Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
セキュリティの基礎とインシデントレスポンス / Security Fundamentals a...
Search
Kenji Saito
PRO
June 13, 2022
Technology
0
190
セキュリティの基礎とインシデントレスポンス / Security Fundamentals and Incident Response
2022年6月13日(月)、早稲田大学 大学院経営管理研究科「サイバーセキュリティ」にて使用するスライドです。
Kenji Saito
PRO
June 13, 2022
Tweet
Share
More Decks by Kenji Saito
See All by Kenji Saito
続・スマートコントラクトと分散ファイナンス / Smart Contracts and Decentralized Finance, Continued
ks91
PRO
0
38
スマートコントラクトと分散ファイナンス / Smart Contracts and Decentralized Finance
ks91
PRO
0
62
シン・ブロックチェーン / Truth of Blockchain
ks91
PRO
0
91
パスワード/パスフレーズと認証 / Password, Passphrase and Authentication
ks91
PRO
0
35
git と GitHub / git and GitHub
ks91
PRO
0
35
ソフトウェアの開発と保守 / Software Development and Maintenance
ks91
PRO
0
50
インターネットの特徴 / Features of the Internet
ks91
PRO
0
34
インターネットのガバナンス / Governance of the Internet
ks91
PRO
0
29
暗号学的ハッシュ関数 / Cryptographic Hash Function
ks91
PRO
0
37
Other Decks in Technology
See All in Technology
生成AIで小説を書くためにプロンプトの制約や原則について学ぶ / prompt-engineering-for-ai-fiction
nwiizo
6
4k
さくらのIaaS基盤のモニタリングとOpenTelemetry/OSC Hokkaido 2025
fujiwara3
2
310
マネジメントって難しい、けどおもしろい / Management is tough, but fun! #em_findy
ar_tama
5
700
高速なプロダクト開発を実現、創業期から掲げるエンタープライズアーキテクチャ
kawauso
2
7.7k
SmartNewsにおける 1000+ノード規模 K8s基盤 でのコスト最適化 – Spot・Gravitonの大規模導入への挑戦
vsanna2
0
120
AI専用のリンターを作る #yumemi_patch
bengo4com
5
3.9k
生成AI時代の開発組織・技術・プロセス 〜 ログラスの挑戦と考察 〜
itohiro73
1
420
5min GuardDuty Extended Threat Detection EKS
takakuni
0
180
Backlog ユーザー棚卸しRTA、多分これが一番早いと思います
__allllllllez__
1
130
KubeCon + CloudNativeCon Japan 2025 Recap
ren510dev
1
360
面倒な作業はAIにおまかせ。Flutter開発をスマートに効率化
ruideengineer
0
130
あなたの声を届けよう! 女性エンジニア登壇の意義とアウトプット実践ガイド #wttjp / Call for Your Voice
kondoyuko
4
560
Featured
See All Featured
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
252
21k
Mobile First: as difficult as doing things right
swwweet
223
9.7k
The Straight Up "How To Draw Better" Workshop
denniskardys
234
140k
Practical Orchestrator
shlominoach
188
11k
It's Worth the Effort
3n
185
28k
A Modern Web Designer's Workflow
chriscoyier
694
190k
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
657
60k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
Navigating Team Friction
lara
187
15k
Building a Modern Day E-commerce SEO Strategy
aleyda
42
7.4k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
26k
Code Review Best Practice
trishagee
69
18k
Transcript
2022 3-4 (WBS) 2022 3-4 — 2022-06-13 – p.1/57
https://speakerdeck.com/ks91 WBS 2022 3-4 — 2022-06-13 – p.2/57
1 6 6 • 2 6 6 • 3 6
13 • 4 6 13 • 5 6 20 I ( ) 6 6 20 I ( ) 7 6 27 ( ) 8 6 27 ( ) 9 7 4 10 7 4 11 7 11 12 7 11 13 7 18 II ( ) 14 7 18 II ( ) 15 7 25 2022 3-4 — 2022-06-13 – p.3/57
+ + 2022 3-4 — 2022-06-13 – p.4/57
2022 3-4 — 2022-06-13 – p.5/57
1. (1) (2) 2022 6 9 ( ) 23:59 JST
Waseda Moodle (Q & A ) 2022 3-4 — 2022-06-13 – p.6/57
. . . . . . 11 ( ) 7
( ) ( ) 2022 3-4 — 2022-06-13 – p.7/57
Y T ⇒ 2022 3-4 — 2022-06-13 – p.8/57
O back plan ⇒ 2022 3-4 — 2022-06-13 – p.9/57
(1) : NFT (2) : 2022 3-4 — 2022-06-13 –
p.10/57
NPO https://www.nisc.go.jp/security-site/blue_handbook/index.html 1 6 2022 3-4 — 2022-06-13 – p.11/57
2022 3-4 — 2022-06-13 – p.12/57
( ) (1) : ( ) (2) : ( )(
) ( ) ( ) ( ↓ ) → ( : “Correct Horse Battery Staple”) ( ) 2022 3-4 — 2022-06-13 – p.13/57
3 2 ( ) (2 ) . . . .
