Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
疑似乱数の作り方・使い方 ゲームから情報セキュリティまで / jeita-20171026
Search
Kenji Rikitake
October 26, 2017
Technology
1
630
疑似乱数の作り方・使い方 ゲームから情報セキュリティまで / jeita-20171026
JEITA (電子情報技術産業協会) 第4回 ハードウェアセキュリティ技術分科会 発表原稿
Kenji Rikitake
October 26, 2017
Tweet
Share
More Decks by Kenji Rikitake
See All by Kenji Rikitake
SDR Implementation of Analog FM Broadcast Multipath Filter
jj1bdx
0
620
インターネットとオープンな無線技術の今後 / Future of Internet and Open Radio Engineering
jj1bdx
0
1.1k
FM放送とマルチパスを適応フィルタで極めてみた / Solving multipath distortion of FM broadcast by adaptive filters
jj1bdx
1
3.2k
ソフトウェアラジオとC++ そしてFMエアチェックのための信号解析と数値計算にまつわるよもやま話 / Software radio and C++
jj1bdx
0
820
SDR時代のFM受信 マルチパスモニタとマルチパスフィルタ / FM broadcast reception with SDR - multipath monitor and multipath filter
jj1bdx
0
430
How I discover a working implementation of clock_nanosleep() for macOS in CPAN Time::Hires
jj1bdx
1
970
Sleeping pays / 1000eng-74th-jj1bdx
jj1bdx
1
34
The BEAM Programming Paradigm
jj1bdx
1
770
Safe randomness: theory and practice
jj1bdx
1
1.2k
Other Decks in Technology
See All in Technology
LangSmith入門―トレース/評価/プロンプト管理などを担うLLMアプリ開発プラットフォーム
os1ma
3
120
GraphQL 成熟度モデルの紹介と、プロダクトに当てはめた事例 / GraphQL maturity model
mh4gf
7
1.3k
家族アルバム みてねにおけるGrafana活用術 / Grafana Meetup Japan Vol.1 LT
isaoshimizu
1
720
ExaDB-D dbaascli で出来ること
oracle4engineer
PRO
0
2.1k
On Your Data を超えていく!
hirotomotaguchi
2
680
require(ESM)とECMAScript仕様
uhyo
3
630
Postman v10リリース後を振り返る / Looking back at Postman v10 after release
yokawasa
1
160
生産性向上チームの紹介
cybozuinsideout
PRO
1
870
Delivering Millions of Messages within seconds @ Duolingo
pelelgrino
0
350
一生覚えておきたい「システム開発=コミュニケーション」〜初めての実務案件振り返りLT〜
maimyyym
0
140
Além do else! Categorizando Pokemóns com Pattern Matching no JavaScript
wmsbill
0
620
DevOpsDays History and my DevOps story
kawaguti
PRO
9
2.5k
Featured
See All Featured
Atom: Resistance is Futile
akmur
259
25k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
17
1.4k
How GitHub Uses GitHub to Build GitHub
holman
468
290k
Visualization
eitanlees
136
14k
Optimising Largest Contentful Paint
csswizardry
8
2.4k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
2
3.4k
Optimizing for Happiness
mojombo
370
69k
Intergalactic Javascript Robots from Outer Space
tanoku
266
26k
Become a Pro
speakerdeck
PRO
11
4.5k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
241
1.2M
Building Better People: How to give real-time feedback that sticks.
