«CVE-2014-0224ã‚’æ‰±ã„ã¾ã™ã€‚ ãã‚Œã‚’ç™ºè¦‹ã—ãŸæ—¥æœ¬ã®ä¼šç¤¾ã§ã‚ã‚‹ãƒ¬ãƒ”ãƒ€ãƒ ã«ã‚ˆã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆã¨ã€ãã®åå¿œã‚’ã„ãã¤ã‹ã€‚
reika221 2014/06/06
OpenSSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

CCS Injection
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§CCS Injection(CVE-2014-0224)ã®æ”»æ’ƒãŒè¡Œã‚ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’ãƒžãƒˆãƒªãƒƒã‚¯ã‚¹åŒ–ã—ã¦ã¿ãŸã€‚ - piyolog
lepidumç¤¾ã®èŠæ± æ°ãŒOpenSSLã®å®Ÿè£…ã«è„†å¼±æ€§ãŒã‚ã‚‹ã“ã¨ã‚’ç™ºè¦‹ã—ã¾ã—ãŸã€‚ã“ã®è„†å¼±æ€§ã¯ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«æ¬ é™¥ãŒã‚ã‚‹ã‚‚ã®ã§ã€æ‚ªç”¨ã•ã‚ŒãŸå ´åˆã«æš—å·é€šä¿¡ã®æƒ…å ±ãŒæ¼ãˆã„ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã¨åŒç¤¾å…¬é–‹æƒ…å ±ã§ã¯èª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™ã€‚ å°šã€6æœˆ6æ—¥ã«ãƒ¬ãƒ”ãƒ€ãƒ ç¤¾ãŒã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®å½è£…ã‚’è¡Œã†æ”»æ’ƒãŒè¡Œã‚ã‚Œã‚‹æã‚Œã«ã¤ã„ã¦å±é™ºãŒãªã„ã“ã¨ãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦è¨‚æ£ã‚’è¡Œã„ã¾ã—ãŸã€‚ãã‚Œã«ä¼´ã„ä»¥ä¸‹ã®å†…å®¹ã‚‚ä¿®æ£ã‚’åŠ ãˆã¦ã„ã¾ã™ã€‚(ä¿®æ£å‰ã®è¨˜äº‹ã¯éšæ‹“ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚) lepidumç¤¾ å…¬é–‹æƒ…å ± å½“ç¤¾ã§ç™ºè¦‹ã—å ±å‘Šã‚’ã—ãŸOpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0224 ï¼‰ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚æ—©æ€¥ãªæ›´æ–°ãŒæœ›ã¾ã‚Œã‚‹å†…å®¹ã ã¨è€ƒãˆã¦ã„ã¾ã™ã€‚ #ccsinjection #OpenSSL æ¦‚è¦ã¯ã“ã¡ã‚‰ã®ãƒšãƒ¼ã‚¸ã‚’ã”å‚ç…§ä¸‹ã•ã„ã€‚http://t.co/bhY7GpLZ2jâ€” lepidum (@lepidum) 2
reika221 2014/06/06
OpenSSL

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
SSLã®è¨¼æ˜Žæ›¸æœŸé™ã‚’CLIã§ç¢ºèªã™ã‚‹ - ã†ã¾ã„ã¼ã†ã¶ã‚ã
SSLãªã‚“ã ã‹ã‚‰opensslä½¿ãˆã°ã‚ã‹ã‚‹ã‚ˆãã£ã¦ã„ã†ã€‚ openssl $ openssl s_client -connect ssl.example.com:443 2>&1 < /dev/null | openssl x509 -enddate | grep ^notAfter notAfter=Oct 1 23:59:59 2011 GMTopensslã§æŽ¥ç¶šã—ã«ã„ãã®ã§ã€remote host ã®çŠ¶æ…‹ã‚’ç¢ºèªå¯èƒ½ã€‚ certwatch (in crypto-utils package (redhat)) yumã§ã„ã‚Œã‚‹ã¨cron.dailyã«ç™»éŒ²ã•ã‚Œã¦æ¯Žæ—¥ãƒã‚§ãƒƒã‚¯ã•ã‚Œã‚‹ã€‚defaultã®è¨å®šã§ã¯ã€apacheã«è¨å®šã•ã‚Œã¦ã„ã‚‹è¨¼æ˜Žæ›¸(httpd -t -DDUMP_CERTS)ã‚’èª¿ã¹ã¦ã„ã‚‹æ§˜åã€‚ $ certwatch /path/to/cert.pemãƒ•ã‚¡ã‚¤ãƒ«ã‚’èª¿ã¹ã‚‹ã®ã§åŸºæœ¬çš„ã«ã¯
reika221 2014/05/09
OpenSSL

