『プロフェッショナル SSL/TLS 読書会』第 10 章

)454 $41 BOE1JOOJOH ʰϓϩϑΣογϣφϧ44-5-4ʱಡॻձ

!IBTIFEIZQIFO w )BTI !IBTIFEIZQIFO w 8FCEFWFMPQFS w +4 3VCZ
4DBMB 3VTU 4FDVSJUZ FUDʜ w 44-ͱಉڃੜ

)454 ઈର)5514ڧ੍͢ΔϚϯ ূ໌ॻΤϥʔΛແࢹ͢Δ உͷࢠͷΠϥετ

)454֓ཁ w 3'$)5514USJDU5SBOTQPSU4FDVSJUZ *&5' w <XFCαΠτଆ>  )5514ͷΈڐՄ͍ͯ͠ΔࢫΛϢʔβ΁એݴͰ͖Δ w
<Ϣʔβଆ>  ΞΫηε࣌ʹϒϥ΢β΁)5514Λڧ੍Ͱ͖Δ w ϓϩτίϧ͸)551ϔομ Strict-Transport-Security: max-age=expireTime [; includeSubDomains]

)454͕ແ͍ੈք w 63-όʔʹlFYBNQMFDPNJOEFYIUNMͱೖྗ  ͞ΕͨΒɺ௨ৗϒϥ΢β͸)551ͰϦΫΤετ  ࠷ॳ͔Β)5514͕ར༻Ͱ͖͔ͨ΋͠Εͳ͍ w ϒϥ΢β͕ग़͢ূ໌ॻΤϥʔΛϢʔβ͸ແࢹ͕ͪ͠ $MJDL5ISPVHI*OTFDVSJUZzGSPN3'$   ຊ౰ʹෆਖ਼ͳূ໌ॻͰ΋௨աͯ͠͠·͏
w ࠞࡏίϯςϯπ  JNHͰεΩʔϜΛमਖ਼͠๨Ε෦෼తʹ)551ͷ݀ w $PPLJFͷ4FDVSFଐੑͱ%PNBJOଐੑ  ଘࡏ͠ͳ͍αϒυϝΠϯ΁ͷ༠ಋ࣌ʹϢʔβ͕  ূ໌ॻΤϥʔΛແࢹ͢Δͱ$PPLJF͕઄औ͞ΕΔ 

)454͕ղܾ͢Δ͜ͱ w )5514Λڧ੍Ͱ͖Δ w εΩʔϜͳ͠Ͱ63-όʔʹೖྗ͞Εͯ΋ )5514Ͱ௨৴Λ։࢝ w ূ໌ॻΤϥʔ࣌ʹʮྫ֎Λ௥Ճʯͤ͞ͳ͍  l/P6TFS3FDPVSTFz
w εΩʔϜΛमਖ਼͠๨ΕͨϦιʔε͕͋ͬͯ΋  ࣗಈͰ)5514ͰGFUDIͯ͘͠ΕΔ w AJODMVEF4VC%PNBJOTAΛซ༻͢Δ͜ͱͰ   ೚ҙͷαϒυϝΠϯ΋)5514ڧ੍Ͱ͖Δ w %PNBJO$PPLJFͷ4FDVSFଐੑ໰୊

)454ͷ࢖͍ํ w ʮূ໌ॻΤϥʔͷͳ͍)5514ʯͷϨεϙϯεͰ  A4USJDU5SBOTQPSU4FDVSJUZAϔομΛฦ͚ͩ͢ w NBYBHF͜ͷϙϦγʔ͕༗ޮͳඵ਺ w JODMVEF4VC%PNBJOTαϒυϝΠϯͰ΋༗ޮʹ w QSFMPBE<࢓༷ະఆٛ>ϒϥ΢βͷ)4541SFMPBE
ର৅ͱͯ͠XFCαΠτΛਃ੥͢Δͱ͖ʹࢦఆ w ্هͷϔομΛϒϥ΢β͕ड͚औ͔ͬͯΒ༗ޮ Strict-Transport-Security: max-age=expireTime [; includeSubDomains] [; preload]

