仮想通貨取引所が使うウォレットのセキュリティを考える

by Shu Kobuchi

Slide 1

Slide 1 text

Ծ૝௨՟औҾॴ͕࢖͏ ΢ΥϨοτͷηΩϡϦςΟ ೥݄೔ ϒϩοΫνΣʔϯηΩϡϦςΟษڧձ!/FVUSJOP ϑϨηοπגࣜձࣾɹখᔹप 4IV,PCVDIJ

Slide 2

Slide 2 text

খᔹपɹ4IV,PCVDIJɹ!TIV@LPCTIVLPCVDIJ ෱Ԭݝ൧௩ࢢੜ·Εɹฌݿݝ੢ٶࢢɾๅ௩ࢢҭͪ ਆށେֶւࣄՊֶ෦ଔۀ ಸྑઌ୺Պֶٕज़େֶӃେֶ৘ใՊֶݚڀՊम࢜ྃ ৽ଔͰՈిϝʔΧʔͰιϑτ΢ΣΞ։ൃ ͦͷޙ4*FSͰͷडୗ։ൃ౳ େࡕͷϕϯνϟʔͰ#JUDPJO8FC8BMMFUࢼ࡞඼։ൃ ʙגࣜձࣾΩϡʔϒγεςϜ w ʙେࡕʹͯɺڭҭܥେن໛جװγεςϜͷ։ൃͱอक w ʙɹ౦ژసۈɺٕज़ઓུࣨʢϒϩοΫνΣʔϯͳͲʣ ʙϑϨηοπגࣜձࣾͷγχΞιϑτ΢ΣΞΤϯδχΞ w Ծ૝௨՟ࣄۀऀ޲͚΢ΥϨοτ։ൃΛ୲౰ ࣗݾ঺հ !2

Slide 3

Slide 3 text

҉߸௨՟ಡॻձʗษڧձɹIUUQTDSZQUPDVSSFODZDPOOQBTTDPN ॳ৺ऀʙதڃऀ޲͚ͷʮϏοτίΠϯͱ͔ษڧձʯʢ݄̍ճɿฏ೔໷ʣ w ࣍ճ͸ Ր ʙϦΫϧʔτάϧʔϓώϡʔϦοΫۜ࠲ஸ໨Ϗϧ தڃऀʙ্ڃऀ޲͚ͷʮ҉߸௨՟ྠಡձʯʢ݄̍ճɿฏ೔໷ʣ w ࣍ճ͸ ݄ ʙϝϧϖΠ ࿡ຊ໦ώϧζ৿Ϗϧ DSBTIBDBEFNZ *5ܥಈը഑৴ ʹͯϏοτίΠϯͱ͔ษڧձͷΞʔΧΠϒ഑৴த  IUUQTDSBTIBDBEFNZDPNNVOJUZDSZQUPDVSSFODZ :PV5VCFνϟϯωϧʢྠಡձʗษڧձʣIUUQTHPPHM"2&W+ ϩάϛʔ5FDI ษڧձॻ͖ى͜͠ IUUQTHPPHMK,"-3 ίϛϡχςΟ঺հ !3

Slide 4

Slide 4 text

Ծ૝௨՟औҾॴ΢ΥϨοτʹ͍ͭͯ

Slide 5

Slide 5 text

ΞδΣϯμ ϗοτ΢ΥϨοτʗίʔϧυ΢ΥϨοτ Ϛϧνγά &UIFSFVNͳͲͷϚϧνγά w εϚʔτίϯτϥΫτΛ࢖Θͳ͍ঝೝํ๏ ൿີ෼ࢄ๏ ϑϨηοπʹ͍ͭͯ ˞΢ΥϨοτͷηΩϡϦςΟʹਖ਼ղ͸͋Γ·ͤΜ  ɹฐࣾ੡඼Λ༻͍ͨࣄྫΛ༻͍ͯ͝આ໌͠·͢ !5

Slide 6

Slide 6 text

Ծ૝௨՟΢ΥϨοτͱ͸ ൿີ伴ͷೖΕ෺ ιϑτ΢ΣΞ ετϨʔδʹ֨ೲ͞Εͨൿີ伴ΛΞϓϦέʔγϣϯͰར༻ ϋʔυ΢ΣΞ ϖʔύʔ ൿີ伴͕ΦϯϥΠϯ઀ଓ͞Ε͍ͯΔ୺຤಺ʹ͋Δͷ͕ϗοτ΢ΥϨοτ ൿີ伴͕׬શΦϑϥΠϯͳ୺຤Ͱѻ͑Δͷ͕ίʔϧυ΢ΥϨοτ ίʔϧυ΢ΥϨοτͷػೳ͸ϊʔυͱͯ͠Ͱͳ͘ɺॺ໊ͷར༻ʹಛԽ !6 ίΠϯ͕ೖͬ ͍ͯΔΑΓ΋ɺ 伴͕ೖ͍ͬͯ ΔΠϝʔδ

