Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの基礎とインシデントレスポンス / Security Fundamentals a...
Search
Kenji Saito
PRO
June 13, 2022
Technology
0
190
セキュリティの基礎とインシデントレスポンス / Security Fundamentals and Incident Response
2022年6月13日(月)、早稲田大学 大学院経営管理研究科「サイバーセキュリティ」にて使用するスライドです。
Kenji Saito
PRO
June 13, 2022
Tweet
Share
More Decks by Kenji Saito
See All by Kenji Saito
続・スマートコントラクトと分散ファイナンス / Smart Contracts and Decentralized Finance, Continued
ks91
PRO
0
21
スマートコントラクトと分散ファイナンス / Smart Contracts and Decentralized Finance
ks91
PRO
0
57
シン・ブロックチェーン / Truth of Blockchain
ks91
PRO
0
88
パスワード/パスフレーズと認証 / Password, Passphrase and Authentication
ks91
PRO
0
34
git と GitHub / git and GitHub
ks91
PRO
0
35
ソフトウェアの開発と保守 / Software Development and Maintenance
ks91
PRO
0
48
インターネットの特徴 / Features of the Internet
ks91
PRO
0
34
インターネットのガバナンス / Governance of the Internet
ks91
PRO
0
29
暗号学的ハッシュ関数 / Cryptographic Hash Function
ks91
PRO
0
37
Other Decks in Technology
See All in Technology
生成AI時代の開発組織・技術・プロセス 〜 ログラスの挑戦と考察 〜
itohiro73
1
390
KubeCon + CloudNativeCon Japan 2025 Recap
ren510dev
1
320
fukabori.fm 出張版: 売上高617億円と高稼働率を陰で支えた社内ツール開発のあれこれ話 / 20250704 Yoshimasa Iwase & Tomoo Morikawa
shift_evolve
PRO
2
2.8k
ハッカソン by 生成AIハッカソンvol.05
1ftseabass
PRO
0
160
生まれ変わった AWS Security Hub (Preview) を紹介 #reInforce_osaka / reInforce New Security Hub
masahirokawahara
0
380
Connect 100+を支える技術
kanyamaguc
0
160
OpenHands🤲にContributeしてみた
kotauchisunsun
1
500
Lambda Web Adapterについて自分なりに理解してみた
smt7174
5
140
さくらのIaaS基盤のモニタリングとOpenTelemetry/OSC Hokkaido 2025
fujiwara3
2
280
Understanding_Thread_Tuning_for_Inference_Servers_of_Deep_Models.pdf
lycorptech_jp
PRO
0
150
OPENLOGI Company Profile
hr01
0
67k
本が全く読めなかった過去の自分へ
genshun9
0
730
Featured
See All Featured
Cheating the UX When There Is Nothing More to Optimize - PixelPioneers
stephaniewalter
281
13k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.9k
What's in a price? How to price your products and services
michaelherold
246
12k
The Art of Programming - Codeland 2020
erikaheidi
54
13k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
940
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
657
60k
For a Future-Friendly Web
brad_frost
179
9.8k
Building a Scalable Design System with Sketch
lauravandoore
462
33k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
2.9k
StorybookのUI Testing Handbookを読んだ
zakiyama
30
5.9k
Embracing the Ebb and Flow
colly
86
4.7k
Facilitating Awesome Meetings
lara
54
6.4k
Transcript
2022 3-4 (WBS) 2022 3-4 — 2022-06-13 – p.1/57
https://speakerdeck.com/ks91 WBS 2022 3-4 — 2022-06-13 – p.2/57
1 6 6 • 2 6 6 • 3 6
13 • 4 6 13 • 5 6 20 I ( ) 6 6 20 I ( ) 7 6 27 ( ) 8 6 27 ( ) 9 7 4 10 7 4 11 7 11 12 7 11 13 7 18 II ( ) 14 7 18 II ( ) 15 7 25 2022 3-4 — 2022-06-13 – p.3/57
+ + 2022 3-4 — 2022-06-13 – p.4/57
2022 3-4 — 2022-06-13 – p.5/57
1. (1) (2) 2022 6 9 ( ) 23:59 JST
Waseda Moodle (Q & A ) 2022 3-4 — 2022-06-13 – p.6/57
. . . . . . 11 ( ) 7
( ) ( ) 2022 3-4 — 2022-06-13 – p.7/57
Y T ⇒ 2022 3-4 — 2022-06-13 – p.8/57
O back plan ⇒ 2022 3-4 — 2022-06-13 – p.9/57
(1) : NFT (2) : 2022 3-4 — 2022-06-13 –
p.10/57
NPO https://www.nisc.go.jp/security-site/blue_handbook/index.html 1 6 2022 3-4 — 2022-06-13 – p.11/57
2022 3-4 — 2022-06-13 – p.12/57
( ) (1) : ( ) (2) : ( )(
) ( ) ( ) ( ↓ ) → ( : “Correct Horse Battery Staple”) ( ) 2022 3-4 — 2022-06-13 – p.13/57
3 2 ( ) (2 ) . . . .