. . . . . (1) : (2) : (3) : (4) : IC ( ) (2 ) . . . 2022 3-4 — 2022-06-13 – p.14/57
( ) CAP 2022 3-4 — 2022-06-13 – p.15/57
(1) ( ) ( ) ( 16 ) SHA (Secure
Hash Algorithm) ( ) 1bit 2022 3-4 — 2022-06-13 – p.16/57
(2) . . . H m H(m) = H(m′) m′
(m′ = m) H(m) m m′ H(m) = H(m′) ( m′ = m) 2022 3-4 — 2022-06-13 – p.17/57
SHA-1 https://shattered.io 2017 2 Google (CWI) (shattered ) SHA-1 2022
3-4 — 2022-06-13 – p.18/57
( ) (TCP, UDP) SSL (Secure Sockets Layer) → TLS
(Transport Layer Security) HTTPS IP (Internet Protocol) IPsec DNS DNSSEC (S/MIME) (PGP ) 2022 3-4 — 2022-06-13 – p.19/57
= . . . (AES : Advanced Encryption Standard) (
. . . ) 2022 3-4 — 2022-06-13 – p.20/57
2022 3-4 — 2022-06-13 – p.21/57
(RSA ) Πϯλʔωοτ ɾ ෮߸จͱݟͳͯ͠ ɹެ։ݤͰ҉߸Խ ɾ ॺ໊͖ฏจΛૹ৴ ɾ ҉߸จͱݟͳͯ͠
ɹൿີݤͰ෮߸ ड৴ऀ ެ։ݤ ൿີݤ ൃ৴ऀ ฏจ ฏจ ൿີݤ ެ։ݤ ݤ ॺ໊ ॺ໊ ɾ ͋Β͔͡Ίެ։ݤΛ͓ͯ͘͠ ݤϖΞ μΠδΣετ μΠδΣετ ɾ ෮߸ˠ҉߸Խॲཧͨ͠μΠδΣετ ɹݩʹΔ͕ͣͩɺ ͦΕ͕ฏจ͔Β ɹܭࢉͨ͠μΠδΣετͱҰக͢Δ͔ ( ) RSA ( Rivest, Shamir, Adleman ; ) Bitcoin ECDSA ( DSA : Digital Signature Algorithm) 2022 3-4 — 2022-06-13 – p.22/57
: < , > : : < , , >
: OK NG 2022 3-4 — 2022-06-13 – p.23/57
( ) RSA ( ) 2022 3-4 — 2022-06-13 –
p.24/57
RSA ( ) . . . Fermat Attack on RSA
(RSA ) (2022 3 14 ) https://fermatattack.secvuln.info ( ) ( ) / 1643 2 RSA 2 OK ( ) https://qiita.com/tnakagawa/items/d87fd8459ec9e1ce6844 RSA 2022 3-4 — 2022-06-13 – p.25/57
( ) PKI ( ) ɾ ΠϯλʔωοτΛ௨ͯ͠ಘͨެ։ݤʹ ɹຊͩͱ͍͏อূ͕ͳ͍ ɾ ূ໌ॻͷॺ໊ʹΘΕ͍ͯΔެ։ݤຊ͔͔Βͳ͍
"MJDF #PC $BSPMF ূ໌ऀ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ ެ։ݤ ݤϖΞ ൿີݤ ൿີݤ ൿີݤ ެ։ݤ # C C C C C C C C C " # ୭ͷʁ $" Πϯλʔωοτ ॺ໊ ॺ ॺ໊ ໊ ໊ ɾ ̖ͷެ։ݤͷॺ໊ ূ໌ॻ ɾ ͨͩ͠ɺ ॺ໊͕ຊ͔ݕূ͢Δ ɹʹ̘̖ͷެ։ݤ͕ඞཁ .BMJTTB ߈ܸऀ & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & . " (PKI) CA (Certificate Authority) CA CA CA ( ) ← CA 2022 3-4 — 2022-06-13 – p.26/57