Slide 7

Slide 7 text

औҾॴͷ΢ΥϨοτ Ծ૝௨՟औҾॴ ަ׵ॴ ΢ΥϨοτͰඞཁͳػೳ ೖۚ w ΞϦε͕औҾॴͷΞυϨεʹૹۚ ग़ۚ w ΞϦεͷग़ۚϦΫΤετΛड͚ͯɺऔҾॴ͔ΒΞϦεͷΞυϨεʹૹ ۚ !7 Ծ૝௨՟औҾॴ ʢަ׵ॴʣ ೖۚ ग़ۚ

Slide 8

Slide 8 text

औҾॴͷ΢ΥϨοτ ϗοτ΢ΥϨοτ͸ΦϯϥΠϯ઀ଓ͞Ε͍ͯΔͨΊɺ֎෦͔ΒԾ૝௨՟ͷ౪೉ ͷඃ֐ʹૺ͏ةݥੑ͕ߴ͍ ίʔϧυ΢ΥϨοτ͸׬શΦϑϥΠϯͷͨΊɺΠϯλʔωοτܦ༝Ͱͷ౪೉ͷ ةݥੑ͸গͳ͍ ίʔϧυ΢ΥϨοτͰશ෦อ؅Ͱ͖Ε͹҆શ͕ͩɺଈ࣌ग़ۚʹରԠͰ͖ͳ͍ͳ ͲෆศͳͷͰɺϗοτ΢ΥϨοτʹগͳׂ͍߹ͰԾ૝௨՟Λอ࣋  ྫ ϗοτɿίʔϧυ̍ɿ̕ !8 ϗοτ ΢ΥϨοτ ίʔϧυ ΢ΥϨοτ ϗοτ΢ΥϨοτ͸ ΦϯϥΠϯ઀ଓ ίʔϧυ΢ΥϨοτ͸ ׬શΦϑϥΠϯ

Slide 9

Slide 9 text

ૹۚͷྲྀΕ CJUDPJOEΛྫʹ ະॺ໊59࡞੒DSFBUFSBXUSBOTBDUJPO $ bitcoin-cli createrawtransaction "[{\"txid\":\"abaecccc21ca238a3f4b58a872c14fe47f1c8722d90493c2e8f85d9e56d7702f\",\"vout\":0}]" "[{\"2NGa1SWywnSmHqy7WL8rStYYa6FLFpyYnVL\":0.005}]" 02000000012f70d7569e5df8e8c29304d922871c7fe44fc172a8584b3f8a23ca21ccccaeab0000000000ffffffff0120a1 07000000000017a914ffd8526f832e9ae817767757c1f8d9efc39e68b58700000000 ൿີ伴Ͱॺ໊TJHOSBXUSBOTBDUJPO $ bitcoin-cli signrawtransactionwithwallet 02000000012f70d7569e5df8e8c29304d922871c7fe44fc172a8584b3f8a23ca21ccccaeab0000000000ffffffff0120a1 07000000000017a914ffd8526f832e9ae817767757c1f8d9efc39e68b58700000000 { "hex": "020000000001012f70d7569e5df8e8c29304d922871c7fe44fc172a8584b3f8a23ca21ccccaeab0000000017160014f39 af1383125efc22d85ba35b8dad1bfe96867ccffffffff0120a107000000000017a914ffd8526f832e9ae817767757c1f8d 9efc39e68b5870247304402207740bd427784122c7275894f8ff402a89ee86a1a28f9bb62d49b4e8665b341c00220079ee ca9457c048bc9a5d8525ebb7b47ed21433e625d12118601a98694a2c58c012103f4cb1b486625b8955d3ccd4782a67c582 33bee788d7e52f5a5e84573d243be1300000000", "complete": true } ϒϩʔυΩϟετTFOESBXUSBOTBDUJPO $ bitcoin-cli sendrawtransaction 020000000001012f70d7569e5df8e8c29304d922871c7fe44fc172a8584b3f8a23ca21ccccaeab0000000017160014f39a f1383125efc22d85ba35b8dad1bfe96867ccffffffff0120a107000000000017a914ffd8526f832e9ae817767757c1f8d9 efc39e68b5870247304402207740bd427784122c7275894f8ff402a89ee86a1a28f9bb62d49b4e8665b341c00220079eec a9457c048bc9a5d8525ebb7b47ed21433e625d12118601a98694a2c58c012103f4cb1b486625b8955d3ccd4782a67c5823 3bee788d7e52f5a5e84573d243be1300000000 51b10e463ae300301209243a207668f2f8d431d5fc089e1fbf9ad7f67e8e21f2 !9 ະॺ໊59 ॺ໊ࡁ59 ॺ໊ ϒϩʔυ Ωϟετ 59*% ॺ໊ࡁ59 ະॺ໊59

