A Rust-based TLS library outperformed OpenSSL in almost every category
A tiny and relatively unknown TLS library written in Rust, an up-and-coming programming language, outperformed the industry-standard OpenSSL in almost every major category. The findings are the result of a recent four-part series of benchmarks [1, 2, 3, 4] carried out by Joseph Birr-Pixton, the developer behind the Rustls library. Benchmark resultsThe findings showed that Rustls was 10% faster whe
政府ã«ã‚ˆã‚‹ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®æ¤œé–²ã¨SNIã«ã¤ã„ã¦
ã—ã‹ã—今回一般ã®äººã®ç›®ã«ã‚‚触れる形ã§SNIã‚„HTTPSã®ã“ã¨ãŒå ±ã˜ã‚‰ã‚ŒãŸçµæžœã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã‚‚å«ã‚ã¦æ˜Žã‚‰ã‹ã«æŠ€è¡“ã«é–¢ã—ã¦å‹˜é•ã„ã‚’ã—ã¦ã„ã‚‹ã®ã§ã¯ãªã„ã‹ã¨æ„Ÿã˜ã‚‹ç™ºè¨€ã‚’見るã“ã¨ãŒã‚ã‚Šã¾ã—ãŸã€‚ã“ã®ã¾ã¾æ”¾ç½®ã™ã‚‹ã®ã‚‚良ããªã„ã¨æ„Ÿã˜ã¦ã„ã‚‹ã®ã§ã€Q&Aã¨ã„ã†å½¢ã§SNIã‚„HTTPSã«é–¢ã™ã‚‹èª¤è§£ã‚’å°‘ã—ã§ã‚‚解ã‘ã‚Œã°ã¨æ€ã„ã¾ã™ã€‚ Q&AQ: ãã‚‚ãã‚‚SNIã£ã¦ä½•ï¼Ÿä»¥å‰æ›¸ã„ãŸè¨˜äº‹ã«ã‚‚書ã‹ã‚Œã¦ã„ã‚‹ã®ã§æ˜¯éžèªã‚“ã§ã¿ã¦ãã ã•ã„。 ç°¡å˜ã«èª¬æ˜Žã™ã‚‹ã¨ã€HTTPSã§ã¯SSL/TLSを利用ã—ã¦é€šä¿¡ãŒæš—å·åŒ–ã•ã‚Œã¾ã™ã€‚ãªã®ã§1ã¤ã®IPアドレスã§è¤‡æ•°ã®è¨¼æ˜Žæ›¸ã‚’扱ãŠã†ã¨ã—ãŸå ´åˆã€æœ€åˆã®é€šä¿¡æ™‚ã«ã©ã®è¨¼æ˜Žæ›¸ã‚’利用ã™ã‚Œã°ã„ã„ã‹åˆ†ã‹ã‚Šã¾ã›ã‚“。ãã“ã§SNIãŒå¿…è¦ã«ãªã‚Šã¾ã™ã€‚ SNIã¯æœ€åˆã®é€šä¿¡æ™‚ã«ä»Šã‹ã‚‰é€šä¿¡ã—ãŸã„サーãƒãƒ¼ãƒãƒ¼ãƒ （ドメインåã¨è€ƒãˆã¦ãã ã•ã„）をサーãƒãƒ¼ã«å¹³æ–‡ã§æ¸¡ã™ã“ã¨ã§ã€é€šä¿¡ã—ãŸã„SSL証明書を指定ã§ãã¾ã™ã€‚SNIã¯ç¾åœ¨ã®ä¸€èˆ¬çš„ãªãƒ–ラウ
Extended Validation is Broken
Extended Validation Is Broken By @iangcarroll Extended validation ("EV") certificates are a unique type of certificate issued by certificate authorities after more extensive validation of the entity requesting the certificate. In exchange for this more rigorous vetting, browsers show a special indicator like a green bar containing the company name, or in the case of Safari completely replace the U
How I tricked Symantec with a Fake Private Key - Hanno's blog
Lately, some attention was drawn to a widespread problem with TLS certificates. Many people are accidentally publishing their private keys. Sometimes they are released as part of applications, in Github repositories or with common filenames on web servers. If a private key is compromised, a certificate authority is obliged to revoke it. The Baseline Requirements – a set of rules that browsers and
HTTPS Certificate Revocation is broken, and it’s time for some new tools