Web of Trust "MJDF͔Βݟͨɺ ਓͷ৴༻ "MJDF͔Βݟͨɺ ݤͷਅਖ਼ੑ શʹ৴༻͍ͯ͠Δ ਅਖ਼Ͱ͋Δ ڀۃతʹਅਖ਼
ਅਖ਼ͬΆ͍͔ ͋Δఔͷ৴༻ Θ͔Βͳ͍ Θ͔Βͳ͍ ڀۃతʹ৴༻Ͱ͖Δ "ˠ#ͷҙຯ ʮ"͕#ͷެ։ݤʹॺ໊ʯ ଞਓͷެ։ݤʹॺ໊͢Δࡍɺ ϑΟϯΨʔϓϦϯτ μΠδΣετ ΛνΣοΫ͢ΔΑ͏ͳਓ͔ͳ "MJDFݤͷॴ༗ऀͷ ৴༻ΛධՁ͢Δ ݤͷਅਖ਼ੑܭࢉͰ ٻΊΒΕΔ (PKI) (PGP ) 2022 3-4 — 2022-06-13 – p.27/57
10 ATM 1 ATM 1 : http://www.slideshare.net/yamaz2/ss-58813038 ( ) ⇒
ATM 2022 3-4 — 2022-06-13 – p.28/57
(safety) ( ), ( ), etc. (liveness) ( ), etc.
( ) ( = ) 2022 3-4 — 2022-06-13 – p.29/57
CAP ( . . . ) Consistency ( ) Availability
( ) Partition tolerance ( ) ⇒ 3 Eventual consistency ( ) . . . 2022 3-4 — 2022-06-13 – p.30/57
Consistency ( ) Strong consistency ( ) (safety) Eventual consistency
( ) (liveness) ↑ Weak consistency ( ) 2022 3-4 — 2022-06-13 – p.31/57
(1) : NFT 2022 3-4 — 2022-06-13 – p.32/57
( ) = = : . . . ( :
) ( ) . . . . . . . . . 2022 3-4 — 2022-06-13 – p.33/57
↑ ( ) PDF 2022 3-4 — 2022-06-13 – p.34/57
⇒ ( ) . . . . . . 2022
3-4 — 2022-06-13 – p.35/57
NFT ( ) NFT : Non-Fungible Token ( ) (1
) → fungible token (1 ) → NFT 2022 3-4 — 2022-06-13 – p.36/57
ERC-721 ERC (Ethereum Request for Comments) 721 (721 ) https://github.com/ethereum/EIPs/blob/master/EIPS/eip-721.md
interface ERC721 { function balanceOf(address _owner) external view returns (uint256); function ownerOf(uint256 _tokenId) external view returns (address); function safeTransferFrom(address _from, address _to, uint256 _tokenId, . . . ) external payable; : } interface ERC721TokenReceiver { function onERC721Received( .. . , uint256 _tokenId, . . . ) external returns(bytes4); } interface ERC721Metadata { function name() external view returns (string _name); function symbol() external view returns (string _symbol); function tokenURI(uint256 _tokenId) external view returns (string); } tokenURI URL ( ) ( ) 2022 3-4 — 2022-06-13 – p.37/57
