ハッシュと暗号は違うぞ！ / Do not confuse hashes and ciphers.

by HASEGAWA Tomoki

Slide 1

Slide 1 text

ίϯϐϡʔλͷجૅ1 ϋογϡͱ҉߸͸ҧ͏ͧʂʂ ௕୩઒ஐر HASEGAWA Tomoki

Slide 2

Slide 2 text

ライフワーク: Web / iOSアプリ開発, ビール, 電子工作,  サッカー観戦, レンタルカートレース, … 長谷川智希 Web / iOS App Development, Beer, IoT, Watch soccer match, Rental Kart Racing, … デジタルサーカス株式会社副団長CTO Digital Circus, Inc. Vice-master CTO Tokyo, Japan Lifework: @tomzoh

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

WE ARE HIRING!! Web Development Mobile App Development （）（iOS, Android) http://www.dgcircus.com Omotesando, Tokyo

Slide 6

Slide 6 text

ࠓ೔ͷςʔϚ • ࣮ࡍʹ͋ͬͨ΍ΓͱΓ:  ͓٬͞·ʮηΩϡϦςΟ্DBʹύεϫʔυΛอଘ͠ͳ͍Ͱɻʯ  ๭ϕϯμʮͰ͸ύεϫʔυ͸҉߸Խͯ͠อଘ͠·͠ΐ͏ɻʯ  ΅͘ʮ·ͬͯʂʂʂʂ ʯ • ϋογϡͱ҉߸ͷҧ͍͕ཧղ͞Ε͍ͯͳ͍͜Μͳੈͷ த͡ΌϙΠζϯ☠ • ίϯϐϡʔλΤϯδχΞͱͯͪ͠ΌΜͱཧղͯ͠ɺਖ਼ ͘͠ϋογϡ΍҉߸ԽΛ࢖͓͏ɻ

Slide 7

Slide 7 text

ϋογϡ

Slide 8

Slide 8 text

ϋογϡ • γεςϜ։ൃɺಛʹWebγεςϜͰ͸࣌ͱͯ͠ϋο γϡΛ࢖͏ɻ • ͦͷಛੑΛཧղ͠ͳ͍ͰϋογϡΛ࢖༻͢Δͱɺ ηΩϡϦςΟ੬ऑੑΛ๊͑ΔՄೳੑ͕͋Δɻ • ϋογϡͷಛੑΛཧղͯ͠ਖ਼͘͠࢖͍·͠ΐ͏ɻ

Slide 9

Slide 9 text

ϋογϡͱ͸Կ͔

Slide 10

Slide 10 text

ӳ୯ޠͱͯ͠ͷҙຯ:

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

΢ΟΩϖσΟΞͰݟΔͱ:

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

ϋογϡͱ͸Կ͔ • ʮσʔλ͔Βࢉग़ͨ͠খ͞ͳ஋ɻ֤σʔλΛ۠ผɾ දݱ͢Δ໨తʹ༻͍Δʯ • σʔλΛϋογϡؔ਺ʹೖྗ͢Δͱɺϋογϡ஋ ͕ग़ྗ͞ΕΔɻ • ϋογϡؔ਺ͷྫ: md5, sha-1, sha-2 …

Slide 16

Slide 16 text

ϋογϡؔ਺ͷಛ௃ Α͘࢖ΘΕΔϋογϡؔ਺͸͜Μͳ෩ʹઃܭ͞Ε͍ͯΔ: • Կ౓΍ͬͯ΋ಉ͡ϋογϡ஋ʹͳΔ • ͲΜͳσʔλΛೖྗͯ͠΋ಉ͡௕͞ͷϋογϡ஋ʹͳΔ • ผͷσʔλʹରͯ͠͸͍͍ͩͨผͷϋογϡ஋ʹͳΔ • ϋογϡ஋͔ΒݩͷσʔλΛࢉग़͢Δ͜ͱ͸΄΅Ͱ͖ͳ͍