)4541SFMPBE w 4USJDU5SBOTQPSU4FDVSJUZϔομΛड͚औΔલ͸ ґવͱͯ͠)5514ར༻Մೳੑ͸ෆ໌ w )454ΛσϓϩΠ͍ͯ͠Δ͜ͱΛ͋Β͔͡Ίϒϥ΢ βʹొ࿥͓͍ͯͯ͠ɺॳճ͔Β)454Λ༗ޮʹ͠ ͓ͯ͘ 5XJUUFS $ZCP[V
FUD w ϒϥ΢βϕϯμʔΛ୅දͯ͠(PPHMF͕ਃ੥ϑΥʔ ϜΛ؅ཧ͍ͯ͠Δ IUUQTITUTQSFMPBEPSH w NBYBHF೥Ҏ্ɾJODMVEF4VCEPNBJOT QSFMPBEଐੑඞਢ w l5-%1SFMPBEJOHz85'

4FDVSJUZ$POTJEFSBUJPOT 3'$͸l4FDVSJUZ$POTJEFSBUJPOTz͕໘ന͍ w ͳͥ4USJDU5SBOTQPSU4FDVSJUZϔομ͸  ʮূ໌ॻΤϥʔͷͳ͍)5514ʯ͕ඞཁͳͷ͔ ຊདྷ)454͕༗ޮͳXFCαΠτͩͬͨ৔߹  ূ໌ॻΤϥʔ͕ແࢹ͞Εͨঢ়ଶͰNBYBHFͷ ϔομΛฦ͞ΕΔͱ)454͕ແޮԽ͞ΕΔ
ຊདྷ)551͔͠ͳ͍XFCαΠτͩͬͨ৔߹  )551Ϩεϙϯε͕վ᜵͞Εͯ)454Λ༗ޮʹ͞ Εͯ͠·͏ͱɺϦΫΤετ͕)5514ʹม׵͞Ε ͯ͠·͍%P4߈ܸ͕੒ཱ͢Δ ࣾ಺ϓϩΩγαʔόͱ͸૬ੑѱ͍ΑͶ

4FDVSJUZ$POTJEFSBUJPOT ଞʹ΋ w AJODMVEF4VC%PNBJOTA͕%PNBJO$PPLJFͷ  อޢʹ΋໾ཱͭ͜ͱ w 04ͷ࣌ܭΛਐΊΒΕΕ͹ϙϦγʔ͸౰વແޮԽ͞ Ε͏Δ͜ͱ w ِͷϧʔτূ໌ॻ
%/4ΩϟογϡϙΠζχϯά ͷ߹Θٕͤ w ϒϥ΢β಺ʹอଘ͞ΕΔ֤XFCαΠτͷ)454  ৘ใΛ࢖ͬͯ8FC5SBDLJOHͰ͖Δ͜ͱ

)454ΛτϥοΩϯάʹ࢖͏ w )454ʹ͓͚Δϒϥ΢βͷڍಈ͸ɺຊ࣭తʹ  XFCαΠτ΁ͷ๚໰༗ແΛه࿥͢ΔCJU৘ใ w ϫΠϧυΧʔυূ໌ॻΛ༻ҙͯ͠Oݸͷαϒυϝ ΠϯΛ࡞ΓɺͦΕͧΕʹҟͳΔ)454ϙϦγʔΛ ઃఆ͢Ε͹ɺO<CJU>ͷ৘ใΛϒϥ΢β͔Βऔಘ͢ Δ͜ͱ͕Մೳ w
୺తʹมଶ w IUUQTXXXMFWJBUIBOTFDVSJUZDPNCMPHUIF EPVCMFFEHFETXPSEPGITUTQFSTJTUFODFBOE QSJWBDZ