NFT ( ) τʔΫϯ *% ൪߸ 63* ΞυϨε 63* /'5
Ұҙ Ұҙʁ Ұҙʁ Ұҙʁ Ұҙ ࣄ্࣮Ұҙ ϝλσʔλ ίϯτϥΫτͱ͍͏ఆٛҬ ˞ͦͷίϯτϥΫτͱ͍͏ఆٛҬͷதͰ ɹ࣮ઢҹͰࣔͨ͠ҰҙੑΛอূ͢Δʹա͗ͳ͍ ˞ഁઢҹͰࣔͨ͠Ұҙੑɺ࣮ɾӡ༻ͷ࣍ୈͰอূͰ͖Δ ˞ྫ͑ɺ63* 63- ͕ͦΕ͕ࢦ͢Ϧιʔεͷ ɹ҉߸ֶతμΠδΣετΛؚΉ ରσʔλ ը૾ͱ͔ ॴ༗ऀ ϝλσʔλ 63* ରσʔλ 63* ൿີ伴 Ұҙ Ұҙʁ 2022 3-4 — 2022-06-13 – p.38/57
NFT NFT URL Marlinspike, M.: My first impressions of web3
(2022) Web3 . . . URL ↑ NFT → → NFT NFT ↔ Lazy Minting NFT ( ) 2022 3-4 — 2022-06-13 – p.39/57
NFT < , ID> ERC-721 ← OK NFT . .
. ID → ID NFT NFT URL . . . URL . . . →NFT 2022 3-4 — 2022-06-13 – p.40/57
NFT NFT . . . NFT ( ) ↑ ID
. . . 2022 3-4 — 2022-06-13 – p.41/57
NFT : ERC-721 NFT NFT (ID) NFT → URI NFT
( NFT ) (ID) (URI) → NFT ( ) URI → ( ) → ( ) NFT NFT NFT 2022 3-4 — 2022-06-13 – p.42/57
NFT NFT ⇒ 2022 3-4 — 2022-06-13 – p.43/57
(2) : https://www.cloudsign.jp https://www.gmosign.com 2022 3-4 — 2022-06-13 – p.44/57
NPO NICT CYDER https://cyder.nict.go.jp (3) : 2022 3-4 — 2022-06-13
– p.45/57
Πϯγσϯτͷ༧ஹͳͲ ॳಈରԠ ෮چાஔ ఆରԠ ࠶ൃࢭࡦ ߃ٱରԠ ݕ౼ ࣄޙରԠ τϦΞʔδ ใ
ࠂ ɾ ެ ද Π ϯ γ σ ϯ τ ϋ ϯ υ Ϧ ϯ ά Π ϯ γ σ ϯ τ Ϩ ε ϙ ϯ ε ސ ٬ ɾ ެ ڞ ݕɾड ରԠํݕ౼ 1PJOUPG$POUBDU ূڌอશ ෧͡ࠐΊ ࠜઈ , , DoS , , etc. 2022 3-4 — 2022-06-13 – p.46/57
Point of Contact (PoC) 1 2022 3-4 — 2022-06-13 –
p.47/57
2022 3-4 — 2022-06-13 – p.48/57
HDD ( ) 2022 3-4 — 2022-06-13 – p.49/57
2022 3-4 — 2022-06-13 – p.50/57
( ) 2022 3-4 — 2022-06-13 – p.51/57
( ) JPCERT/CC, NISC, ( ) ( ) 2022 3-4
— 2022-06-13 – p.52/57
(1 ) 2022 3-4 — 2022-06-13 – p.53/57
(3) : 70 1,000 Twitter 3 1. 2. 3. 3
2022 3-4 — 2022-06-13 – p.54/57
2022 3-4 — 2022-06-13 – p.55/57
2. OK (1) (2) 2020 6 16 ( ) 23:59
JST Waseda Moodle (Q & A ) 2022 3-4 — 2022-06-13 – p.56/57
Zoom Discord # 2022 3-4 — 2022-06-13 – p.57/57