Slide 17

Slide 17 text

ϋογϡؔ਺ͷ༻్

Slide 18

Slide 18 text

ϋογϡؔ਺ͷ༻్1 ʮμ΢ϯϩʔυ͖ͯͨ͠ϑΝΠϧɺ  ͪΌΜͱμ΢ϯϩʔυͰ͖͔ͨͳ…ʯ • μ΢ϯϩʔυݩʹϋογϡؔ਺ͱϋογϡ஋Λදࣔɻ • μ΢ϯϩʔυͨ͠ϑΝΠϧͷϋογϡ஋ΛखݩͰܭࢉͯͦ͠Ε ͱൺֱ͢Δɻ • ϋογϡ஋͕߹͑͹OKɻ • ϑΝΠϧ͕վ͟Μ͞Ε͍ͯͨΓɺμ΢ϯϩʔυʹࣦഊ͍ͯ͠Ε͹ϋο γϡ஋͕߹Θͳ͍ɻ • aptͱ͔yumͰ΋಺෦తʹ࢖༻͞Ε͍ͯΔɻ

Slide 19

Slide 19 text

UbuntuͷISO഑෍αΠτ

Slide 20

Slide 20 text

UbuntuͷISO഑෍αΠτ

Slide 21

Slide 21 text

UbuntuͷISO഑෍αΠτ c94d54942a2954cf852884d656224186 *ubuntu-16.04-desktop-amd64.iso 610c4a399df39a78866f9236b8c658da *ubuntu-16.04-desktop-i386.iso 23e97cd5d4145d4105fbf29878534049 *ubuntu-16.04-server-amd64.img 23e97cd5d4145d4105fbf29878534049 *ubuntu-16.04-server-amd64.iso 494c03028524dff2de5c41a800674692 *ubuntu-16.04-server-i386.img 494c03028524dff2de5c41a800674692 *ubuntu-16.04-server-i386.iso 17643c29e3c4609818f26becf76d29a3 *ubuntu-16.04.1-desktop-amd64.iso 9e4e30c37c99b4e029b4bfc2ee93eec2 *ubuntu-16.04.1-desktop-i386.iso d2d939ca0e65816790375f6826e4032f *ubuntu-16.04.1-server-amd64.img d2d939ca0e65816790375f6826e4032f *ubuntu-16.04.1-server-amd64.iso 455206c599c25d6a576ba23ca906741a *ubuntu-16.04.1-server-i386.img 455206c599c25d6a576ba23ca906741a *ubuntu-16.04.1-server-i386.iso

Slide 22

Slide 22 text

ϋογϡؔ਺ͷ༻్2 ʮ/node/1ͱ͔ɺID͕URLʹؙݟ͑ͳͷΧοί  ѱ͍ͳ…ʯ • IDΛϋογϡؔ਺ͷೖྗͱ͠ɺURLʹ͸ϋογϡ஋Λ࢖͏ɻ • /user/9e4e30c37c99b4e029b4bfc2ee93eec2

Slide 23

Slide 23 text

ϋογϡؔ਺ͷ༻్3 ʮύεϫʔυΛͦͷ··DBʹอଘ͢Δͷ͸ةݥɻʯ • Ϣʔβ͕ೖྗͨ͠ύεϫʔυ͕Ϣʔβ͕ઃఆͨ͠΋ͷͱಉ͔͕͡ ෼͔Ε͹ྑ͍ɻ • ϋογϡؔ਺ΛܾΊ͓͖ͯɺDBʹ͸ύεϫʔυͷϋογϡ஋Λอ ଘ͢Δɻ • ࣍ճϩάΠϯ࣌ʹϢʔβ͕ೖྗͨ͠จࣈྻ͔Βϋογϡ஋Λܭࢉ ͠ɺDBʹอଘ͞Εͨ΋ͷͱൺֱ͢Δɻ • ϋογϡ஋͕߹͑͹Ϣʔβ͕ೖྗͨ͠จࣈྻ͸ͦͷϢʔβ͕ઃఆͨ͠ ύεϫʔυͱ౳͍͠ɻ • DB͕ྲྀग़ͯ͠΋ύεϫʔυ͸όϨͳ͍ɻ