ͦͷଞͷ࿩୊ w NBYBHF͕ܻʹͳΔΑ͏ʹڧ੍੾அ߈ܸΛ͢Δ ͜ͱͰɺ༗ޮظؒΛ࠷େඵ·ͰݮΒͤΔ w

$41 ϔομઃఆ೉͢͠ ΅͘ͷ͔Μ͕͍͖͑ͨ͞ΐ͏ͷ  $41ઃఆΛߟ͍͑ͯΔ  உͷࢠͷΠϥετ

$41֓ཁ w $POUFOU4FDVSJUZ1PMJDZ 8$XFCBQQTFD w $41 $41-FWFM
w ݱࡏ$41-FWFM 8% ͷࡦఆத w ࢓༷ΑΓҾ༻  l5IJTEPDVNFOUEFpOFTBNFDIBOJTNCZ XIJDIXFCEFWFMPQFSTDBODPOUSPMUIF SFTPVSDFTXIJDIBQBSUJDVMBSQBHFDBOGFUDI PSFYFDVUF BTXFMMBTBOVNCFSPGTFDVSJUZ SFMFWBOUQPMJDZEFDJTJPOTz w ϒϥ΢β͕औಘɾ࣮ߦ͢ΔϦιʔεͷ؅ཧ  ͦͷଞԿͰ΋ʢ࣮ࡍ৭ʑ͋Γ͗͢Δʣ

$41ͷ࢖༻ྫ w ϒϥ΢β͕࣮ߦ͢Δ+4ͷಡࠐݩʢΦϦδϯʣΛط ஌ͷ$%/ʹ੍ݶ͠ɺΠϯϥΠϯεΫϦϓτΛແޮ Խͯ͠944Λ๷͍͗ͨ TDSJQUTSD w ϓϥάΠϯͷ࣮ߦΛېࢭ͍ͨ͠ PCKFDUTSD
w A$POUFOU4FDVSJUZ1PMJDZAϔομ͕Ϩεϙϯεʹ ؚ·Ε͍ͯͨϖʔδͰ༗ޮʹͳΔ w ͓खܰʹࢼ͍ͨ͠ͱ͖͸  <meta http-equiv="Content-Security-Policy"> Content-Security-Policy: script-src https://cdn.example.com/scripts/; object-src 'none'

)454ͱͷҧ͍ w ༗ޮظؒͷ֓೦͕ͳ͍ w $POUFOU4FDVSJUZ1PMJDZϔομ͕Ϩεϙϯεʹ ؚ·Ε͍ͯͨͱ͖͚ͩద༻͞ΕΔ w $41ͷઃఆΛؒҧͬͯσϓϩΠͯ͠͠·ͬͯ΋ ൺֱతૣΊʹແޮԽɾमਖ਼Ͱ͖Δ w
$POUFOU4FDVSJUZ1PMJDZ3FQPSU0OMZϔομΛ ࢖͏ͱESZSVO͕Ͱ͖ΔʢϒϩοΫର৅ͱͳΔεΫ ϦϓτͳͲΛใࠂ͚ͩͯ͘͠ΕΔʣ

$41ͷσΟϨΫςΟϒ w IUUQTXXXXPSH53$41DTQEJSFDUJWFT w DIJMETSD w DPOOFDUTSD w EFGBVMUTSD w
GPOUTSD w GSBNFTSD w JNHTSD w NBOJGFTUTSD w NFEJBTSD w PCKFDUTSD w TDSJQUTSD w TUZMFTSD w XPSLFSTSD w CBTFVSJ w QMVHJOUZQFT w TBOECPY w EJTPXOPQFOFS w GPSNBDUJPO w GSBNFBODFTUPST w SFQPSUVSJ w SFQPSUUP

$41ͷσΟϨΫςΟϒ σΟϨΫςΟϒ͕ແݶʹ૿͖͑ͯͨͷͰɺ  ֎෦࢓༷ͱͯ͠σΟϨΫςΟϒΛ௥ՃͰ͖ΔΑ͏ lNPEVMBSFYUFOTJCJMJUZzΛ೦಄ʹஔ͔Ε͍ͯΔ ྫ w ACMPDLBMMNJYFEDPOUFOUA w AVQHSBEFJOTFDVSFSFRVFTUTA w
ASFRVJSFTSJGPSA 4VCSFTPVSDF*OUFHSJUZ ৽͍͠σΟϨΫςΟϒͷڍಈͱͯ͠ఆٛ͢΂͖΋ͷ͕ 5FNQMBUF.FUIPE1BUUFSOతʹ$41ͷ࢓༷͕ఆٛ  ͍ͯ͠ΔͨΊɺ֎෦࢓༷ʹΑΔ֦ு͕Մೳ