wjessup
355
18k
Code Reviewing Like a Champion
maltzj
514
39k
Transcript
ٙࣅཚͷ࡞Γํɾ͍ํ ήʔϜ͔ΒใηΩϡϦςΟ·Ͱ ྗ ݈࣍ ྗ݈ٕ࣍ज़࢜ࣄॴ 201710݄26 JEITA ୈ4ճϋʔυΣΞηΩϡϦςΟٕज़Պձ Kenji Rikitake
/ JEITA 26-OCT-2017 1
ࣗݾհ (1/2) 1990ΑΓΠϯλʔωοτٕज़ ͷݚڀ։ൃʹैࣄ 2010ʙ2013: ژେֶ ใ ڥػߏ ڭतͱͯ͠ಉେֶͷશ ֶใηΩϡϦςΟରࡦΛ୲
2011/2012: ACM SIGPLAN Erlang Workshop ʹͯٙࣅཚ SFMTͱTinyMTͷErlang/OTPฒ ߦॲཧγεςϜͷ࣮Λൃද Kenji Rikitake / JEITA 26-OCT-2017 2
ࣗݾհ (2/2) 20144݄ΑΓྗ݈ٕ࣍ज़࢜ ࣄॴॴͱͯ͠ಠཱ 2015: Erlang/OTP ͷٙࣅཚ ϥΠϒϥϦ rand ϞδϡʔϧΛ։
ൃ όʔδϣϯ18.0ΑΓ࠾༻ 2016: Arduino UnoͰཧཚ ʹجͮ͘ిࢠαΠίϩ avrdice ʢࣸਅʣΛ։ൃɺMaker Faire Tokyo 2016ʹͯలࣔ Kenji Rikitake / JEITA 26-OCT-2017 3
ٙࣅཚͱ Kenji Rikitake / JEITA 26-OCT-2017 4
ͦͷલʹ ཚͱ? Kenji Rikitake / JEITA 26-OCT-2017 5
ཚྻͱ༧ଌෆೳੑ ݱࡏಘΒΕ͍ͯΔྻ͔Βະདྷ͕༧Ͱ͖ͳ͍ྻ 1 ཚͱཚྻͷཁૉʢ͋Δ͍ཚྻࣗʣ ిࢠճ࿏ͷʮࡶԻʯʹ૬ ༧ଌෆೳੑΛʮϥϯμϜωεʯͱ͍͏ ϥϯμϜωεʮใΤϯτϩϐʔʯͷҰཁૉ 2 2 খીಓʮΘ͔Γ͍͢ΦʔτϙΠΤʔγε(ࣗݾੜ࢈)ʯΑΓʮใΤϯτϩϐʔʯ
1 Wikipedia ʮཚྻʯΑΓൈਮ Kenji Rikitake / JEITA 26-OCT-2017 6
ϥϯμϜωεΛࣔ͢ཧݱ ࡶԻ → ߅ͷੜ͢ΔࡶԻ ΞόϥϯγΣ߱෬ → πΣφʔμΠΦʔυͷࡶԻ ಋମͷԆ࣌ؒͷόϥπΩ → ࣗྭൃৼͷΏΒ͗
ݪࢠ่֩յͷִ࣌ؒؒʢΨΠΨʔΧϯλʔʣ ͦͷଞɺྔࢠྗֶతෆ֬ఆੑͳͲ ʢʮࡶԻʯݯΛԿʹٻΊΔ͔ʹؼணʣ Kenji Rikitake / JEITA 26-OCT-2017 7
ཧཚ ϥϯμϜωεΛࣔ͢ཧݱʹΑΔཚྻ هͰ͖Δ͕࠶ݱͰ͖ͳ͍ ಘΒΕΔϥϯμϜωε༗ݶ →ޙड़͢ΔٙࣅཚʹൺߴԽ/େ༰ྔԽ͕ࠔ ੜஔͷཧత߈ܸ͕Մೳ →ੜ͞Εͨཚ͔Β߈ܸΛ͢Δ͜ͱࠔ Kenji Rikitake /
JEITA 26-OCT-2017 8
9
૿෯લͷࡶԻ Kenji Rikitake / JEITA 26-OCT-2017 10
૿෯ޙͷϥϯμϜͳϏοτྻ Kenji Rikitake / JEITA 26-OCT-2017 11
