TCP MD5もう辞めよ? / We shouldn't rely on TCP MD5

Transcript

1. TCP MD5 ΋͏ࣙΊΑ?
   ҏ೾
   ݯଠ IHANet ௒υϥϑτ൛ (2017-07-26)
   5$1
   .%ͷ࿩
   
   

2. ࢲͷݏ͍ͳ΋ͷ
   •  ແҙຯͳ͜ͱ •  ཧ۶΍ཪ෇͚ͳ͘ɺʮͳΜͱͳ͘ʯ࣮૷͞Ε͍ͯΔ΋ͷ͝ͱ •  ྫ) ҉߸ԽZIPϑΝΠϧΛϝʔϧఴ෇͠ύεϫʔυΛฏจͰૹ ෇ • 

   ྫ) TCP MD5 ←ࠓ೔ͷ࿩ 5$1
   .%ͷ࿩
   
   

3. TCP MD5ʹ͍ͭͯ
   •  MD5Λ༻͍ͨిࢠॺ໊(MAC)ɺTCPϖΠϩʔυʹిࢠॺ໊Λ෇༩͢ Δ •  MD5: ڧিಥ଱ੑ͸͍·΍ඓՎަ͡ΓʹಥഁͰ͖Δͱ͞Ε͍ͯΔ (TBL: ΤϏσϯε)ɻऑিಥ଱ੑͷಥഁ΋ࡢࠓͷۚࢳͰύϫʔ͕ख

   ʹೖΔΫϥ΢υ؀ڥΛߟྀ͢Δͱة͏͍ͱࢥΘΕΔ(ཁΤϏσϯε) •  ΋͸΍ిࢠॺ໊ʹ࢖͏ϋογϡؔ਺ͱͯ͠͸ద͞ͳ͍(ةຆԽͯ͠ ͍Δ)ঢ়گ –  ຊདྷͷ໨త: TCPϖΠϩʔυͷվ͟Μ๷ࢭͷ໾ʹ͸ཱͨͳ͍ͱࢥͬͨ΄͏͕Α͍ •  ୅ସͷ࣮૷΋͋Δ: TCP-AO (RFC5925, RFC5926) –  SHA256౳͕࢖͑ΔΒ͍͠ •  TCP-AO͕࣮૷ࡁͳΒTCP MD5ΑΓͪ͜ΒΛ࢖͏΂͖ͱ͞Ε͍ͯΔ (RFC7454) 5$1
   .%ͷ࿩
   
   

4. ٙ໰
   •  TCP MD5: ΋͸΍ຊདྷͷվ͟Μ๷ࢭͷ༻్͸Ռͨͣ͞ɺ҉߸త ʹ͸ແҙຯͷঢ়گ •  ے͕௨͍ͬͯΔͱࢥΘ͖͠୅ସ: –  TCP-AO

   –  TCP MD5 ͳ͠ + BGP4ϐΞ͸filterΛݫີʹॻ͍͕ͯΜ͹Δ (IXηάϝϯτ಺Ͱ͸ MAC addressϕʔεͰϑΟϧλϦϯά͢Δͱ͔) –  BGP4 over IPsec •  ΋͸΍ҙຯ͕ͳ͍ͷʹɺͦΕͰ΋ͳ͔ͥTCP MD5Λ͚͕ͭͨ Δਓୡ͕͍ΔɻԿނ? –  ؍ଌൣғͰ͸ɺ͚͕ͭͨΔͷ͸೔ຊਓ͚ͩͳؾ͕͢Δ͕... 5$1
   .%ͷ࿩
   
   

5. ٙ໰ (2)
   •  ᐌ͘ʮ҉߸తʹ͸ҙຯ͕ͳ͍ͷ͸ঝ஌͍ͯ͠Δ͕ɺ࡞๏ͱͯͭ͠ ͚Δͷ͕๬·͍͠ʯ –  Α͏͢Δʹʮཧ۶͸ଘࡏ͠ͳ͍͕׳शతʹҙຯͷͳ͍ͷΛঝ஌Ͱ͚͍ͭͯΔʯͱ͍͏ ͜ͱͳΒ͹ɺ΍͸Γ୯ͳΔحशͳͷͰ͸? •  ᐌ͘ʮΦϖϛεΛ๷͛Δʯ

   –  ύεϫʔυ͚ͭΔ͚ͩͰ๷͛ΔͬͯͲΜͳΦϖϛε? –  ΦϖϨʔγϣϯମ੍Λݟ௚ͨ͠ํ͕Α͍ͷͰ͸? •  ᐌ͘ʮASؒͰऔΓަΘ͢ឺͰ͋Δʯ –  ͜Ε͸ͳΜͱͳ͘Θ͔Δؾ͕͢Δ (ҏ೾తʹ͸ (εϐϦνϡΞϧͳҙຯͰ)) –  ڞ௨ͷΩʔϫʔυ͕ઃఆ͞Ε͍ͯͳ͍ͱϐΞ͕ுΕͳ͍Α͏ʹ͢Δɺઐ༻ͷcapability Λ༻ҙ͢ΔɺͳͲͷํ͕ΑΓ࣮֬ʹʮΦϖϛεΛ๷͛ΔʯͷͰ͸ͳ͍͔? –  TCPϔομͷແବͳΦʔόϔου΋ੜ͡ͳ͍ (TBL: ࣮૷ྫ: BIRD, Quagga) 5$1
   .%ͷ࿩