$41ͷσΟϨΫςΟϒ w ACMPDLBMMNJYFEDPOUFOUA w )5514ͰTFSWF͞Εͨϖʔδ಺͔Β෭࣍తͳ )551ϦΫΤετΛ͢΂ͯःஅ w AVQHSBEFJOTFDVSFSFRVFTUTA w ೚ҙͷ)551ϦΫΤετΛ͢Δલʹ͢΂ͯ
)5514΁มߋ )454ͱ΄΅ಉ͡

"DLOPXMFEHFNFOUT͕೤͍ w l-PUTPGQFPQMFBSFBXFTPNF'PSJOTUBODF .BSJPBOEBMMPG$VSFʜz w ͝ଘ஌$VSFͷ%S*OH.BSJP)FJEFSJDI w )4$.JOJDIBMMFOHFl4I U JUT$41zͰ$41
Λ୊ࡐͱͨ͠944$IBMMFOHFΛߟҊ͢ΔͳͲ  ଟେͳߩݙ w $POUFOU4FDVSJUZ1PMJDZEFGBVMUTSDTFMG BKBYHPPHMFBQJTDPNͷঢ়گͰ944͢Δʹ͸ w IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ )4$.JOJDIBMMFOHF4I U JUT$41

ϐϯχϯά 50'6ٕज़ͷҰྫ 50'6

ϐϯχϯά֓ཁ w ϐϯχϯάͱ͍͑͹)5511VCMJD,FZ1JOOJOH )1,1 Λ࿈૝͢Δํ΋ଟ͍ʁ w ͜ͷষͰ͸ɺূ໌ॻ΍ެ։伴ʹ͓͍ͯ  ΑΓҰൠతͳϐϯχϯάٕज़ʹ͍ͭͯઆ໌ w ূ໌ॻɾެ։伴͸ຊ࣭తʹ೚ҙͷओମͷࣝผࢠ
w ࣝผࢠͱಛఆͷαʔϏεΛ݁ͼ͚ͭΔʢϐϯཹΊʣ ͜ͱ͕ʮϐϯχϯάʯ

ͳͥϐϯχϯάΛ͢Δ͔ ূ໌ॻΛൃߦ͢Δ$"Λݶఆ͢Δ w 1VCMJD$"ϞσϧͰ͸ɺূ໌ॻΛൃߦ͢Δࡍʹυϝ Πϯॴ༗ऀͷঝೝ͕ʮ͍Βͳ͍ʯ w ༩Γ஌Β͵ͱ͜ΖͰ୭͔͕ͳΓ͢·ͯ͠ূ໌ॻΛൃ ߦ͢ΔՄೳੑ͕͋Δ w ͋Δ$"͔Βൃߦ͞Εͨূ໌ॻΛαʔϏεʹϐϯ
χϯά͢Δ͜ͱͰɺͦΕҎ֎ͷ$"Ͱޡൃߦ͞Εͯ ѱ༻͞ΕΔϦεΫΛݮΒͤΔ

ͳͥϐϯχϯάΛ͢Δ͔ 伴ܧଓ؅ཧ ,FZ$POUJOVJUZ ʹ࢖͏ w ݕূͰ͖ͳ͍αʔόূ໌ॻΛϒϥ΢βʹྫ֎ͱͯ͠ ొ࿥͢Δɺ44)Ͱ઀ଓઌͷࢦ໲ΛهԱ͢ΔͳͲ w Ұ౓ਖ਼͍͠ʢͱ৴ͨ͡ʣ΋ͷΛهԱ͢Ε͹  ࣍ճҎ߱ʹड͚औͬͨ΋ͷΛਖ਼͍͠ʢͱ৴͍ͯ͡Δʣ
΋ͷͱൺֱͰ͖Δ w 5SVTU0O'JSTU6TF50'6 w l50'6zͷॳग़͸6TFOJYͷQBQFSΒ͍͠

ԿΛϐϯχϯά͢Δ͔ w ಉ͡ެ։伴ʹෳ਺ͷূ໌ॻ͕ඥ෇͖͏Δ w ެ։伴Λϐϯχϯά͢Δࡍʹ͸ 4VCKFDU1VCMJD,FZ*OGP 41,* ͕ศར w "MHPSJUIN*EFOUJpFS͕ਅਖ਼ੑͷݕূʹ΋࢖͑Δ
# RFC 5280 Sec. 4.1 SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING }

Subject: CN=hashedhyphen.com Subject Public Key Info: Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit) Modulus (2048 bit): 00:a8:f2:7d:cb:39:e3:d6:9c:30:7d:63:eb:cc:f2: ff:ea:40:07:b3:bb:30:21:4f:2a:1c:fb:ba:1b:f5: 1c:af:36:a6:03:f9:85:3f:50:5b:21:05:b6:f5:79: bb:e9:f9:f1:30:bc:28:07:85:13:0c:33:6e:8a:24: 33:9f:83:6d:f6:69:27:ee:4f:a8:13:b2:fe:52:e1: 06:cb:da:a0:85:df:b8:09:a3:97:1b:8d:e7:20:0b: 70:40:53:0a:ea:50:e7:60:03:70:ce:f4:35:4d:2c: 5c:ae:d0:4c:b8:7c:a3:d5:d7:13:c0:e0:d3:85:8b: 2d:7e:f2:0a:08:f1:06:9d:79:2d:40:c1:4d:93:71: 2d:d3:12:05:29:50:f6:a4:2e:7e:3d:27:7e:38:81: 51:21:0b:32:f7:37:b9:24:82:0b:e1:78:05:50:2c: e0:63:1d:d3:44:fb:57:be:ca:d0:e6:3f:31:1c:0c: 45:5c:43:df:69:cd:6f:fd:5c:2e:c9:e9:93:91:18: f7:e3:28:d3:2e:68:0f:bd:a7:59:1a:98:c9:08:61: 04:e7:e1:81:74:31:3d:43:1f:91:c7:90:c7:f6:54: 10:10:77:88:e8:fa:82:8f:8e:79:3d:05:e0:3a:96: c0:8e:60:28:e1:ab:1b:8e:51:36:45:c2:be:f8:2b: a2:ff Exponent: 65537 (0x10001)

Ͳ͜ʹϐϯཹΊ͢Δ͔ *.0Ͳ͜ʮΛʯϐϯཹΊ͢Δ͔ɺͱಡΈ͍ͨ w αʔόূ໌ॻʢͷ41,*ʣΛϐϯχϯά͢Δ৔߹ɺެ։伴Λఆ ظతͳೖΕସ͑΍ɺಉ͡ϗετ໊Ͱෳ਺ͷূ໌ॻΛར༻͢Δ৔ ߹ʹ໘౗ w தؒ$"΍ϧʔτ$"ͷূ໌ॻΛϐϯχϯά͢Δ৔߹ɺαʔ όূ໌ॻ͕औΓಘΔ೚ҙͷݕূύεΛαϙʔτ͢Δඞཁɺ࣍ճ ͷαʔόূ໌ॻߋ৽࣌ʹطଘͷݕূύε্ʹ͓͚Δ$"͕ม
ΘΔՄೳੑ͕͋ͬͯ໘౗ w αʔόূ໌ॻʹॺ໊͕ඞؚͣ·Ε͍ͯΔͷͰɺ  ࠷Լ૚ͷதؒ$"Λϐϯχϯάͯ͠ɺ࣍ճͷূ໌ॻߋ৽࣌ʹ ϐϯχϯά͕յΕͳ͍Α͏ͳӡ༻Λґཔʁ w ଞͷ$"͔Βऔಘͨ͠ূ໌ॻΛ༧උʹඞͣ༻ҙ͢Δ w BOETPPOʜ

Ͳ͜ʹϐϯཹΊ͢Δ͔ ʮϐϯχϯάͷӡ༻Ͱ࠷΋ޮՌతͳͷ͸ɺࣗ෼ࣗ਎Ͱ தؒ$"Λॴ༗͢Δ͜ͱͰ͢ɻʯ

Ͳ͜ʹϐϯཹΊ͢Δ͔ ͦΕ͸ͦ͏

ωΠςΟϒΞϓϦͰͷϐϯχϯά w ΞϓϦͷόΠφϦ഑෍࣌ʹূ໌ॻΛόϯυϧ w +BWBͷτϥετετΞͷΠϝʔδʁ w αʔόαΠυ͕ωΠςΟϒΞϓϦ͔ΒͷΈͷΞΫη εͰ͋Ε͹ׂͱݱ࣮త w "OESPJE͸ূ໌ॻϐϯχϯάΛαϙʔτ͍ͯ͠Δ
ʢΒ͍͠ʣ