Slide 24

Slide 24 text

ϋογϡͷಛੑʹΑΔ஫ҙࣄ߲

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

ϋογϡ஋িಥʹΑΔ߈ܸ ਆιϑτ͕Ͱ͖ͨͷͰެ։͢ΔΑɻ ϋογϡ஋෇͖Ͷɻ

Slide 28

Slide 28 text

ϋογϡ஋িಥʹΑΔ߈ܸ ਆιϑτ͕Ͱ͖ͨͷͰެ։͢ΔΑɻ ϋογϡ஋෇͖Ͷɻ ΢ΟϧεೖΕͯ…ɻ຤ඌʹΰϛσʔλ෇͚Ճ͑ͯϋο γϡ஋ಉ͡ʹͳΔ༷ʹͨ͠Ζɻ

Slide 29

Slide 29 text

ϋογϡ஋িಥʹΑΔ߈ܸ μ΢ϯϩʔυͨ͠ϑΝΠϧɺେৎ෉͔ͳʁ ϋογϡ஋߹ͬͯΔ͠OKʂ ਆιϑτ͕Ͱ͖ͨͷͰެ։͢ΔΑɻ ϋογϡ஋෇͖Ͷɻ ΢ΟϧεೖΕͯ…ɻ຤ඌʹΰϛσʔλ෇͚Ճ͑ͯϋο γϡ஋ಉ͡ʹͳΔ༷ʹͨ͠Ζɻ

Slide 30

Slide 30 text

ϋογϡ஋িಥʹΑΔ߈ܸ μ΢ϯϩʔυͨ͠ϑΝΠϧɺେৎ෉͔ͳʁ ϋογϡ஋߹ͬͯΔ͠OKʂ ਆιϑτ͕Ͱ͖ͨͷͰެ։͢ΔΑɻ ϋογϡ஋෇͖Ͷɻ ΢ΟϧεೖΕͯ…ɻ຤ඌʹΰϛσʔλ෇͚Ճ͑ͯϋο γϡ஋ಉ͡ʹͳΔ༷ʹͨ͠Ζɻ ͗Όʔʂ΢ΟϧεೖΓͩͬͨʂʂʂ

Slide 31

Slide 31 text

ϋογϡ஋িಥʹΑΔ߈ܸ μ΢ϯϩʔυͨ͠ϑΝΠϧɺେৎ෉͔ͳʁ ϋογϡ஋߹ͬͯΔ͠OKʂ ਆιϑτ͕Ͱ͖ͨͷͰެ։͢ΔΑɻ ϋογϡ஋෇͖Ͷɻ ΢ΟϧεೖΕͯ…ɻ຤ඌʹΰϛσʔλ෇͚Ճ͑ͯϋο γϡ஋ಉ͡ʹͳΔ༷ʹͨ͠Ζɻ ͗Όʔʂ΢ΟϧεೖΓͩͬͨʂʂʂ Ͳ͏ͨ͠ΒΑ͔ͬͨʁ

Slide 32

Slide 32 text

ϋογϡ஋িಥʹΑΔ߈ܸͷରࡦ • Ͳ͏͠Α͏΋ͳ͍ɻ • ϋογϡ஋ͷিಥΛҙਤతʹى͜͠ʹ͍͘ΞϧΰϦ ζϜΛ࢖͏͔͠ͳ͍ɻ

Slide 33

Slide 33 text

ϋογϡ஋িಥʹΑΔ߈ܸͷରࡦ • Ͳ͏͠Α͏΋ͳ͍ɻ • ϋογϡ஋ͷিಥΛҙਤతʹى͜͠ʹ͍͘ΞϧΰϦ ζϜΛ࢖͏͔͠ͳ͍ɻ

Slide 34

Slide 34 text

ϋογϡؔ਺ͷ༻్2 ʮ/node/1ͱ͔ɺID͕URLʹؙݟ͑ͳͷΧοί  ѱ͍ͳ…ʯ • IDΛϋογϡؔ਺ͷೖྗͱ͠ɺURLʹ͸ϋογϡ஋Λ࢖͏ɻ • /user/9e4e30c37c99b4e029b4bfc2ee93eec2