certwatch
ãƒªãƒ³ã‚¯
heartbleedã‚’iptablesã§æ¢ã‚ã‚‹ã“ã¨ã«ã¤ã„ã¦ - yasulib memo
å‰æ›¸ã OpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0160ï¼‰ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ è©³ç´°ã¯piyokangoã•ã‚“ã®ç´ æ™´ã‚‰ã—ã„ã¾ã¨ã‚ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚ OpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0160ï¼‰é–¢é€£ã®æƒ…å ±ã‚’ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚°ã«ã¦ã€ãƒˆãƒ¼ãƒžãƒ„ã®å²©äº•ã•ã‚“ãŒæ›¸ã„ãŸèˆˆå‘³æ·±ã„è¨˜äº‹ãŒã‚ã‚Šã¾ã—ãŸã€‚ ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : Openssl Heartbleed æ”»æ’ƒã®æ¤œçŸ¥ã«ã¤ã„ã¦ ï¼ƒæ ¹æœ¬çš„ãªå¯¾ç–ã§ã¯ãªãã€ã‚ãã¾ã§æ”»æ’ƒæ¤œçŸ¥ã¨ã„ã†æ„å‘³ã§ã€‚ iptables log rules iptables -t filter -A INPUT -p tcp --dport 443 -m u32 --u32 "52=0x18030000:0x1803FFFF" -j LOG --log-prefix "BLOCKED: HEARTBEAT" iptables block rules i
reika221 2014/04/14
OpenSSL

security

Heartbleed
ãƒªãƒ³ã‚¯
Wiresharkã§SSLé€šä¿¡ã®ä¸èº«ã‚’è¦—ã„ã¦ã¿ã‚‹ - ã‚ã°é›»åãŒè©°ã¾ã¤ã¦ã‚ã‚‹
OpenSSLã®è„†å¼±æ€§ã€ŒHeartbleedã€ãŒä¸–é–“ã‚’è³‘ã‚ã›ã¦ã„ã¾ã™ãŒã€è‰²ã€…ã¨ä¹—ã‚Šé…ã‚Œã¦ã—ã¾ã£ãŸæ„ŸãŒã‚ã‚‹ã®ã§ã€ã‚†ã‚‹ã‚†ã‚‹ã¨è½ã¡ç©‚æ‹¾ã„ã‚’ã—ã‚ˆã†ã‹ã¨æ€ã„ã¾ã™ã€‚ Heartbleedã§ç§˜å¯†éµã‚’æ‰‹ã«å…¥ã‚ŒãŸã‚‰SSLé€šä¿¡ã®ä¸èº«å…¨éƒ¨è¦‹ãˆã¡ã‚ƒã†ã˜ã‚ƒã‚“!! ã¨ã„ã†äº‹æ…‹ã«ãªã£ã¦ã„ã¾ã™ãŒã€ãªã‚“ã¨ãªãç†è«–çš„ã«ãã†ã ã‚ã†ãªã¨åˆ†ã‹ã‚‹ã‚‚ã®ã®ã‚¤ãƒžã‚¤ãƒå…·ä½“çš„ãªæ‰‹é †ãŒåˆ†ã‹ã‚‰ãªã„ã€‚ ã¨ã„ã†ã‚ã‘ã§ä»Šå›žã®ãƒ†ãƒ¼ãƒžã¨ã—ã¦ã€æ‰‹å…ƒã«ã‚µãƒ¼ãƒã®ç§˜å¯†éµã¨ã€SSLé€šä¿¡ã‚’ãƒ‘ã‚±ãƒƒãƒˆã‚ãƒ£ãƒ—ãƒãƒ£ã—ãŸpcapãƒ•ã‚¡ã‚¤ãƒ«ãŒã‚ã‚‹ã¨ãã«ã€Wiresharkã§ã©ã‚“ãªæ„Ÿã˜ã§SSLé€šä¿¡ã‚’ã€Œã»ã©ãã€ã®ã‹â€¦â€¦ã¨ã„ã†å…·ä½“çš„ãªæ‰‹é †ã‚’ã€ãƒãƒžã‚Šæ‰€ã‚’å«ã‚ã¦ã¾ã¨ã‚ã¦ãŠã“ã†ã‹ã¨æ€ã„ã¾ã™ã€‚ ã¨ã„ã†ã‹ã€ç§è‡ªèº«ãŒãƒãƒžã£ãŸã®ã§è‡ªåˆ†ç”¨ãƒ¡ãƒ¢ã§ã™ãªã€‚ãªãŠã“ã®æ–‡æ›¸ã§ã¯"SSL"ã¨ã ã‘è¨˜è¿°ã—ã€TLSã¯ç„¡è¦–ã—ã¦ã„ã¾ã™ã€‚ å‰ææ¡ä»¶ ã¨ã‚Šã‚ãˆãšä»¥ä¸‹ã®ã‚ˆã†ãªæ„Ÿã˜ã®æ¤œè¨¼ç’°å¢ƒã§è©¦ã—ã¾ã—ãŸã€‚ IPã‚¢ãƒ‰ãƒ¬ã‚¹ èª¬æ˜Ž ãƒ›ã‚¹ãƒˆO
reika221 2014/04/14
ssl

OpenSSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
OpenSSLã®æš—å·å‡¦ç†ãŒçˆ†é€Ÿãªä»¶ - Y's note
OpenSSLâ€•æš—å·ãƒ»PKIãƒ»SSL/TLSãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®è©³ç´°â€• ä½œè€…:John Viega,Matt Messier,Pravir Chandra,é½‹è—¤ åé“ã‚ªãƒ¼ãƒ ç¤¾Amazon ç›®æ¬¡ OpenSSLã«ã‚ˆã‚‹æš—å· å®Ÿè¡Œç’°å¢ƒ OpenSSLã«ã‚ˆã‚‹æš—å·åŒ–é€Ÿåº¦ ECBã¨CBCã®é•ã„ PHP OpenSSLã¨Mcrypté–¢æ•°ã®algorithmsæ¯”è¼ƒ OpenSSLã¨mcrypté–¢æ•°ã®DES,AESã®é€Ÿåº¦æ¯”è¼ƒ Mcryptã®ã‚¼ãƒpaddingã®ç™– C DESæš—å· AESæš—å· OpenSSLã¨Mcryptã®DES,AESã®é€Ÿåº¦æ¯”è¼ƒ OpenSSLã«ã‚ˆã‚‹æš—å· OpenSSLæ—¥æœ¬èªžã‚µã‚¤ãƒˆ: The Open Source toolkit for SSL/TLS ã‚ã©ã¦ãã‚„ã£ã¦ã„ã‚‹@yutakikuchi_ã§ã™ã€‚ ä»Šæ—¥ã¯OpenSSLã®å…±é€šéµæš—å·ã«ã¤ã„ã¦èª¿æŸ»ã—ãŸå†…å®¹ã‚’çºã‚ã¾ã™ã€‚OpenSSLã«ã¤ã„ã¦ç‰¹ã«Cè¨€
reika221 2014/02/28
OpenSSL
ãƒªãƒ³ã‚¯
OpenSSLã¨Pythonã§RSAæš—å·ã®åŽŸç†ã‚’çŸ¥ã‚‹ - ã‚‚ã‚‚ã„ã‚ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼
OpenSSLã‚’ä½¿ã†ã¨ã€æ¬¡ã®ã‚ˆã†ã«ã—ã¦2048bitã®RSAéµãŒä½œæˆã§ãã‚‹ã€‚ $ openssl genrsa 2048 Generating RSA private key, 2048 bit long modulus ......................+++ .................+++ e is 65537 (0x10001) -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAui/OeOYeMrLv+U2w13hQkL204OQVlB05nksKa5LaNE6mT3WY (snip) -----END RSA PRIVATE KEY----- ã“ã“ã§å‡ºåŠ›ã•ã‚Œã‚‹å†…å®¹ã¯ã€ASN.1ã¨ã„ã†æ§‹æ–‡è¦å‰‡ã§è¡¨ç¾ã•ã‚ŒãŸæƒ…å ±ã‚’DERã¨å‘¼ã°ã‚Œã‚‹ãƒã‚¤ãƒŠãƒªå½¢å¼ã«ã—ã€ãã‚Œã‚’ã•ã‚‰ã«Base64ã‚¨ãƒ³ã‚³ãƒ¼ãƒ‰ã—ãŸã‚‚ã®ã«ãªã£ã¦ã„ã‚‹ã€‚ ã“ã®ãƒ•ã‚©ãƒ¼ãƒžãƒƒãƒˆ
reika221 2013/11/28
OpenSSL

python
ãƒªãƒ³ã‚¯
ã•ãã‚‰VPS 2G(CentOS6)ã«UT-VPNã‚’å°Žå…¥(ã‚µãƒ¼ãƒå´è¨å®šç·¨) - Glide Note
mkdir ~/src cd ~/src wget "http://utvpn.tsukuba.ac.jp/files/utvpn/v1.01-7101-public-2010.06.27/Source%20Code%20(Win32%20and%20Unix)/utvpn-src-unix-v101-7101-public-2010.06.27.tar.gz" tar zxvf utvpn-src-unix-v101-7101-public-2010.06.27.tar.gz cd utvpn-unix-v101-7101-public cp /usr/include/openssl/* ~/src/utvpn-unix-v101-7101-public/src/Mayaqua/openssl/
reika221 2012/10/12
OpenSSL

VPN

CentOS

ã•ãã‚‰VPS
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