Slide 10

Slide 10 text

PGͷ৔߹ ະॺ໊59࡞੒ ঝೝऀ"͕ͭ໨ͷॺ໊ ঝೝऀ#͕ͭ໨ͷॺ໊ ϒϩʔυΩϟετ ผਓ͕ ૢ࡞ Ϛϧνγάͷॺ໊ͰϒϩʔυΩϟετ !10 ະॺ໊59 ॺ໊59 ॺ໊ ϒϩʔυ Ωϟετ ॺ໊ ॺ໊ࡁ59 ΋͏Ұਓ͸ॺ໊ෆཁ ΞϦε Ϙϒ Ωϟϩϧ ൿີ伴" ൿີ伴# ൿີ伴$

Slide 11

Slide 11 text

ฐࣾ੡඼Λ༻͍ͨߏ੒ྫ ϗοτ΢ΥϨοτͰ͸ൿີ伴Λ҉߸Խ ϗοτ΢ΥϨοταʔόʔΛ̏୆༻ҙ͠ɺPGͷϚϧνγάΛߦ͏ ̏୆ͷαʔόʔ͸ผʑͷ71/ 71$ ʹ഑ஔ ϗοτ΢ΥϨοτͷηΩϡϦςΟ !11 )PU )PU )PU %# %# %# 71/ 71/ 71/ PGϚϧνγά ߈ܸऀ͸ͭͷ71/ ʹ৵ೖͯ͠ൿີ伴Λ ୣऔ͠෮߸Խ͠ͳ͍ ͱ௨՟Λ౪Ίͳ͍ ҉߸Խͯ͠ ֨ೲ ҉߸Խͯ͠ ֨ೲ ҉߸Խͯ͠ ֨ೲ 71$ 71$ 71$ ൿີ伴" ൿີ伴# ൿີ伴$

Slide 12

Slide 12 text

ฐࣾ੡඼Λ༻͍ͨߏ੒ྫ ίʔϧυ΢ΥϨοτͰͷॺ໊ʹ͸5SF[PSͳͲͷϋʔυ΢ΣΞ΢ΥϨοτΛ ΦϑϥΠϯ࢖༻ʢΦϑϥΠϯͰ࢖༻Ͱ͖ΔϥΠϒϥϦ͋Γʣ ίʔϧυ΢ΥϨοτͷηΩϡϦςΟ !12 ະॺ໊59 ࡞੒ ൿີ伴ʹΑΓ ॺ໊ࡁ59࡞੒ ηΩϡϦςΟϧʔϜ ʢ׬શΦϑϥΠϯʣ 23ίʔυԽ ҹ࡮ ະॺ໊59 ಡΈࠐΈ ΦϯϥΠϯͷ ࣥ຿ࣨ ॺ໊ࡁ59 ಡΈࠐΈ ϒϩʔυ Ωϟετ 23ίʔυԽ ҹ࡮ ࢴΛ࣋ͬͯ Ҡಈ ΦϯϥΠϯͷ ࣥ຿ࣨ ࢴΛ࣋ͬͯ Ҡಈ ඇ࢖༻࣌͸ۚݿอ؅

Slide 13

Slide 13 text

&UIFSFVNͷϚϧνγά &UIFSFVNʹ͸Ϛϧνγά͕ͳ͘ɺ1BSJUZ͸εϚʔτίϯτϥΫτͰػೳ࡞੒ 1BSJUZ.VMUJ4JH8BMMFU໰୊ &UIFSFVNίϯτϥΫτͰ࡞੒͞Εͨ.VMUJTJH8BMMFUͷதͷ &5) ౰࣌ͷϨʔτͰԯԁ૬౰ ͕ౚ݁ 1BSJUZ.VMUJTJH8BMMFUʹมΘΔ.VMUJTJHίϯτϥΫτΛ։ൃͨ͠ͱͯ͠΋ɺ 1VCMJDωοτϫʔΫͰ͸ৗʹ߈ܸͷةݥʹࡽ͞ΕΔ !13 ߈ܸ

Slide 14

Slide 14 text

ίϯτϥΫτΛ࢖Θͳ͍Ϛϧνγάͷྫ ฐࣾ੡඼Λ༻͍ͨߏ੒ྫ ෳ਺ঝೝΛεϚʔτίϯτϥΫτͰ͸ͳ͘ɺ8FCΞϓϦͰ੍ޚɾॺ໊ w PGΛٖࣅతʹߦ͏ w Ұਓ໨ͷঝೝͷࡍ͸ɺະॺ໊59͸มߋͳ͘ɺೋਓ໨ͷঝೝͷࡍʹγϯ άϧγάͷॺ໊Λͯ͠ॺ໊ࡁΈ59Λ࡞੒͢Δ !14 ະॺ໊59 ॺ໊ࡁ59 ঝೝ 0, %# 0, %# ঝೝ ϒϩʔυ Ωϟετ γϯάϧγάॺ໊