This article was originally published on Scott Helme's blog and is reprinted here with his permission. We have a little problem on the web right now and I can only see it becoming a larger concern as time goes by: more and more sites are obtaining certificates, vitally important documents needed to deploy HTTPS, but we have no way of protecting ourselves when things go wrong. Certificates We're cu
Padding oracles and the decline of CBC-mode cipher suites
At CloudFlare, we’re committed to making sure the encrypted web is available to everyone, even those with older browsers. At the same time, we want to make sure that as many people as possible are using the most modern and secure encryption available to them. Improving the cryptography used by the majority requires a coordinated effort between the organizations building web browsers and API client
OpenSSLã®è„†å¼±æ€§(CVE-2017-3733)ã«è¦‹ã‚‰ã‚Œã‚‹ä»•æ§˜ã¨castã®è½ã¨ã—ç©´ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ OpenSSL-1.1.0dã«è„†å¼±æ€§(CVE-2017-3733)ãŒè¦‹ã¤ã‹ã‚Šã€Encrypt-Then-Mac 㨠renegotiation を組ã¿åˆã‚ã›ã¦ crashã•ã›ã‚‹ã“ã¨ãŒã§ãã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã¯ã€ä»•æ§˜ã®æº–æ‹ ä¸è¶³ã‚„ä¸é©åˆ‡ãªå¤‰æ•°ã® cast ãªã©ãŒåŽŸå› ã§ã—ãŸã€‚ TLS1.3ã§ã¯ã“ã†ã„ã†è½ã¨ã—ç©´ãŒå°‘ãªããªã‚‹ã‚ˆã†æ©Ÿèƒ½ã®æ ¹æœ¬çš„ãªè¦‹ç›´ã—ãŒè¡Œã‚ã‚Œã¦ã„ã¾ã™ã€‚ 1. ã¯ã˜ã‚㫠先週 OpenSSL-1.1.0d ã«å¯¾ã—ã¦ã‚»ã‚ュリティアップデートãŒã‚り〠Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)ã¨ã„ã†è„†å¼±æ€§(Severity: High)ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ 対象ã¨ãªã£ãŸ 1.1.0 ã¯ã€æ˜¨å¹´2016å¹´8月ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸOpenSSLã®æ–°ã—ã„リリースブランãƒã§ã™ã€‚1.1.0ã§ã¯APIã®å¤§å¹…変更もã‚ã‚Šã€ã¾ã ã‚ã¾ã‚Šæ™®åŠ
Building Zero protocol for fast, secure mobile connections
Building Zero protocol for fast, secure mobile connections Every day, more than a billion people use Facebook on Android and iOS devices to connect with their friends. Securing data in transit between our mobile apps and our servers helps ensure that people have a safe experience on Facebook. Our mobile apps use a custom networking stack called Mobile Proxygen, a C++14 cross-platform HTTP client w
So you want to expose Go on the Internet