. . . . . (1) : (2) : (3) : (4) : IC ( ) (2 ) . . . 2022 3-4 — 2022-06-13 – p.14/57
( ) CAP 2022 3-4 — 2022-06-13 – p.15/57
(1) ( ) ( ) ( 16 ) SHA (Secure
Hash Algorithm) ( ) 1bit 2022 3-4 — 2022-06-13 – p.16/57
(2) . . . H m H(m) = H(m′) m′
(m′ = m) H(m) m m′ H(m) = H(m′) ( m′ = m) 2022 3-4 — 2022-06-13 – p.17/57
SHA-1 https://shattered.io 2017 2 Google (CWI) (shattered ) SHA-1 2022
3-4 — 2022-06-13 – p.18/57
( ) (TCP, UDP) SSL (Secure Sockets Layer) → TLS
(Transport Layer Security) HTTPS IP (Internet Protocol) IPsec DNS DNSSEC (S/MIME) (PGP ) 2022 3-4 — 2022-06-13 – p.19/57
= . . . (AES : Advanced Encryption Standard) (
. . . ) 2022 3-4 — 2022-06-13 – p.20/57
2022 3-4 — 2022-06-13 – p.21/57
(RSA ) Πϯλʔωοτ ɾ ෮߸จͱݟͳͯ͠ ɹެ։ݤͰ҉߸Խ ɾ ॺ໊͖ฏจΛૹ৴ ɾ ҉߸จͱݟͳͯ͠
ɹൿີݤͰ෮߸ ड৴ऀ ެ։ݤ ൿີݤ ൃ৴ऀ ฏจ ฏจ ൿີݤ ެ։ݤ ݤ ॺ໊ ॺ໊ ɾ ͋Β͔͡Ίެ։ݤΛ͓ͯ͘͠ ݤϖΞ μΠδΣετ μΠδΣετ ɾ ෮߸ˠ҉߸Խॲཧͨ͠μΠδΣετ ɹݩʹΔ͕ͣͩɺ ͦΕ͕ฏจ͔Β ɹܭࢉͨ͠μΠδΣετͱҰக͢Δ͔ ( ) RSA ( Rivest, Shamir, Adleman ; ) Bitcoin ECDSA ( DSA : Digital Signature Algorithm) 2022 3-4 — 2022-06-13 – p.22/57
: < , > : : < , , >
: OK NG 2022 3-4 — 2022-06-13 – p.23/57
( ) RSA ( ) 2022 3-4 — 2022-06-13 –
p.24/57
RSA ( ) . . . Fermat Attack on RSA
(RSA ) (2022 3 14 ) https://fermatattack.secvuln.info ( ) ( ) / 1643 2 RSA 2 OK ( ) https://qiita.com/tnakagawa/items/d87fd8459ec9e1ce6844 RSA 2022 3-4 — 2022-06-13 – p.25/57
( ) PKI ( ) ɾ ΠϯλʔωοτΛ௨ͯ͠ಘͨެ։ݤʹ ɹຊͩͱ͍͏อূ͕ͳ͍ ɾ ূ໌ॻͷॺ໊ʹΘΕ͍ͯΔެ։ݤຊ͔͔Βͳ͍
"MJDF #PC $BSPMF ূ໌ऀ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ # C C C C C C C C C " # ୭ͷʁ $" Πϯλʔωοτ ॺ໊ ॺ ॺ໊ ໊ ໊ ɾ ̖ͷެ։ݤͷॺ໊ ূ໌ॻ ɾ ͨͩ͠ɺ ॺ໊͕ຊ͔ݕূ͢Δ ɹʹ̘̖ͷެ։ݤ͕ඞཁ .BMJTTB ߈ܸऀ & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & . " (PKI) CA (Certificate Authority) CA CA CA ( ) ← CA 2022 3-4 — 2022-06-13 – p.26/57
