Messaging Layer Security and stuff @ IETF105

by sylph01

Slide 1

Slide 1 text

Messaging Layer Security, and other security related stuff Ryo Kajiwara @ lepidum IETF105 Report Session, ISOC-JP

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

Messaging Layer Security (mls)

Slide 4

Slide 4 text

աڈʹ࿩ͨ͠ࢿྉʹ͍ͭͯ ݕࡧͯ͠ग़ͯ͘Δࢿྉʹ͸ࢲ͕2018/8ʹ࿩ͨ͠ࢿྉ͕ग़͖ͯ·͢ ͕ɺ۩ମతͳํࣜʹؔͯ͠͸͔ͳΓଟ͘ͷΞοϓσʔτ͕ೖͬͯ ͍·͢ɻ֓આ෦෼ʹؔͯ͠͸एׯͦΕΛྲྀ༻͍ͯ͠·͢ɻ https:/ /speakerdeck.com/sylph01/messaging-layer-security ۩ମతʹݴ͏ͱɺ17൪໨ͷεϥΠυҎ߱ͷ಺༰͸΄ͱΜͲݱࡏͷ υϥϑτʹ࢒͍ͬͯ·ͤΜɻπϦʔͷܭࢉʹؔͯ͠Asynchronous Ratchet Treeͷ֓೦͚ͩ͸ࠓͷυϥϑτͰ΋͋Δఔ౓௨༻͠·͢ɻ

Slide 5

Slide 5 text

͜Ε͸Կʁ ෳ਺ਓͷάϧʔϓʹ͓͚ΔηΩϡΞϝοηʔδϯάͷͨΊͷ伴ަ ׵ͷํ๏Λඪ४Խ͠Α͏ɺͱ͍͏Internet-Draft -> Working Groupɻ ͘͢͝ฏ͍ͨ͘͏ͱɺάϧʔϓνϟοτΛEnd-to-End҉߸Խ͢Δ ํ๏Λඪ४Խ͠Α͏ͥɺͱ͍͏಺༰ɻ

Slide 6

Slide 6 text

ηΩϡΞϝοηʔδϯάʁ ࠷ۙͷϝοηʔδϯάαʔϏε͸End-to-End҉߸Խ͕ී௨Ͱ͢ɻ • Signalʢ͕͜͜͸͠Γʣ • Facebook Messenger • WhatsApp • LINE ͳͲ͸End-to-End҉߸ԽΛطʹऔΓೖΕ͍ͯ·͢ɻ

Slide 7

Slide 7 text

WG Charter͔Βཁ໿ ҎԼͷੑ࣭Λ࣋ͭάϧʔϓ伴ͷ߹ҙɾϝοηʔδอޢΛඞཁͱ͢ ΔΞϓϦέʔγϣϯ͕ଟ͘ଘࡏ͢ΔͨΊɺͦΕΛ࣮ݱ͍ͨ͠: ϝοηʔδͷൿີੑɺϝοηʔδͷ׬શੑɾೝূɺϝϯόʔͷೝ ূɺඇಉظੑɺForward SecrecyɺPost-Compromise Securityɺε έʔϥϏϦςΟ

Slide 8

Slide 8 text

είʔϓʹ͍ͭͯ • ֤ϕϯμʔ͸ಠࣗϓϩτίϧͰ࣮ݱ͍ͯ͠ΔͨΊɺࣗ਎ͷϓϩ τίϧɾελοΫΛಠཱʹҡ࣋؅ཧ͢Δඞཁ͕͋Γɺ݁Ռͱ͠ ͯಠཱʹ඼࣭อূΛ͢Δඞཁ͕͋Δɻ • MLS͸ϝοηʔδͷηΩϡϦςΟ෦෼ʹ͍ͭͯڞ௨ͷํ๏Λఏ ࣔ͢Δ͜ͱͰɺϓϩτίϧͷਖ਼౰ੑɾ҆શੑͷݕূ݁ՌΛڞ༗ Ͱ͖Δ͜ͱΛ໨ࢦ͢(shared validation of the protocol)ɻ • 伴߹ҙҎ্ͷϝοηʔδϯάΞϓϦέʔγϣϯͷ interoperability/federationΛఏڙ͢Δ΋ͷͰ͸ͳ͍