)1,1 w 3'$1VCMJD,FZ1JOOJOH&YUFOTJPOGPS )551 w ϓϩτίϧ͸)551ͷ1VCMJD,FZ1JOTϔομ w )454ͱಉ͘͡NBYBHFΛࢦఆ͠ɺϋογϡؔ਺
ͷΞϧΰϦζϜͱ41,*ͷϋογϡ஋Λࢦఆͯ͠ϐ ϯχϯάΛද໌͢Δ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

)1,1 w ඞͣͭҎ্ϐϯχϯά͢Δඞཁ͕͋Δ w ͔֤ͭʑ͕ผʑͷূ໌ॻνΣʔϯʹ͋Δඞཁ w )1,1͕ಈ࡞ͤͣʹCVH[JMMBNP[JMMBPSHʹ ʮ)1,1ಈ͍ͯͳ͍Μ͚ͩͲόάʁʯͬͯฉ͍ͨΒ ʮূ໌ॻݸ͔͠ϐϯχϯάͯ͠ͳ͍΍Μ͚ʯ  ͬͯࢦఠ͞Εͨࢥ͍ग़ʢஏ͔͍ͣ͠ʣ
Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

)1,1 w ඞͣͭҎ্ϐϯχϯά͢Δඞཁ͕͋Δ w ͔֤ͭʑ͕ผʑͷূ໌ॻνΣʔϯʹ͋Δඞཁ w )1,1͕ಈ࡞ͤͣʹCVH[JMMBNP[JMMBPSHʹ ʮ)1,1ಈ͍ͯͳ͍Μ͚ͩͲόάʁʯͬͯฉ͍ͨΒ ʮূ໌ॻݸ͔͠ϐϯχϯάͯ͠ͳ͍΍Μ͚ʯ  ͬͯࢦఠ͞Εͨࢥ͍ग़ʢஏ͔͍ͣ͠ʣ
w 1VCMJD,FZ1JOT3FQPSU0OMZϔομΛ࢖͑͹ ESZSVOͰ͖Δ Public-Key-Pins: max-age=2592000; pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g="; pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="

%"/& w %/4#BTFE"VUIFOUJDBUJPOPG/BNFE&OUJUJFT w )5514PO5-4͸αʔόূ໌ॻͷݕূΛ5-4্ Ͱ΍Δ΋ͷ w ͦΕ%/44&$Ͱ΍Ε͹ྑ͘ͳ͍ʁ

%"/&WT5-4 ݱࡏͷ5-4ೝূͷϞσϧ͸ w ʢʣຊ෺ͷυϝΠϯ໊ॴ༗ऀʹͷΈূ໌ॻΛൃߦ ͢ΔΑ͏ͳ৴པͰ͖Δ$"͕·ͣ͋ͬͯɺ ͦͷ͏͑Ͱ w αΠτʹΞΫηε͕͋ͬͨͱ͖ʹ͸͍ͭ΋ɺʢʣ ҙਤ໊ͨ͠લͲ͓Γূ໌ॻ͕ਖ਼͍͜͠ͱΛϢʔβΤʔ δΣϯτʢϒϥ΢βͳͲʣ͕͔֬ΊΔɺ
ͱ͍͏ஈ֊ͷϞσϧͰߏ੒

%"/&WT5-4 ݱࡏͷ5-4ೝূͷϞσϧ͸ w ʢʣຊ෺ͷυϝΠϯ໊ॴ༗ऀʹͷΈূ໌ॻΛൃߦ͢ ΔΑ͏ͳ৴པͰ͖Δ$"͕·ͣ͋ͬͯɺ ͦͷ͏͑Ͱ w αΠτʹΞΫηε͕͋ͬͨͱ͖ʹ͸͍ͭ΋ɺʢʣҙ ਤ໊ͨ͠લͲ͓Γূ໌ॻ͕ਖ਼͍͜͠ͱΛϢʔβΤʔδΣ ϯτʢϒϥ΢βͳͲʣ͕͔֬ΊΔɺ
ͱ͍͏ஈ֊ͷϞσϧͰߏ੒ w %/44&$͕࢖͑Ε͹ɺड৴ͨ͠υϝΠϯʹ͍ͭͯͷ ৘ใ͸υϝΠϯ໊ॴ༗ऀ͔Βͷ΋ͷͰ͋Δͱ֬৴Ͱ ͖ΔͷͰ$"͕ඞཁͰ͸ͳ͍