Slide 35

Slide 35 text

ݯ૾ܭࢉʹΑΔ߈ܸ /node/1 ͬͯͷ΋ΞϨͳͷͰϋογϡԽͨ͠Ζɻ $url = sprintf("/user/%s", md5($user_id));

Slide 36

Slide 36 text

ݯ૾ܭࢉʹΑΔ߈ܸ /node/1 ͬͯͷ΋ΞϨͳͷͰϋογϡԽͨ͠Ζɻ $url = sprintf("/user/%s", md5($user_id)); ͜ͷจࣈྻͷฒͼɺmd5ͩͳɻͲ͏ͤݩ͸࿈൪ͩΖɻ for ($i = 0; $i < 1000; $i++)} $page = file_get_contents(  sprintf("/user/%s", md5($i))); }

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

ݯ૾ܭࢉʹΑΔ߈ܸͷରࡦ1 • ݩσʔλ͕όϨͳ͍Α͏ʹ͢Δɻ • ͦͷͨΊʹɺݩσʔλʹιϧτΛ௥Ճ͢Δɻ • ιϧτ͸ԿͰ΋ྑ͍ɻ20จࣈҎ্͙Β͍ͷਪଌ͠ʹ͍͘จࣈ ྻɻ • ʮ࿈൪ͱ͔ΛΘ͔Γʹ͘͘͢Δʯ༷ͳ༻్Ͱ͸ɺιϧτΛ෇ ͚ͳ͍ܗͰϋογϡؔ਺Λ࢖͏͜ͱ͸ແ͍ͱࢥͬͯྑ͍ɻ

Slide 40

Slide 40 text

ݯ૾ܭࢉʹΑΔ߈ܸͷରࡦ1 • ݩσʔλ͕όϨͳ͍Α͏ʹ͢Δɻ • ͦͷͨΊʹɺݩσʔλʹιϧτΛ௥Ճ͢Δɻ • ιϧτ͸ԿͰ΋ྑ͍ɻ20จࣈҎ্͙Β͍ͷਪଌ͠ʹ͍͘จࣈ ྻɻ • ʮ࿈൪ͱ͔ΛΘ͔Γʹ͘͘͢Δʯ༷ͳ༻్Ͱ͸ɺιϧτΛ෇ ͚ͳ͍ܗͰϋογϡؔ਺Λ࢖͏͜ͱ͸ແ͍ͱࢥͬͯྑ͍ɻ $salt = "aemi4ahcoh7weeN2euth"; $url = sprintf("/user/%s", md5($salt.$user_id));

Slide 41

Slide 41 text

Slide 42

Slide 42 text

ݯ૾ܭࢉʹΑΔ߈ܸ ύεϫʔυΛϋογϡԽͯ͠DBʹอଘͨ͠Αɻ ͜ΕͰσʔλ͕࿙Ӯͯ͠΋େৎ෉ʂ

Slide 43

Slide 43 text

ݯ૾ܭࢉʹΑΔ߈ܸ ύεϫʔυΛϋογϡԽͯ͠DBʹอଘͨ͠Αɻ ͜ΕͰσʔλ͕࿙Ӯͯ͠΋େৎ෉ʂ ͜ͷจࣈྻͷฒͼɺmd5ͩͳɻΑ͋͘Δύεϫʔυͷ දΛ࢖ͬͯ…ɻ ݩσʔλ md5 abcde ab56b4d92b40713acc5af89985d4b786 qwerty d8578edf8458ce06fbc5bb76a58c5ca4 password 5f4dcc3b5aa765d61d8327deb882cf99 : :

Slide 44

Slide 44 text

ݯ૾ܭࢉʹΑΔ߈ܸ ύεϫʔυΛϋογϡԽͯ͠DBʹอଘͨ͠Αɻ ͜ΕͰσʔλ͕࿙Ӯͯ͠΋େৎ෉ʂ ͋ͬͱ͍͏ؒʹύεϫʔυ͕͹Εͨʂ ͜ͷจࣈྻͷฒͼɺmd5ͩͳɻΑ͋͘Δύεϫʔυͷ දΛ࢖ͬͯ…ɻ ݩσʔλ md5 abcde ab56b4d92b40713acc5af89985d4b786 qwerty d8578edf8458ce06fbc5bb76a58c5ca4 password 5f4dcc3b5aa765d61d8327deb882cf99 : :