2ͭͷಠཱͨ͠ճ࿏ͷग़ྗ Kenji Rikitake / JEITA 26-OCT-2017 12
ϑΥϯɾϊΠϚϯɾϑΟϧλ ΑΓߴ͍࣭ͷཧཚΛಘΔͨΊͷํ๏ 1ϏοτಘΔͨΊʹ2ϏοταϯϓϦϯά͢Δ 1ͭ 2ͭ ݁Ռ 0 0 ແࢹʢ࠶ࢼߦʣ 0
1 0 1 0 1 1 1 ແࢹʢ࠶ࢼߦʣ Kenji Rikitake / JEITA 26-OCT-2017 13
͋ΒͨΊͯ ٙࣅཚͱ? Kenji Rikitake / JEITA 26-OCT-2017 14
ཚίϯϐϡʔλͰ࡞Εͳ͍ ཚ༧ଌෆೳͰͳ͚ΕͳΒͳ͍ →ܾఆతΞϧΰϦζϜͰੜͰ͖ͳ͍ ܾఆతΞϧΰϦζϜ෦ঢ়ଶΛ࣋ͭ ෦ঢ়ଶͷऔΓಘΔ߹ͷ༗ݶ ߹ͷ͕༗ݶͰ͋ΔҎ্पظ͕ܾ·Δ पظ͕͋Εݪཧతʹ༧ଌͰ͖ͯ͠·͏ Kenji Rikitake /
JEITA 26-OCT-2017 15
ͦΕͰٙࣅཚΛܭࢉ͢Δҙຯ पظ͕ेʹେ͖͍ྻཚͱಉ༷ͷੑ࣭Λ࣋ͭ →ٙࣅతʹཚͱΈͳͤΔˠٙࣅཚ ݱࡏͷٕज़Ͱ࡞ΕΔٙࣅཚͷपظेେ͖͍ →ྫ: SFMTͷయܕత࣮: ֬Λ࠶ݱ͢Δ͚ͩͰ͋Ε༧ଌෆೳੑෆཁ →ٙࣅཚྻ͕ٻΊΔ֬Ͱ͋ΕΑ͍ Kenji Rikitake
/ JEITA 26-OCT-2017 16
ٙࣅཚͷཧཚʹର͢Δར ෦ঢ়ଶͷॳظ͕ಉ͡Ͱ͋Ε࠶ݱͰ͖Δ →࠶ݱੑΛอূͰ͖ΔͷͰූ߸Խʹ͑Δ ܭࢉೳྗΛ૿͢͜ͱͰߴԽ/େ༰ྔԽ͕Ͱ͖Δ →େنͳधཁʹ༰қʹԠ͑ΒΕΔ ΞϧΰϦζϜͷͰ༧ଌෆೳੑΛߴΊΒΕΔ →ཧཚͰͳ࣮ͯ͘༻্ेͳ߹ଟ͍ Kenji Rikitake /
JEITA 26-OCT-2017 17
ٙࣅཚͷ༻్ ҉߸伴ͷੜʢ҉߸తڧ͕ඞཁɺޙड़ʣ γϛϡϨʔγϣϯʢϞϯςΧϧϩ๏ʣ ιϑτΣΞςετʢ݅ΛϥϯμϜʹม͑Δʣ εϖΫτϥϜͷ֦ࢄʢ௨৴ɺిݯϊΠζରࡦʣ ෛՙࢄʢϥϯμϜʹαʔόΛબʣ Kenji Rikitake / JEITA
26-OCT-2017 18
γϛϡϨʔγϣϯ: ϞϯςΧϧϩ๏ 3 3 By nicoguaro - Own work, CC
BY 3.0, from Wikimedia Commons Kenji Rikitake / JEITA 26-OCT-2017 19
ݹ͍ٙࣅཚͷੜ๏: ઢܗ߹ಉ๏ ͔͚ࢉɺͨ͠ࢉɺׂΓࢉ͚ͩ ܭࢉࣜͷྫ: →શͯͷ߹͕ܭࢉՄೳͳͨΊ҆શͰͳ͍ →ଟ࣍ݩͰنଇతʹͯ͠͠·͏ →ԼҐϏοτͷϥϯμϜωε͕͍ Kenji Rikitake /
JEITA 26-OCT-2017 20
ઢܗ߹ಉ๏ͰݱΕΔنଇੑ 4 4 CC BY-SA 3.0, from Wikimedia Commons Kenji
Rikitake / JEITA 26-OCT-2017 21
ݱͷੜ๏: LFSR LFSR: ઢܗϑΟʔυόοΫϨδελ 5 ಛੑଟ߲ࣜͷྫ: 5 By melan -