%"/&ͷϢʔεέʔε ࣗݾॺ໊ূ໌ॻͷ҆શͳσϓϩΠ w ࠓ·Ͱͷ5-4ͩͱඞͣূ໌ॻΤϥʔ͕ग़Δ w ʮҰൠతͳʯϢʔβ͸ແࢹ͢Δ͚Ͳʜ·͋ w ໰୊͸ʮਖ਼͍͠ʯΤϥʔͱࣗݾূ໌ॻͷݕূΤϥʔ ͕۠ผ͔ͭͳ͍
w %/44&$͕͋Ε͹ɺ໊લղܾ͢ΔυϝΠϯॴ༗ ऀͷਅਖ਼ੑΛ֬อͰ͖Δ͔ΒԿͰ΋҆શʹϐϯχ ϯάͰ͖ΔΑͶ w ಠࣗϧʔτূ໌ॻͩͬͯϐϯχϯάͰ͖ͪΌ͏

%"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ ϙʔτ൪߸ʢΞϯμʔείΞલஔʣ ϓϩτίϧʢΞϯμʔείΞલஔʣ ׬શम০υϝΠϯ໊ _443._tcp.www.example.com.
IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

%"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w $FSUJpDBUF6TBHF w 1,*95" $"ূ໌ॻ νΣʔϯ্
w 1,*9&& &OE&OUJUZূ໌ॻ νΣʔϯઌ಄ w ʜ _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

%"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w 4FMFDUPS w $FSU ূ໌ॻϐϯχϯά w
41,* ެ։伴 41,* ϐϯχϯά _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

%"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w .BUDIJOH5ZQF w 'VMM ௚઀ൺֱ w
4)" ϋογϡൺֱ w 4)" ϋογϡൺֱ PQUJPOBM _443._tcp.www.example.com. IN TLSA ( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

%"/&ͷ࣮૷ɾσϓϩΠ w 5-4"ϨίʔυΛκʔϯϑΝΠϧͰఆٛ w $FSUJpDBUF"TTPDJBUJPO%BUB w લͭͷ஋ͷ૊߹ͤʹରԠ͢Δϐϯχϯά஋ _443._tcp.www.example.com. IN TLSA
( 0 1 1 d2abde240d7cd3ee6b4b28c54df034b9 7983a1d16e8a410e4561cb106618e971 )

%"/&WT)1,1 w ෳ਺ͷ5-4"ϨίʔυΛ࢖ͬͯෳ਺ϐϯχϯάͰ ͖Δʢಉ͡ʣ w %/4ͷ55-ͱ͍͏༗ޮظ͕ؒ͋Δʢಉ͡ʣ w ͨͩ͠ɺϓϩτίϧࣗମ͸໌ࣔతͳ༗ޮظؒΛ࣋ͬ ͍ͯͳ͍ͷͰɺ%/4ͷઃఆมߋͰमਖ਼Մೳʢڧʣ w
ESZSVOతͳϨϙʔτػೳ͕ͳ͍ʢऑʣ

%"/&JOݱ৔ w ओཁϒϥ΢βະαϙʔτ

5"$, w 5SVTU"TTFSUJPOTGPS$FSUJpDBUF,FZT w 1VCMJD$"ͱ%/4͔Β΋ಠཱٕͨ͠ज़ఏҊ w 5-4ͷ$MJFOU)FMMPΛ֦ு͢Δ w αʔόࣗ਎͕ੜ੒ͨ͠ॺ໊伴Ͱϐϯχϯά w
೚ҙͷϓϩτίϧ͔Βಠཱ͍ͯ͠Δ͕ෳࡶ

『プロフェッショナル SSL/TLS 読書会』 第 10 章

『プロフェッショナル SSL/TLS 読書会』 第 10 章

More Decks by Ryo Kato

Other Decks in Technology

Featured

Transcript

『プロフェッショナル SSL/TLS 読書会』第 10 章

『プロフェッショナル SSL/TLS 読書会』第 10 章