Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの基礎とインシデントレスポンス / Security Fundamentals a...
Search
Kenji Saito
PRO
June 13, 2022
Technology
0
190
セキュリティの基礎とインシデントレスポンス / Security Fundamentals and Incident Response
2022年6月13日(月)、早稲田大学 大学院経営管理研究科「サイバーセキュリティ」にて使用するスライドです。
Kenji Saito
PRO
June 13, 2022
Tweet
Share
More Decks by Kenji Saito
See All by Kenji Saito
発表と総括 / Presentations and Summary
ks91
PRO
0
6
サイバーフィジカル社会、金融の未来とアイデアソン / Cyber Physical Society, Future of Finance, and Ideathon
ks91
PRO
0
53
マニフェスト: 人類の知のフロンティアに向けた拡張的足場へ / Manifesto: Toward Expansive Scaffolding for Humanity's Knowledge Frontier
ks91
PRO
0
11
続・スマートコントラクトと分散ファイナンス / Smart Contracts and Decentralized Finance, Continued
ks91
PRO
0
50
スマートコントラクトと分散ファイナンス / Smart Contracts and Decentralized Finance
ks91
PRO
0
64
シン・ブロックチェーン / Truth of Blockchain
ks91
PRO
0
98
パスワード/パスフレーズと認証 / Password, Passphrase and Authentication
ks91
PRO
0
37
git と GitHub / git and GitHub
ks91
PRO
0
36
ソフトウェアの開発と保守 / Software Development and Maintenance
ks91
PRO
0
51
Other Decks in Technology
See All in Technology
セキュアな社内Dify運用と外部連携の両立 ~AIによるAPIリスク評価~
zozotech
PRO
0
120
データ戦略部門 紹介資料
sansan33
PRO
1
3.3k
CDK Vibe Coding Fes
tomoki10
1
630
SREの次のキャリアの道しるべ 〜SREがマネジメントレイヤーに挑戦して、 気づいたこととTips〜
coconala_engineer
1
4.3k
Amazon SNSサブスクリプションの誤解除を防ぐ
y_sakata
3
190
AI Ready API ─ AI時代に求められるAPI設計とは?/ AI-Ready API - Designing MCP and APIs in the AI Era
yokawasa
6
1.9k
microCMSではじめるAIライティング
himaratsu
0
150
“日本一のM&A企業”を支える、少人数SREの効率化戦略 / SRE NEXT 2025
genda
1
270
ロールが細分化された組織でSREは何をするか?
tgidgd
1
420
サービスを止めるな! DDoS攻撃へのスマートな備えと最前線の事例
coconala_engineer
1
180
Talk to Someone At Delta Airlines™️ USA Contact Numbers
travelcarecenter
0
160
TLSから見るSREの未来
atpons
2
310
Featured
See All Featured
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
231
53k
Being A Developer After 40
akosma
90
590k
Bootstrapping a Software Product
garrettdimon
PRO
307
110k
Building Applications with DynamoDB
mza
95
6.5k
We Have a Design System, Now What?