ߘऀ͕ࣗ࡞, ύϒϦοΫɾυϝΠϯ Kenji Rikitake / JEITA 26-OCT-2017 22
LFSRͷಛ ಛੑଟ߲ࣜΛબͿͱ࠷पظʹͰ͖Δ ݱࡏ༏Ε͍ͯΔͱ͞ΕΔཚੜํࣜͷجૅ ϋʔυΣΞԽ͕༰қ →GPSɺGSMܞଳɺΠʔαωοτͳͲԠ༻ ιϑτΣΞ࣮༰қ Kenji Rikitake / JEITA
26-OCT-2017 23
҉߸తҎ֎Ͱͷ͓קΊͷٙࣅཚ Mersenne Twister (MT): ͍पظ͕औΕΔ Xorshift+/*: ߴ SFMT: MTͷվྑ൛ɺ͍पظ͕औΕΔ TinyMT:
ΈࠐΈతʹద͍ͯ͠Δ MTΛϥΠϒϥϦʹ࣋ͭݴޠ͋Δ(R, Python) ͨͩ͠҉߸తʹ͍͚ͬͯ·ͤΜ Kenji Rikitake / JEITA 26-OCT-2017 24
҉߸తʹΈͨ ٙࣅཚͷηΩϡϦςΟ Kenji Rikitake / JEITA 26-OCT-2017 25
ٙࣅཚͷ҆શΛकΔʹ ಠࣗͷΞϧΰϦζϜΛ࡞Βͳ͍ ৴པͰ͖Δ࣮Λมߋͤͣʹ͏ ʢ҉߸ͷηΩϡϦςΟͱಉ͡ʣ Kenji Rikitake / JEITA 26-OCT-2017 26
JavaScriptॲཧܥV8Ͱ͋ͬͨόά Kenji Rikitake / JEITA 26-OCT-2017 27
౷ܭతͳཚͷݕఆ ஶ͘͠ภΓ͕͋Δ߹όά·ͨҟৗͷՄೳੑ ɺฏۉɺϞϯςΧϧϩ๏ʢԁपͳͲʣ ֤छύλʔϯͷ ݕఆʢߦྻϥϯΫͳͲʣ 6 ֤छπʔϧ: Dieharder, TestU01, PractRand
7 7 ৽෦༟ʮཚͷݕূπʔϧʹ͍ͭͯʯɺNeuG handbook 1.0 documentation 6 ୮Ӌ࿕ਓɺಢۼʮٖࣅཚݕূπʔϧͷௐࠪ։ൃʯɺژେֶཧղੳݚڀॴߨڀ 1351רɺ2004ɺpp. 80-93 Kenji Rikitake / JEITA 26-OCT-2017 28
౷ܭతͳݕఆํ๏ͷݶք पظΛௐΔ͜ͱ͕Ͱ͖ͳ͍ ݕఆΛύεͯ͠༧ଌෆೳੑࣔͤͳ͍ →҉߸త҆શੜํ๏ͷݕূΛߦΘͳ͍͜ͱʹ ࣔ͢͜ͱ͕Ͱ͖ͳ͍ ظؒʹฆΕࠐΜͩෆਖ਼ͳ݁Ռͷݕग़͕Ͱ͖ͳ͍ Kenji Rikitake / JEITA
26-OCT-2017 29
҉߸త҆શͷ݅ લఏ݅: ౷ܭతݕఆͰෆඋ͕ݟΒΕͳ͍ ෦ঢ়ଶ͕໌ͯ͠༧ଌෆೳੑ͕อͨΕΔ →ΞϧΰϦζϜ/࡞ํ๏ͷެ։͕ݕূͷେલఏ →ʮൿີͷճ࿏/ΞϧΰϦζϜʯ৴༻͞Εͳ͍ ҉߸త҆શੑʹର͢Δ߈ܸख๏ͷ։ൃΜ →ใηΩϡϦςΟͷҰେݚڀ Kenji Rikitake
/ JEITA 26-OCT-2017 30
OSͰͷ҉߸త҆શͳཚੜख๏ Kenji Rikitake / JEITA 26-OCT-2017 31
ΑΓ҆શͳٙࣅཚΛಘΔʹ ίϯϐϡʔλ෦ͰͷΤϯτϩϐʔͰෆे →ಛʹԾϚγϯͰΤϯτϩϐʔ͕ෆ →֎෦ʹཧཚͷڙڅݯΛઃ͚Δ ཧཚʹϑΥϯɾϊΠϚϯɾϑΟϧλΛ͏ ཧཚʹϋογϡؔΛซ༻ →֎෦ͷཚ߈ܸͷӨڹΛ؇Ͱ͖Δ Kenji Rikitake /