Slide 45

Slide 45 text

ݯ૾ܭࢉʹΑΔ߈ܸ ύεϫʔυΛϋογϡԽͯ͠DBʹอଘͨ͠Αɻ ͜ΕͰσʔλ͕࿙Ӯͯ͠΋େৎ෉ʂ ͋ͬͱ͍͏ؒʹύεϫʔυ͕͹Εͨʂ Ͳ͏ͨ͠ΒΑ͔ͬͨʁ ͜ͷจࣈྻͷฒͼɺmd5ͩͳɻΑ͋͘Δύεϫʔυͷ දΛ࢖ͬͯ…ɻ ݩσʔλ md5 abcde ab56b4d92b40713acc5af89985d4b786 qwerty d8578edf8458ce06fbc5bb76a58c5ca4 password 5f4dcc3b5aa765d61d8327deb882cf99 : :

Slide 46

Slide 46 text

ݯ૾ܭࢉʹΑΔ߈ܸͷରࡦ2 • Ϣʔβ͕ͲΜͳύεϫʔυΛ෇͚ͯ΋ςʔϒϧʹͦ Ε͕ݱΕͳ͍༷ʹ͢Δɻ • ͦͷͨΊʹɺݩσʔλʹιϧτΛ௥Ճ͢Δɻ • લͷέʔεͱಉ͡ɻ • ϋογϡͱฉ͍ͨΒιϧτ͸ʁͱࢥ͏͙Β͍Ͱྑ͍ɻ • ͪͳΈʹ͜ͷςʔϒϧɺ͘͢͝σΧ͍ɻ • 4จࣈͰ640MBɺ5จࣈͰ50GBɺ8จࣈͰ12PBɻ • ϨΠϯϘʔςʔϒϧͱ͍͏ํ๏͕͋Δɻ IUUQXXXTMJEFTIBSFOFUIJNBSVTBMU ࢀߟ

Slide 47

Slide 47 text

ϋογϡ஋ͷিಥ

Slide 48

Slide 48 text

ϋογϡ஋ͷিಥ • ϋογϡ஋ͷিಥ:  ผͷσʔλΛϋογϡؔ਺ʹೖΕ͍ͯΔͷʹɺಉ͡ϋογϡ஋ ͕ग़͖ͯͯ͠·͏͜ͱɻ • ͲΜͳϋογϡؔ਺ΛબΜͰ΋ϋογϡ஋͸ඞͣিಥ͢Δɻ ݩσʔλ 32bit ϋογϡ 2bit data 1 data 2 data 3 data 4 hash 1 hash 2 hash 3 hash 4 data 5

Slide 49

Slide 49 text

Slide 50

Slide 50 text

Slide 51

Slide 51 text

Slide 52

Slide 52 text

Slide 53

Slide 53 text

Slide 54

Slide 54 text

ϋογϡ஋͕িಥ͢Δલఏͷઃܭ • ϋογϡ஋͸ඞͣিಥ͢Δ • ϋογϡΛ࢖͏৔߹ʹ͸িಥͨ͠ΒࠔΔ͔ࠔΒͳ͍͔Λඞͣ ߟ͑Δɻ • URLͷྫͳͲɺϢχʔΫͰͳ͍ͱࠔΔ΋ͷ͸ɺඞͣিಥͯ͠ ͍ͳ͍͔ͷνΣοΫΛ͢Δɻ • ύεϫʔυͷྫ͸িಥͯ͠΋͔·Θͳ͍ɻ • ʮͦͷϋογϡΛDBʹอଘ͢Δ࣌ʹɺͦͷΧϥϜ͕ϢχʔΫ Ͱ͋Δඞཁ͕͋Δ͔ʯ