morganepeng
53
7.7k
Producing Creativity
orderedlist
PRO
346
40k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
34
5.9k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
331
22k
How to Think Like a Performance Engineer
csswizardry
25
1.7k
Code Reviewing Like a Champion
maltzj
524
40k
Unsuck your backbone
ammeep
671
58k
Transcript
2022 3-4 (WBS) 2022 3-4 — 2022-06-13 – p.1/57
https://speakerdeck.com/ks91 WBS 2022 3-4 — 2022-06-13 – p.2/57
1 6 6 • 2 6 6 • 3 6
13 • 4 6 13 • 5 6 20 I ( ) 6 6 20 I ( ) 7 6 27 ( ) 8 6 27 ( ) 9 7 4 10 7 4 11 7 11 12 7 11 13 7 18 II ( ) 14 7 18 II ( ) 15 7 25 2022 3-4 — 2022-06-13 – p.3/57
+ + 2022 3-4 — 2022-06-13 – p.4/57
2022 3-4 — 2022-06-13 – p.5/57
1. (1) (2) 2022 6 9 ( ) 23:59 JST
Waseda Moodle (Q & A ) 2022 3-4 — 2022-06-13 – p.6/57
. . . . . . 11 ( ) 7
( ) ( ) 2022 3-4 — 2022-06-13 – p.7/57
Y T ⇒ 2022 3-4 — 2022-06-13 – p.8/57
O back plan ⇒ 2022 3-4 — 2022-06-13 – p.9/57
(1) : NFT (2) : 2022 3-4 — 2022-06-13 –
p.10/57
NPO https://www.nisc.go.jp/security-site/blue_handbook/index.html 1 6 2022 3-4 — 2022-06-13 – p.11/57
2022 3-4 — 2022-06-13 – p.12/57
( ) (1) : ( ) (2) : ( )(
) ( ) ( ) ( ↓ ) → ( : “Correct Horse Battery Staple”) ( ) 2022 3-4 — 2022-06-13 – p.13/57
3 2 ( ) (2 ) . . . .
. . . . . (1) : (2) : (3) : (4) : IC ( ) (2 ) . . . 2022 3-4 — 2022-06-13 – p.14/57
( ) CAP 2022 3-4 — 2022-06-13 – p.15/57
(1) ( ) ( ) ( 16 ) SHA (Secure
Hash Algorithm) ( ) 1bit 2022 3-4 — 2022-06-13 – p.16/57
(2) . . . H m H(m) = H(m′) m′
(m′ = m) H(m) m m′ H(m) = H(m′) ( m′ = m) 2022 3-4 — 2022-06-13 – p.17/57
SHA-1 https://shattered.io 2017 2 Google (CWI) (shattered ) SHA-1 2022
3-4 — 2022-06-13 – p.18/57
( ) (TCP, UDP) SSL (Secure Sockets Layer) → TLS
(Transport Layer Security) HTTPS IP (Internet Protocol) IPsec DNS DNSSEC (S/MIME) (PGP ) 2022 3-4 — 2022-06-13 – p.19/57
= . . . (AES : Advanced Encryption Standard) (
. . . ) 2022 3-4 — 2022-06-13 – p.20/57
2022 3-4 — 2022-06-13 – p.21/57
(RSA ) Πϯλʔωοτ ɾ ෮߸จͱݟͳͯ͠ ɹެ։ݤͰ҉߸Խ ɾ ॺ໊͖ฏจΛૹ৴ ɾ ҉߸จͱݟͳͯ͠
ɹൿີݤͰ෮߸ ड৴ऀ ެ։ݤ ൿີݤ ൃ৴ऀ ฏจ ฏจ ൿີݤ ެ։ݤ ݤ ॺ໊ ॺ໊ ɾ ͋Β͔͡Ίެ։ݤΛ͓ͯ͘͠ ݤϖΞ μΠδΣετ μΠδΣετ ɾ ෮߸ˠ҉߸Խॲཧͨ͠μΠδΣετ ɹݩʹΔ͕ͣͩɺ ͦΕ͕ฏจ͔Β ɹܭࢉͨ͠μΠδΣετͱҰக͢Δ͔ ( ) RSA ( Rivest, Shamir, Adleman ; ) Bitcoin ECDSA ( DSA : Digital Signature Algorithm) 2022 3-4 — 2022-06-13 – p.22/57