Slide 9

Slide 9 text

ඇಉظੑ(asynchronous usage) ͜͜Ͱ͍͏ʮඇಉظੑʯͱ͸ɺ2ਓͷϢʔβʔ͕ಉ࣌ʹΦϯϥΠϯ Ͱ͋Δ͜ͱΛཁٻ͢ΔΑ͏ͳMLSͷoperation͕ଘࡏͯ͠͸͍͚ͳ ͍ɺͱ͍͏ੑ࣭ͷ͜ͱɻ

Slide 10

Slide 10 text

Forward Secrecy ௨৴ϓϩτίϧͷੑ࣭Ͱɺ௕ظ伴(long-term key)ͷ๫࿐ʹΑͬͯա ڈͷηογϣϯΩʔͷ҆શੑ͕ࣦΘΕͳ͍ɺͱ͍͏ੑ࣭ɻ ʮաڈͷηογϣϯΩʔʯͷ҆શੑͳͷʹʮForwardʯʁˠϝο ηʔδΛૹͬͨ͋ͱকདྷʹΘͨͬͯηογϣϯΩʔͷ๫࿐ʹ଱͑ Δɺͱ͍͏ੑ࣭͔ͩΒɻ TLSͷจ຺ͰͷFSͱಉٛɻ·ͨɺ"Perfect" Forward Secrecyͱ Forward Secrecy͸Ұൠʹಉٛɻ

Slide 11

Slide 11 text

Post-Compromise Security ݫີͳఆٛͱͯ͠͸ "On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees" (Cohn-Gordon et al., 2017) ͷ(3.0.2)ͱ(3.1)ɺ άϧʔϓϝϯόʔͷ׬શͳঢ়ଶ(௕ظ伴ͱͦΕΒ͔Βಋग़͞Εͨ伴) ͕compromise͞Εͨͱͯ͠ɺ৽ͨʹ҆શͳ伴͕ಋग़͞Εͯάϧʔ ϓͷձ࿩͕ܧଓ͞ΕҎޙͷൿີੑ͕कΒΕΔͱ͖ɺpost- compromise securityΛ࣋ͭɺͱ͍͏ɻ FS/PCS͸mls-architectureͷ3.2.2.1Ͱ΋ఆٛ͞Ε͍ͯΔɻ

Slide 12

Slide 12 text

Documents • draft-ietf-mls-architecture-02 • draft-ietf-mls-protocol-07 • draft-omara-mls-federation-00

Slide 13

Slide 13 text

mls-architecture

Slide 14

Slide 14 text

લఏ • full messaging protocolͷ࣮૷Λҙਤ͍ͯ͠ͳ͍ (<-> XMPP) • wire encodingͷఆٛͰ͸ͳ͘ɺந৅తͳσʔλߏ଄ͷΈΛఆٛ • άϧʔϓͷن໛͸as large as thousands

Slide 15

Slide 15 text

໾ׂ Messaging Service͸2ͭͷabstract serviceΛఏڙ͢Δ: • Authentication Service: long-term identityͷ؅ཧ • long-term identity keyͷσΟεΧόϦʔαʔϏε • Delivery Service: ϝοηʔδͷड৴ͱ࠶഑෍ • ϝοηʔδͦͷ΋ͷͷϒϩʔυΩϟετͷ΄͔ɺάϧʔϓ伴 ߹ҙʹඞཁͳkeying materialͷ഑෍ͷ໾ׂ΋ߦ͏ ಉҰαʔόʔͰ΋Α͍͕ɺ໾ׂ͕ҧ͏ͷͰจষ্۠ผ͞ΕΔ