Back when crypto/tls was slow and net/http young, the general wisdom was to always put Go servers behind a reverse proxy like NGINX. That’s not necessary anymore! At Cloudflare we recently experimented with exposing pure Go services to the hostile wide area network. With the Go 1.8 release, net/http and crypto/tls proved to be stable, performant and flexible. However, the defaults are tuned for lo
Let's Encrypt を支ãˆã‚‹ ACME プãƒãƒˆã‚³ãƒ« - Block Rockin’ Codes
Intro 先日 #http2study 㧠mozilla ã® Richard Barnes ㌠Let's Encrypt ã«ã¤ã„ã¦è©±ã—ã¦ãã‚Œã¾ã—ãŸã€‚ 資料: Let's Encrypt Overview ã“ã®è³‡æ–™ã®ç¿»è¨³ ã¯ã—ãŸã®ã§ã™ãŒã€ã„らãªããªã£ã¦ã—ã¾ã£ãŸã®ã§ä¾›é¤Šã‚‚ã‹ãã¦ã“ã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®ãƒ¢ãƒãƒ™ãƒ¼ã‚·ãƒ§ãƒ³ã¨ã€ Web ã§ãŠã“ã£ã¦ã„ã‚‹ HTTPS 推進ã®ãŸã©ã‚‹é“ã«ã¤ã„ã¦ã€è³‡æ–™ã‚’補足ã—ã¤ã¤ç´¹ä»‹ã—ã¾ã™ã€‚ çµè«–ã‹ã‚‰è¨€ã†ã¨ Let's Encrypt ã¯ã‚‚ã¡ã‚ã‚“ ACME プãƒãƒˆã‚³ãƒ« ã«ã¤ã„ã¦ã‚‚是éžçŸ¥ã£ã¦ãŠãã¨è‰¯ã„ã¨æ€ã„ã¾ã™ã€‚ HTTPS ã®å•é¡Œ ã™ã§ã«ã“ã®ãƒ–ãƒã‚°ã§ã‚‚紹介ã—ã¦ã„るよã†ã«ã€ Web ã«ãŠã‘ã‚‹ HTTPS ã®é‡è¦æ€§ã¯å¢—ã—ã€ãã‚Œã®æ™®åŠã‚’後押ã—ã™ã‚‹æ´»å‹•ãŒå„所ã§é€²ã‚られã¦ã„ã¾ã™ã€‚ HTTPS 化ã™ã‚‹ Web ã‚’ã©ã†è€ƒãˆã‚‹ã‹ よã言ã‚れる盗è´é˜²æ¢ã‚’始ã‚ã€æš—å·åŒ–ã‚’è¡Œã†ã“ã¨ã§é˜²ã’ã‚‹å•é¡Œã¯å¤šãã‚
錆ã³ã¤ã„ãŸTLSを滑らã‹ã«ã€Googleã«ã‚ˆã‚‹GREASE試験 - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ é•·ã„é–“ã€TLSã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ»ã‚µãƒ¼ãƒé–“ã§ä½¿ç”¨ã™ã‚‹TLSãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’åˆæ„ã™ã‚‹éš›ã«ã€ ä¸å®Œå…¨ãªã‚µãƒ¼ãƒå®Ÿè£…ã«ã‚ˆã£ã¦ version intolerance ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒå•é¡Œã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ TLS1.3ã§ã¯ã“ã® version intolerance ã®å½±éŸ¿ã‚’最å°åŒ–ã™ã‚‹ãŸã‚ã€æ–°ã—ã„ version negotiation ã®ä»•çµ„ã¿ã‚’å–り入れã¾ã—ãŸã€‚ Googleã¯ã€GREASE(Generate Random Extensions And Sustain Extensibility)ã¨ã„ã†ä»•æ§˜ã‚’Chromeã«å®Ÿè£…ã—ã€TLSサーãƒã®ãƒã‚°ã§é€šã‚‰ãªã„拡張やフィールド値ã§å•é¡ŒãŒç™ºç”Ÿã—ãªã„ã‹è©¦é¨“を始ã‚ã¾ã—ãŸã€‚ パケットã‚ャプãƒãƒ£ãŒå¥½ããªäººã¯ã€Chrome㌠0x[0-f]a0x[0-f]a ã®è¦‹æ…£ã‚Œãªã„値をCipherSuiteã‚„TLSæ‹¡å¼µã«ä½¿ã£ã¦ã„ã‚‹ã®ã‚’見ã¤ã‘ã¦ã‚‚é©šã‹ãªã„よã†æ°—ã‚’
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
TLS
draft-wood-tls-external-psk-importer-00 - Importing External PSKs for TLS 1.3
0.me.uk
Automated Analysis of TLS 1.3
Chrome’s Plan to Distrust Symantec Certificates
HTTPS Interception Weakens TLS Security | CISA
TCP＋TLSã«ä»£ã‚る高速プãƒãƒˆã‚³ãƒ«ã€Google生ã¾ã‚Œã®ã€ŒQUICã€ã®ç‰¹å¾´ã¨æ¨™æº–化ã®è¡Œæ–¹ã€IETFトピックス2016-17】
{{#tags}}- {{label}}
{{/tags}}