Web of Trust "MJDF͔Βݟͨɺ ਓͷ৴༻ "MJDF͔Βݟͨɺ ݤͷਅਖ਼ੑ શʹ৴༻͍ͯ͠Δ ਅਖ਼Ͱ͋Δ ڀۃతʹਅਖ਼
ਅਖ਼ͬΆ͍͔ ͋Δఔͷ৴༻ Θ͔Βͳ͍ Θ͔Βͳ͍ ڀۃతʹ৴༻Ͱ͖Δ "ˠ#ͷҙຯ ʮ"͕#ͷެ։ݤʹॺ໊ʯ ଞਓͷެ։ݤʹॺ໊͢Δࡍɺ ϑΟϯΨʔϓϦϯτ μΠδΣετ ΛνΣοΫ͢ΔΑ͏ͳਓ͔ͳ "MJDFݤͷॴ༗ऀͷ ৴༻ΛධՁ͢Δ ݤͷਅਖ਼ੑܭࢉͰ ٻΊΒΕΔ (PKI) (PGP ) 2022 3-4 — 2022-06-13 – p.27/57
10 ATM 1 ATM 1 : http://www.slideshare.net/yamaz2/ss-58813038 ( ) ⇒
ATM 2022 3-4 — 2022-06-13 – p.28/57
(safety) ( ), ( ), etc. (liveness) ( ), etc.
( ) ( = ) 2022 3-4 — 2022-06-13 – p.29/57
CAP ( . . . ) Consistency ( ) Availability
( ) Partition tolerance ( ) ⇒ 3 Eventual consistency ( ) . . . 2022 3-4 — 2022-06-13 – p.30/57
Consistency ( ) Strong consistency ( ) (safety) Eventual consistency
( ) (liveness) ↑ Weak consistency ( ) 2022 3-4 — 2022-06-13 – p.31/57
(1) : NFT 2022 3-4 — 2022-06-13 – p.32/57
( ) = = : . . . ( :
) ( ) . . . . . . . . . 2022 3-4 — 2022-06-13 – p.33/57
↑ ( ) PDF 2022 3-4 — 2022-06-13 – p.34/57
⇒ ( ) . . . . . . 2022
3-4 — 2022-06-13 – p.35/57
NFT ( ) NFT : Non-Fungible Token ( ) (1
) → fungible token (1 ) → NFT 2022 3-4 — 2022-06-13 – p.36/57
ERC-721 ERC (Ethereum Request for Comments) 721 (721 ) https://github.com/ethereum/EIPs/blob/master/EIPS/eip-721.md
interface ERC721 { function balanceOf(address _owner) external view returns (uint256); function ownerOf(uint256 _tokenId) external view returns (address); function safeTransferFrom(address _from, address _to, uint256 _tokenId, . . . ) external payable; : } interface ERC721TokenReceiver { function onERC721Received( .. . , uint256 _tokenId, . . . ) external returns(bytes4); } interface ERC721Metadata { function name() external view returns (string _name); function symbol() external view returns (string _symbol); function tokenURI(uint256 _tokenId) external view returns (string); } tokenURI URL ( ) ( ) 2022 3-4 — 2022-06-13 – p.37/57