Slide 15

Slide 15 text

ൿີ෼ࢄ๏ Ϛϧνγά͸PGͷ৔߹ͩͱɺຊͷൿີ伴ͷ͏ͪຊ͋Ε͹ະ࢖༻ͷίΠ ϯΛ࢖༻Ͱ͖ΔΑ͏ʹͳΔ ରͯ͠ൿີ෼ࢄ๏Ͱ͸ɺ伴ࣗମΛͭͷ෦඼ʹ෼͚ɺͭͷ෦඼͕͋Ε͹෮ݩ Ͱ͖Δ ॺ໊ͷࡍʹ͸伴ͷ෦඼ΛूΊͯ෮ݩ͠ͳ͚Ε͹ͳΒͳ͍ ෮ݩ͕࣌୯Ұো֐఺ͱͳΔ w ʮ͖͍͠஋ॺ໊ʯʹΑΓɺ伴Λ෮ݩ͠ͳͯ͘΋ॺ໊͕ՄೳʹͳΔ !15 ෼ׂ ྫ ͭதͭ ͋Ε͹෮ݩ ෮ݩ͕࣌ ୯Ұো֐఺

Slide 16

Slide 16 text

ϑϨηοπʹ͍ͭͯ

Slide 17

Slide 17 text

ϑϨηοπ໊ࣾͷ༝དྷ 'SJDUJPOMFTT"TTFUTʢຎࡲͷͳ͍ࢿ࢈ʣ σδλϧࢿ࢈Λॠ࣌ʹຎࡲແ͘ҠಈͰ͖ΔΠϯϑϥΛ࡞Δ !17

Slide 18

Slide 18 text

ࣄۀ಺༰ ΢ΥϨοτࣄۀ 'SFTTFUT&8. &OUFSQSJTF8BMMFU.BOBHFNFOU 4ZTUFN w #JUDPJO &UIFSFVN΢ΥϨοτγεςϜͷอकɾӡ༻ w ଟ௨՟ରԠ ڭҭࣄۀ &8.εϖγϟϦετߨ࠲ʢ؅ཧऀɾΦϖϨʔλɾΤϯδχΞ޲͚ʣ ϒϩοΫνΣʔϯΤϯδχΞूதߨ࠲ʢ)BTI)VCͱఏܞʣ ݚڀ։ൃ কདྷతʹ-JHIUOJOH/FUXPSLɺ෼ࢄܕऔҾॴ %&9 ͳͲͷ3% !18

Slide 19

Slide 19 text

ձࣾ֓ཁ !19

Slide 20

Slide 20 text

'SFTTFUT&8.γεςϜͱ͸ !20

Slide 21

Slide 21 text

೔ຊͷԾ૝௨՟ࣄۀͰଟ͘ͷνϟϯεʂ !21

Slide 22

Slide 22 text

&8.͕೔ܦʹ΋ࡌΓ·ͨ͠ʂ ೔ܦిࢠ൛  IUUQTXXXOJLLFJDPNBSUJDMF%(9-341@2"$ !22

Slide 23

Slide 23 text

ϑϨηοπͷڭҭࣄۀ &8.Λ࢖༻͢Δࣄۀऀ޲͚ͱɺϒϩοΫνΣʔϯΤϯδχΞΛཆ੒͢Δ̎ίʔ εΛ͝༻ҙ !23

Slide 24

Slide 24 text

ϑϨηοπ࠾༻৘ใ ΢ΥϨοτΤϯδχΞ ϑϧλΠϜਖ਼ࣾһ ੵۃ࠾༻தʂ ࢒ۀগͳΊɺ౔೔ॕٳΈʴՆقɾ೥຤೥࢝ٳՋ ʲืूϙδγϣϯʳۚ༥ɾܾࡁܥγεςϜܦݧऀ׻ܴ w ։ൃɾอक 5ZQF4DSJQU /PEFKT -JOVY "84PS"[VSF w ӡ༻ɾ؂ࢹ w ϓϩδΣΫτɾϚωʔδϟʔ ΦϑΟε͸౦ژେֶຊڷΩϟϯύε಺ ϦϊϕͰ৽ஙಉવͷշదۭؒ IUUQTGSFTTFUTDPN IUUQTXXXGBDFCPPLDPNGSFTTFUT IUUQTUXJUUFSDPNGSFTTFUT !24