: < , > : : < , , >
: OK NG 2022 3-4 — 2022-06-13 – p.23/57
( ) RSA ( ) 2022 3-4 — 2022-06-13 –
p.24/57
RSA ( ) . . . Fermat Attack on RSA
(RSA ) (2022 3 14 ) https://fermatattack.secvuln.info ( ) ( ) / 1643 2 RSA 2 OK ( ) https://qiita.com/tnakagawa/items/d87fd8459ec9e1ce6844 RSA 2022 3-4 — 2022-06-13 – p.25/57
( ) PKI ( ) ɾ ΠϯλʔωοτΛ௨ͯ͠ಘͨެ։ݤʹ ɹຊͩͱ͍͏อূ͕ͳ͍ ɾ ূ໌ॻͷॺ໊ʹΘΕ͍ͯΔެ։ݤຊ͔͔Βͳ͍
"MJDF #PC $BSPMF ূ໌ऀ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ # C C C C C C C C C " # ୭ͷʁ $" Πϯλʔωοτ ॺ໊ ॺ ॺ໊ ໊ ໊ ɾ ̖ͷެ։ݤͷॺ໊ ূ໌ॻ ɾ ͨͩ͠ɺ ॺ໊͕ຊ͔ݕূ͢Δ ɹʹ̘̖ͷެ։ݤ͕ඞཁ .BMJTTB ߈ܸऀ & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & . " (PKI) CA (Certificate Authority) CA CA CA ( ) ← CA 2022 3-4 — 2022-06-13 – p.26/57
Web of Trust "MJDF͔Βݟͨɺ ਓͷ৴༻ "MJDF͔Βݟͨɺ ݤͷਅਖ਼ੑ શʹ৴༻͍ͯ͠Δ ਅਖ਼Ͱ͋Δ ڀۃతʹਅਖ਼
ਅਖ਼ͬΆ͍͔ ͋Δఔͷ৴༻ Θ͔Βͳ͍ Θ͔Βͳ͍ ڀۃతʹ৴༻Ͱ͖Δ "ˠ#ͷҙຯ ʮ"͕#ͷެ։ݤʹॺ໊ʯ ଞਓͷެ։ݤʹॺ໊͢Δࡍɺ ϑΟϯΨʔϓϦϯτ μΠδΣετ ΛνΣοΫ͢ΔΑ͏ͳਓ͔ͳ "MJDFݤͷॴ༗ऀͷ ৴༻ΛධՁ͢Δ ݤͷਅਖ਼ੑܭࢉͰ ٻΊΒΕΔ (PKI) (PGP ) 2022 3-4 — 2022-06-13 – p.27/57
10 ATM 1 ATM 1 : http://www.slideshare.net/yamaz2/ss-58813038 ( ) ⇒
ATM 2022 3-4 — 2022-06-13 – p.28/57
(safety) ( ), ( ), etc. (liveness) ( ), etc.
( ) ( = ) 2022 3-4 — 2022-06-13 – p.29/57
CAP ( . . . ) Consistency ( ) Availability
( ) Partition tolerance ( ) ⇒ 3 Eventual consistency ( ) . . . 2022 3-4 — 2022-06-13 – p.30/57
Consistency ( ) Strong consistency ( ) (safety) Eventual consistency
( ) (liveness) ↑ Weak consistency ( ) 2022 3-4 — 2022-06-13 – p.31/57
(1) : NFT 2022 3-4 — 2022-06-13 – p.32/57
( ) = = : . . . ( :
) ( ) . . . . . . . . . 2022 3-4 — 2022-06-13 – p.33/57
↑ ( ) PDF 2022 3-4 — 2022-06-13 – p.34/57
⇒ ( ) . . . . . . 2022
3-4 — 2022-06-13 – p.35/57
NFT ( ) NFT : Non-Fungible Token ( ) (1
) → fungible token (1 ) → NFT 2022 3-4 — 2022-06-13 – p.36/57
ERC-721 ERC (Ethereum Request for Comments) 721 (721 ) https://github.com/ethereum/EIPs/blob/master/EIPS/eip-721.md