Slide 16

Slide 16 text

ηΩϡϦςΟલఏͷิ଍ 2.3.5: ΦϑϥΠϯͷϝϯόʔ͕ݹ͍伴Λ͍࣋ͬͯͨΒForward Secrecy/ Post-Compromise SecurityͷલఏͰ͋Δkeying materialͷ࡟আ/ஔ׵ ͸ෆՄೳɻMLS͸͜ͷ໰୊΁ͷରԠ͸ߦΘͳ͍(࣮૷Ͱղܾ͠Ζɺ ͱ͍͏͜ͱ͔)ɻ

Slide 17

Slide 17 text

ཁ݅ (Ұ෦ൈਮ) • ಉ࣌ΦϯϥΠϯΛཁٻ͠ͳ͍ (asynchronous) • एׯͷϝοηʔδϩε͕ൃੜͯ͠΋permanent exclusionʹͭͳ ͕Βͳ͍ • ϚϧνσόΠεରԠ • ཤྺͷ෮ݩ͸FS/PCSͷલఏΛ่͢ͷͰϓϩτίϧϨϕϧͰ͸ ڐՄ͠ͳ͍͕ଞͷํࣜͰ΍Δ͜ͱ͸ߟ͑ΒΕΔ

Slide 18

Slide 18 text

ཁ݅ (Ұ෦ൈਮɺଓ͖) • ϖΠϩʔυͷϑΥʔϚοτΛԾఆ͠ͳ͍ • ෳ਺ͷMLS࣮૷͕federation͢Δ͜ͱ͸͋ΓಘΔ • ͕charterͱͯ͠͸είʔϓ֎ɺmls-federationͰ΍͍ͬͯΔ໛ ༷ • কདྷόʔδϣϯͱͷޓ׵ੑ

Slide 19

Slide 19 text

ηΩϡϦςΟཁ݅ • ΫϥΠΞϯτͱαʔόʔͷؒͷ௨৴͸TLSͳͲͰ҉߸Խ͞Ε͍ͯ Δ͜ͱΛԾఆ͢Δ͕ɺτϥϯεϙʔτ૚ͷcompromiseʹ͸ASʹ ΑΔidentity keys͕ద੾ʹೝূ͞Ε͍ͯΔݶΓ଱͑Δ • DS͸άϧʔϓͷprivate content΁ͷΞΫηεΛ࣋ͨͳ͍(؅ཧऀ ͕ϝοηʔδΛ೷͖ݟΔ͜ͱ͸Ͱ͖ͳ͍) • ϝϯόʔͷ௥Ճ/࡟আ: MLS͸ଞͷϝϯόʔʹ஌ΒͤΔ͜ͱͳ͘ϝ ϯόʔͷ௥Ճ/࡟আΛߦ͏͜ͱΛڐՄ͠ͳ͍(ϓϩτίϧͷ࢓૊Έ ্ͦ͏ͳ͍ͬͯΔ)

Slide 20

Slide 20 text

mls-protocol

Slide 21

Slide 21 text

(എܠ)2 partiesͷ৔߹͸ղܾࡁΈ Signal Messaging ProtocolͰ༻͍ΒΕ͍ͯΔDouble Ratchetํࣜɻ "Ratchet"͸ʮҰ౓ਐΜͩΒ໭Βͳ͍ʯ΋ͷͷྫ͑Ͱɺ҉߸෼໺ʹ ͓͚Δ"Ratchet"ͱ͸ϋογϡؔ਺Λ࢖ͬͯʮ৽͍͠஋͔Βաڈͷ ஋ΛܭࢉͰ͖ͳ͍Α͏ʹͯ͠伴Λಋग़͢Δʯ࢓૊Έͷ͜ͱɻ ͷΑ͏ʹͯ͠ϝοηʔδ͝ͱʹ伴Λߋ৽͢Δɻ

Slide 22

Slide 22 text

(എܠ)ʮͨ͘͞ΜʯͷࢀՃऀͷ৔߹͠ ΜͲ͍ Α͘औΒΕΔํ๏͸ɺطʹཱ͍֬ͯ͠ΔνϟϯωϧΛ௨ͯ͠ ʮsender keyʯΛҰํతʹbroadcastɺ֤ࢀՃऀ͸ͦͷʮsender keyʯͰ҉߸Խͨ͠ϝοηʔδΛૹ৴͢Δɺͱ͍͏΋ͷɻ "hash ratchet"Λ࢖͏͜ͱͰForward Secrecy͸࣮ݱͰ͖Δ͕ɺҰ౓ 伴͕ഁΒΕΔͱ伴Λߋ৽͢Δͷʹಉ͡ํ๏Λ࢖Θͳͯ͘͸ͳΒ ͣɺpost-compromise security͕ͳ͍ͱ͍͑Δɻ