JEITA 26-OCT-2017 32
ཧཚͱϋογϡؔͷซ༻ Kenji Rikitake / JEITA 26-OCT-2017 33
҉߸తͰٙࣅཚΛ͏ʹ ՄೳͳݶΓOSͷαʔϏε/ϥΠϒϥϦΛ͏ →Linux/macOS/BSD: /dev/urandom →Windows: CryptGenRandom →Android: SecureRandom ͦͷଞOpenSSL, LibreSSLͳͲ
ݪଇࣗͰϓϩάϥϜॻ͍͍͚ͯͳ͍ Kenji Rikitake / JEITA 26-OCT-2017 34
MCUCPUͷཧཚͷ৴པੑ Intel x86_64: RDRAND/RDSEED ໋ྩ →ہʹΑΔόοΫυΞͷଘࡏ͕ࢦఠ͞Εͨ →ͦͷ··ΘͣΤϯτϩϐʔݯʹͱͲΊ͍ͯΔ ARM Cortex-M4Ͱࣄಉ͡ →࠷ݶϋογϡؔͱซ༻͕ඞཁ
Kenji Rikitake / JEITA 26-OCT-2017 35
ݕূෆेͳٙࣅཚʹΑΔ੬ऑੑ ݕূෆेͳٙࣅཚͷੜใ੬ऑੑͱͳΔ IEEE 802.11Ͱͷ伴ੜʹΔཚੜஔͷ੬ऑੑ ˠޙͷWPA2ͷKRACK੬ऑੑʹͭͳ͕Δ 8 InfineonࣾͷRSA҉߸伴ੜ࣌ͷݕূෆͰ੬ऑͳ҉ ߸伴͕ੜˠTPMICΧʔυೝূʹӨڹ9 9 ROCA:
Vulnerable RSA generation (CVE-2017-15361) 8 Mathy Vanhoef and Frank Piessens, Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys, 25th USENIX Security Symposium Kenji Rikitake / JEITA 26-OCT-2017 36
·ͱΊ ཧཚஔաఔ͕͔֬ͳͷΛ͏ ཧཚஔͷੜ݁ՌΛͦͷ··৴༻͠ͳ͍ ٙࣅཚ৽͘͠ධՁ͕࣮֬ͳͷΛ͏ ҉߸ϓϩτίϧʹOSͷϥΠϒϥϦΛ͏ ݕূ͕Ͱ͖ͳ͍ಠࣗίʔυϦεΫ Kenji Rikitake / JEITA
26-OCT-2017 37
͋Γ͕ͱ͏͍͟͝·ͨ͠ ࣭͝ΛͲ͏ͧ Kenji Rikitake / JEITA 26-OCT-2017 38
ຊจதͷURLʹ͍ͭͯ https://speakerdeck.com/ jj1bdx/jeita-20171026 Λࢀর ը૾ΫϨδοτ: ग़యΛ໌ه͍ͯ͠ͳ͍ͷྗ ݈͕࣍ࡱӨ λΠτϧεϥΠυͷഎܠ: TV Noise,
Theodore Pulser, PublicDomainPictures.net (public domain) ֤ηΫγϣϯͷഎܠʢࣈͷฒΜͰ͍Δͷʣ: Tyler Easton, Unsplash.com (public domain) Kenji Rikitake / JEITA 26-OCT-2017 39