interface ERC721 { function balanceOf(address _owner) external view returns (uint256); function ownerOf(uint256 _tokenId) external view returns (address); function safeTransferFrom(address _from, address _to, uint256 _tokenId, . . . ) external payable; : } interface ERC721TokenReceiver { function onERC721Received( .. . , uint256 _tokenId, . . . ) external returns(bytes4); } interface ERC721Metadata { function name() external view returns (string _name); function symbol() external view returns (string _symbol); function tokenURI(uint256 _tokenId) external view returns (string); } tokenURI URL ( ) ( ) 2022 3-4 — 2022-06-13 – p.37/57
NFT ( ) τʔΫϯ *% ൪߸ 63* ΞυϨε 63* /'5
Ұҙ Ұҙʁ Ұҙʁ Ұҙʁ Ұҙ ࣄ্࣮Ұҙ ϝλσʔλ ίϯτϥΫτͱ͍͏ఆٛҬ ˞ͦͷίϯτϥΫτͱ͍͏ఆٛҬͷதͰ ɹ࣮ઢҹͰࣔͨ͠ҰҙੑΛอূ͢Δʹա͗ͳ͍ ˞ഁઢҹͰࣔͨ͠Ұҙੑɺ࣮ɾӡ༻ͷ࣍ୈͰอূͰ͖Δ ˞ྫ͑ɺ63* 63- ͕ͦΕ͕ࢦ͢Ϧιʔεͷ ɹ҉߸ֶతμΠδΣετΛؚΉ ରσʔλ ը૾ͱ͔ ॴ༗ऀ ϝλσʔλ 63* ରσʔλ 63* ൿີ伴 Ұҙ Ұҙʁ 2022 3-4 — 2022-06-13 – p.38/57
NFT NFT URL Marlinspike, M.: My first impressions of web3
(2022) Web3 . . . URL ↑ NFT → → NFT NFT ↔ Lazy Minting NFT ( ) 2022 3-4 — 2022-06-13 – p.39/57
NFT < , ID> ERC-721 ← OK NFT . .
. ID → ID NFT NFT URL . . . URL . . . →NFT 2022 3-4 — 2022-06-13 – p.40/57
NFT NFT . . . NFT ( ) ↑ ID
. . . 2022 3-4 — 2022-06-13 – p.41/57
NFT : ERC-721 NFT NFT (ID) NFT → URI NFT
( NFT ) (ID) (URI) → NFT ( ) URI → ( ) → ( ) NFT NFT NFT 2022 3-4 — 2022-06-13 – p.42/57
NFT NFT ⇒ 2022 3-4 — 2022-06-13 – p.43/57
(2) : https://www.cloudsign.jp https://www.gmosign.com 2022 3-4 — 2022-06-13 – p.44/57
NPO NICT CYDER https://cyder.nict.go.jp (3) : 2022 3-4 — 2022-06-13
– p.45/57
Πϯγσϯτͷ༧ஹͳͲ ॳಈରԠ ෮چાஔ ఆରԠ ࠶ൃࢭࡦ ߃ٱରԠ ݕ౼ ࣄޙରԠ τϦΞʔδ ใ
ࠂ ɾ ެ ද Π ϯ γ σ ϯ τ ϋ ϯ υ Ϧ ϯ ά Π ϯ γ σ ϯ τ Ϩ ε ϙ ϯ ε ސ ٬ ɾ ެ ڞ ݕɾड ରԠํݕ౼ 1PJOUPG$POUBDU ূڌอશ ෧͡ࠐΊ ࠜઈ , , DoS , , etc. 2022 3-4 — 2022-06-13 – p.46/57
Point of Contact (PoC) 1 2022 3-4 — 2022-06-13 –
p.47/57
2022 3-4 — 2022-06-13 – p.48/57
HDD ( ) 2022 3-4 — 2022-06-13 – p.49/57
2022 3-4 — 2022-06-13 – p.50/57
( ) 2022 3-4 — 2022-06-13 – p.51/57
( ) JPCERT/CC, NISC, ( ) ( ) 2022 3-4
— 2022-06-13 – p.52/57
(1 ) 2022 3-4 — 2022-06-13 – p.53/57
(3) : 70 1,000 Twitter 3 1. 2. 3. 3
2022 3-4 — 2022-06-13 – p.54/57
2022 3-4 — 2022-06-13 – p.55/57
2. OK (1) (2) 2020 6 16 ( ) 23:59
JST Waseda Moodle (Q & A ) 2022 3-4 — 2022-06-13 – p.56/57
Zoom Discord # 2022 3-4 — 2022-06-13 – p.57/57