NFT ( ) τʔΫϯ *% ൪߸ 63* ΞυϨε 63* /'5
Ұҙ Ұҙʁ Ұҙʁ Ұҙʁ Ұҙ ࣄ্࣮Ұҙ ϝλσʔλ ίϯτϥΫτͱ͍͏ఆٛҬ ˞ͦͷίϯτϥΫτͱ͍͏ఆٛҬͷதͰ ɹ࣮ઢҹͰࣔͨ͠ҰҙੑΛอূ͢Δʹա͗ͳ͍ ˞ഁઢҹͰࣔͨ͠Ұҙੑɺ࣮ɾӡ༻ͷ࣍ୈͰอূͰ͖Δ ˞ྫ͑ɺ63* 63- ͕ͦΕ͕ࢦ͢Ϧιʔεͷ ɹ҉߸ֶతμΠδΣετΛؚΉ ରσʔλ ը૾ͱ͔ ॴ༗ऀ ϝλσʔλ 63* ରσʔλ 63* ൿີ伴 Ұҙ Ұҙʁ 2022 3-4 — 2022-06-13 – p.38/57
NFT NFT URL Marlinspike, M.: My first impressions of web3
(2022) Web3 . . . URL ↑ NFT → → NFT NFT ↔ Lazy Minting NFT ( ) 2022 3-4 — 2022-06-13 – p.39/57
NFT < , ID> ERC-721 ← OK NFT . .
. ID → ID NFT NFT URL . . . URL . . . →NFT 2022 3-4 — 2022-06-13 – p.40/57
NFT NFT . . . NFT ( ) ↑ ID
. . . 2022 3-4 — 2022-06-13 – p.41/57
NFT : ERC-721 NFT NFT (ID) NFT → URI NFT
( NFT ) (ID) (URI) → NFT ( ) URI → ( ) → ( ) NFT NFT NFT 2022 3-4 — 2022-06-13 – p.42/57
NFT NFT ⇒ 2022 3-4 — 2022-06-13 – p.43/57
(2) : https://www.cloudsign.jp https://www.gmosign.com 2022 3-4 — 2022-06-13 – p.44/57
NPO NICT CYDER https://cyder.nict.go.jp (3) : 2022 3-4 — 2022-06-13
– p.45/57
Πϯγσϯτͷ༧ஹͳͲ ॳಈରԠ ෮چાஔ ఆରԠ ࠶ൃࢭࡦ ߃ٱରԠ ݕ౼ ࣄޙରԠ τϦΞʔδ ใ
ࠂ ɾ ެ ද Π ϯ γ σ ϯ τ ϋ ϯ υ Ϧ ϯ ά Π ϯ γ σ ϯ τ Ϩ ε ϙ ϯ ε ސ ٬ ɾ ެ ڞ ݕɾड ରԠํݕ౼ 1PJOUPG$POUBDU ূڌอશ ෧͡ࠐΊ ࠜઈ , , DoS , , etc. 2022 3-4 — 2022-06-13 – p.46/57
Point of Contact (PoC) 1 2022 3-4 — 2022-06-13 –
p.47/57
2022 3-4 — 2022-06-13 – p.48/57
HDD ( ) 2022 3-4 — 2022-06-13 – p.49/57
2022 3-4 — 2022-06-13 – p.50/57
( ) 2022 3-4 — 2022-06-13 – p.51/57
( ) JPCERT/CC, NISC, ( ) ( ) 2022 3-4
— 2022-06-13 – p.52/57
(1 ) 2022 3-4 — 2022-06-13 – p.53/57
(3) : 70 1,000 Twitter 3 1. 2. 3. 3
2022 3-4 — 2022-06-13 – p.54/57
2022 3-4 — 2022-06-13 – p.55/57
2. OK (1) (2) 2020 6 16 ( ) 23:59
JST Waseda Moodle (Q & A ) 2022 3-4 — 2022-06-13 – p.56/57
Zoom Discord # 2022 3-4 — 2022-06-13 – p.57/57