Slide 55

Slide 55 text

ଥ౰ͳιϧτͱ͸ • ιϧτͱͯ͠ଥ౰ͳจࣈྻ͸Կ͔ • ௕͕͞ҰఆҎ্͋Δ͜ͱ͚ͩͲ… • ௕͍ιϧτ͸ϋογϡؔ਺ʹೖྗ͢Δσʔλͷ৘ใྔΛ૿΍͢ɻ • ৘ใྔ͕૿͑ΔͱিಥΛى͜͠΍͘͢ͳΔ͔΋͠Εͳ͍ɻ • Ұൠతʹ࢖༻͞ΕΔϋογϡؔ਺͸͜ͷ༷ͳʮ͍ۙσʔλʢι ϧτ͕ಉ͡Ͱݩσʔλ෦෼͚͕ͩҧ͏σʔλʣʯ͕িಥ͠ʹ͘ ͍༷ʹઃܭ͞Ε͍ͯΔɻ • 20จࣈఔ౓ɺͱ͔ɺ26จࣈఔ౓ɺͱ͔͍Ζ͍ΖݴΘΕ͍ͯΔɻ

Slide 56

Slide 56 text

·ͱΊ

Slide 57

Slide 57 text

·ͱΊ • ϋογϡͱ҉߸͸ҧ͏Αɻ • ϋογϡ΍҉߸Λ࢖͏࣌͸ɺͳͥͦΕΛ࢖͏͔ɺ ͳͥͦͷ൑அΛ͢΂͖͔Λߟ͑Α͏ɻ • ϋογϡΛ࢖͏৔߹͸… • ඞͣɺιϧτΛ෇͚Α͏ɻ • ඞͣɺিಥͯ͠΋ྑ͍͔Λߟ͑Α͏ɻ

Slide 58

Slide 58 text

ʮύεϫʔυͷϋογϡԽʯͱ͔  ೉͍͠ͱ͜Ζ͸͍͍ͨͯ  ಄͍͍ਓ͕ߟ͑ͯ࢓૊ΈΛ ࡞ͬͯ͘Ε͍ͯΔ

Slide 59

Slide 59 text

ڊਓͷݞʹ৐Ζ͏

Slide 60

Slide 60 text

ͨͩ͠

Slide 61

Slide 61 text

த਎Λཧղͤͣʹ ͳΜͱͳ͘࢖͏ͷ͸࠷ѱ

Slide 62

Slide 62 text

ҙຯ͕ແ͍͚ͩͳΒྑ͍͕ɺ ͔ͤͬ͘ߟ͑ΒΕͨ࢓૊ΈΛ ࡴ͢͜ͱʹ΋ͳΓಘΔ

Slide 63

Slide 63 text

No content

Slide 64

Slide 64 text

No content

Slide 65

Slide 65 text

No content

Slide 66

Slide 66 text

ࣗ෼͸ԿΛ͍ͨ͠ͷ͔ Drupal͸ԿΛ༩͑ͯ͘Ε͍ͯΔͷ͔ ͪΌΜͱཧղͯ͠ɺਖ਼͘͠࢖͓͏

Slide 67

Slide 67 text

ͦͯ͠…

Slide 68

Slide 68 text

͜ͷखͷ ʮಛఆͷ੡඼ʹґଘ͠ͳ͍஌ࣝʯ͸ ΤϯδχΞͷ݂ͱͳΓ೑ͱͳΓɺ ΤϯδχΞͱͯ͠ੜ͖͍ͯͨ͘Ίͷ ྗʹͳΔ

Slide 69

Slide 69 text

ʮྗ͕…ཉ͍͔͠…ʯ

Slide 70

Slide 70 text

͜͏͍͏஌ࣝΛͲ͏΍ͬͯಘΔ͔ • ϋογϡʹݶΒͣɺιϑτ΢ΣΞ։ൃʹ͸ଟ͘ͷप ล஌͕ࣝඞཁɻ • ৘ใܥͷେֶ΍ઐ໳ֶߍͰ͸ڭΘΔʢ͸ͣʣɻ • ମܥతʹ޿ֶ͘ͿͷͰ͋Ε͹ࢿ֨ࢼݧ͕ศརɻ • IPAʢ৘ใॲཧਪਐػߏʣͷ  ʮ৘ใॲཧٕज़ऀࢼݧʯ͕͓͢͢Ίɻ http://www.jitec.ipa.go.jp

Slide 71

Slide 71 text

ऴ