Slide 23

Slide 23 text

Ͳ͏΍࣮ͬͯݱ͢Δʁ

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

Ͳ͏΍ͬͯάϧʔϓͷڞ༗ൿ ີΛ҆શʹڞ༗͢Δʁ ެ։伴҉߸(Diffie-Hellman)Ͱɺʮࣗ਎ͷൿີ伴ʯʴʮଞͷϝϯόʔ ͷൿີ伴ʯΛ࢖ͬͯڞ༗ൿີΛಋग़͢Δɻશһͷൿີ伴Λ͍͍ͪ ͪ࢖͏ͱܭࢉίετ͕ߴ͍ͷͰπϦʔߏ଄Λऔ͍ͬͯΔɻ Asynchronous Ratchet Treeͱ͍͏࢓૊Έ͕͜Εʹ૬౰͢Δ͕ɺҰൠ ੑΛอͭͨΊdraft-01͔Β͸"Ratchet Tree"ͱ͍͏ޠʹมߋ͞Ε͍ͯ Δɻ

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

WG activity @ IETF 105

Slide 31

Slide 31 text

User Authentication Within Groups https:/ /datatracker.ietf.org/meeting/105/materials/slides-105-mls- sessa-user-authentication-within-groups-00.pdf SignalͰ͸௕ظ伴͔ΒϩάΠϯ༻QRίʔυΛੜ੒͍ͯ͠Δɻ͜ΕͰ ͸Post-Compromise Security͕ͳ͍ɻ Epoch-Level Authenticationʢಛఆͷ࣌఺ͰͷΈ༗ޮͳϩάΠϯ༻ QRίʔυΛੜ੒ʣͷಋೖͱͦͷํ๏ͷఏҊɻ

Slide 32

Slide 32 text

Protocol Enhancements • group secretͷߋ৽ΛͰ͖ΔݶΓdefer͍ͨ͠ • ݱࡏ͸group΁ͷ௥Ճͷࡍʹϝοηʔδϯάͷ༗ແʹؔΘΒͣ group secretͷߋ৽͕ߦΘΕɺ݁ՌେྔͷDHԋࢉ͕ൃੜ͢Δ • add/update/remove͸ఆ਺࣌ؒͰࡁΉΑ͏ʹͳΔ͚ΕͲ ratchetʢsecretͷߋ৽ʣͷίετ͕ߴ͍ɺͱ͍͏τϨʔυΦ ϑ͕͋Δ

Slide 33

Slide 33 text

Protocol Enhancements • Server-Initiated Add • LazinessΛಋೖͨ͠Βαʔόʔ͕AddΛ࡞ΕΔΑ͏ʹͳΔ (Welcome͸init secretΛؚΉͷͰෆՄೳ) • ݱࡏ͸User-Initiated AddͱGroup-Initiated Add͸ผͷ࢓૊ΈΛ ࢖͍ͬͯΔ͕ɺinit secret΋ඇಉظԽͰ͖Ε͹౷ҰͰ͖Δ͠ɺ ೝূ͞Εͨϝϯόʔ͸WelcomeΛ߹੒Ͱ͖ΔΑ͏ʹͳΔ • ͨͩ͠DH-like construction΁ͷϩοΫΠϯ͕༗Γಘͦ͏ͳͷ ʹՃ͑ͯݕূ͕͠ΜͲͦ͏

Slide 34

Slide 34 text

ਐḿ mls-protocol • draft-08: 10݄ͷinterim • draft-09: 11݄ͷIETF 106 • ೥಺WGLCΛ໨ࢦ͢ͱͷ͜ͱ

Slide 35

Slide 35 text

ࠓޙ΋ಈ޲ͷupdateΛ ใࠂ͍͚ͯ͠Ε͹ͱࢥ ͍·͢ ͋ͱάϧʔϓ伴߹ҙʹ͍ͭͯݹయతͳconstructionҎ֎Λ༻͍Δํ ๏΋͋Γͦ͏…ʁ

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

Slide 38

Slide 38 text

IoTؔ܎ͷ࿩(teep, suit, rats)͸ଞͷํ͕͠Ό΂ Δͱࢥ͏ͷͰলུ

Slide 39

Slide 39 text

oauth.xyz (࣮ࡍʹ͜ͷ໊લΛURLόʔʹಥͬࠐΉͱαΠτ͕ग़ͯ͘Δ) OAuth 2.0͸ଟ͘ͷϢʔεέʔεΛΧόʔͨ͠ΓηΩϡϦςΟ্ͷ ໰୊ΛΧόʔ͢ΔͨΊʹଟ͘ͷ֦ு͕ग़͖͚ͯͨΕͲɺಉ͡໰୊ Λෳ਺ͷํ๏Ͱղܾ͢ΔΑ͏ͳෳࡶੑΛੜΈग़ͯ͠͠·ͬͨɻ τϥϯβΫγϣϯϞσϧ(Ұͭͷtransaction IDΛத৺ʹɺػೳΛ෇ ͚଍͍ͯ͘͠৔߹͸τϥϯβΫγϣϯʹ伴Λ௥Ճ͍ͯ͘͠ɺͱ͍ ͏ํࣜ)Ͱ੔ཧ͠ͳ͓ͦ͏ɺͱ͍͏ࢼΈɻ

Slide 40

Slide 40 text

Dragonblood ANRWͷinvited talkɻWPA3ͷDragonflyϋϯυγΣΠΫʹαΠυ νϟωϧ߈ܸ੬ऑੑ͕͋Γ·͢ɺͱ͍͏࿩ɻ ύεϫʔυΛପԁۂઢ͋Δ͍͸༗ݶମ্ͷཁૉʹม׵͢Δࡍ(hash- to-curve/group)ͷ࣮૷͕·ͣ͘ɺύεϫʔυʹΑͬͯࢼߦճ਺͕ม Θͬͯ͠·͏ͨΊɺ࣮ߦ࣌ؒΛଌఆ͢Δ͜ͱͰύεϫʔυಛఆͷ ͨΊͷ৘ใΛऔΓग़ͤΔɻ ͳ͓ɺ͜ͷൃදͷ͋ͱ͞Βʹ௥ՃͰCVE-2019-13377/13456͕ಉ ҰஶऀʹΑΓൃද͞Εͨɻ

Slide 41

Slide 41 text

TLS 1.3 Impact on Network Based Security Solutions TLS 1.3ͰϛυϧϘοΫε͕ఏڙ͍ͯͨ͠ηΩϡϦςΟػೳ͕Ͳ͏ յΕΔ͔ͷ·ͱΊɻյΕΔ͔Β௚ͤɺͱ͍͏ओுͰ͸ͳ͘ɺӨڹ ൣғΛ໌Β͔ʹ͢Δ͜ͱΛ໨తͱ͍ͯ͠Δ΋ͷɻʢͱ͸͍͑ɺଟ ෼ͦ͏͍͏࿩΋ؚ·Ε͍ͯͦ͏ͩΑͳ͋…ʣInformational RFCͱ͢ Δ͜ͱΛ໨ࢦ͍ͯ͠Δɻ https:/ /datatracker.ietf.org/meeting/105/materials/slides-105-tls- sessb-tls-impact-on-network-security-00

Slide 42

Slide 42 text

ଟ෼ೖΓ͖Βͳ͍ͱࢥ͏DNS ؔ܎͸ࠓճ͸ׂѪ • ANRW: Oblivious DNS, Who Is Answering My Queries (DNS interceptionͷଌఆ), What Can You Learn from an IP? • dnsop • add (Applications Doing DNS) Ͳ͔͜Ͱެ։༧ఆʁ