Signed HTTP Exchanges (SXG)とはなにか/SXG Explained

Signed HTTP Exchange Study https://web-study.connpass.com/event/128480/
の発表資料です。

Transcript

1. 4JHOFE
   )551
   &YDIBOHFT
   49( ͱ͸ͳʹ͔ 49(ͷ࢓૊Έ͔Β".1࿈ܞͷಋೖ·Ͱ େ௡
   ൟथ 49(
   4UVEZ
   ೥݄̑̎̔೔
2. ಺༰  49(ͷ͘͠Έ
    49(".1γεςϜࣄྫ
    BNQQBDLBHFSʹ͍ͭͯ
    49(ಋೖৼΓฦΓ
3. 49(ͷ͘͠Έ
4. ໰୊ɿԿ͕ҧ͏ʁ  4JHOFE
   )551
   &YDIBOHFT
    4JHOFE
   &YDIBOHF
    49(
5. ղ౴  4JHOFE
   )551
   &YDIBOHFT
   ࢓༷ͷਖ਼໊ࣜশ
    4JHOFE
   &YDIBOHF
   ࿩͍ͯ͠Δ࣌ΈΜͳ࢖͍ͬͯΔݴ༿
    49(ɿ
   ֦ுࢠ΋͘͠͸ུশදه
6. ໰୊
   Ͳ͕ͬͪ49( " #
7. ղ౴ " # 49( ".1
8. ໰୊
   Ͳ͕ͬͪ49( " #
9. ղ౴ " # 49( )5514
10. )5514ͱ49(ͷҧ͍ )5514 49( %JTUSJCVUPS 1VCMJTIFS ௨৴ΛकΔ ίϯςϯπΛकΔ ηΩϡΞνϟωϧ FYBNQMFDPN FYBNQMFDPN QVCMJTIFSͷPSJHJOͰදࣔ ॺ໊ ॺ໊
11. )5514ͱ49(ͷҧ͍ )5514 49( ػີੑ 㾎 /" ׬શੑ 㾎 㾎 ೝূ 㾎 㾎 ൱ೝ๷ࢭ /" 㾎 0SJHJO ઀ଓઌ 1VCMJTIFS อޢ͍ͯ͠Δ࣌ؒ ௨৴͍ͯ͠Δؒ
    ਺ඦϛϦඵఔ౓ ॺ໊ͷ༗ޮظؒ
    ࠷େ̓೔ؒ )551ͷ੍ݶ /" ΩϟογϡՄೳͳίϯςϯπݶఆ
    (&5ݶఆɺېࢭϔομ༗
12. 49(ͷ΍ΓऔΓํ๏छ 
    4BNF0SJHJO 
    DSPTTPSJHJO
    4FSWFS
    1VTI 
    BQQMJDBUJPO TJHOFEFYDIBOHF
    ϑΥʔϚοτ 1VTI
    1SPNJTF DSPTTPSJHJO
    4FSWFS1VTI "DDFQU
    BQQMJDBUJPOTJHOFEFYDIBOHFWC 4JHOBUVSF
    4JHOFE)FBEFST 49(ϑΝΠϧ &/"#-&@$3044@ 03*(*/@164) &/"#-&@$3044@ 03*(*/@164) ࠓ೔ͷ࿩
13. ୅දతͳ49(ͷϢʔεέʔε ΦϑϥΠϯ ΦϯϥΠϯ
    ୅දྫ49(".1 49( $FSU 1VCMJTIFS %JTUSJCVUPS )551ϦΫΤετ )551Ϩεϙϯε )551ϦΫΤετ )551Ϩεϙϯε ύοΫͯ͠ॺ໊ ॺ໊ݕূͯ͠࠶ੜ 49(ϑΝΠϧ
14. 49(".1γʔέϯεਤ ݕࡧαʔϏε ".1
    $BDIF 0SJHJO 6" 4FBSDI 4&31 1SFGFUDI 49( (&5 $FSU$IBJO 0$41 49( $FSU$IBJO 0$41 -PDBM$BDIF 7FSJGZ OBWJHBUJPO -PDBM$BDIF ".1࠷దԽ
    5SBOTGPNFS 0SJHJOʹΞΫηε͠ͳ͍ ͜ͱͰ1SJWBDZΛอޢ "DDFQU
    BQQMJDBUJPOTJHOFEFYDIBOHFWC
    ".1$BDIF5SBOTGPSN
    HPPHMFW 7BSZ
    ".1$BDIF5SBOTGPSN #PUΫϩʔϧ (&5 #PUΫϩʔϧ DFSUVSMॻ͖׵͑
    JOEFYԽ %JTUSJCVUPS 1VCMJTIFS
15. ݕࡧ݁Ռ 4&31 ͔Β
    49(Λ1SFGFUDI
16. 49(
    7FSJGZͷঢ়گ EFWUPPM্ωοτϫʔΫύωϧͷ1SFWJFXͰ֬ೝͰ͖·͢
17. 49(ͷঢ়گ w $ISPNF.ΑΓ
    EFGBVMU
    Ͱ
    FOBCMF
    όʔδϣϯC
    w J04൛͸ඇରԠɻݱঢ়ϞόΠϧ؀ڥͰ49(͕࢖͑Δͷ͸ "OESPJE
    $ISPNFͷΈ
    w .BD04൛*&
    &EHF $ISPNJVNϕʔε Ͱ΋49(ಈ࡞֬ೝࡁ
    w (PPHMF
    4FBSDIͰ݄த०ΑΓ49(".1Λਖ਼ࣜରԠ
    w $MPVEqBSF΋49(ػೳఏڙ։࢝ (6*ϕʔε
    w ඪ४Խʜ
    ·ͩΘ͔Γ·ͤΜɻ%*41"5$)&4$"1&
    8PSLTIPQ
    
18. 8FC
    1BDLBHJOH࢓༷֓ཁ ESBGUZBTTLJOIUUQPSJHJO TJHOFESFTQPOTF ESBGUJFUGIUUQCJT IFBEFSTUSVDUVSF ESBGUUIPNTPO IUUQNJD ESBGUZBTTLJOXQBDL CVOEMFEFYDIBOHFT -PBEJOH
    4JHOFE
    
    &YDIBOHFT 8)"58(
    'FUDI #VOEMF 49( 'FUDIʹର͢Δ ϞϯΩʔύον )551ϘσΟͷ )BTI
    %JHFTU ΑΓѻ͍΍͍͢)551 ϔομͷهड़ॻࣜ 8FC
    1BDLBHJOH࢓༷ 3'$
    $#03 #JOBSZ
    +40/ͷ
    γϦΞϥΠζ C೥݄࣌఺ IUUQTHJUIVCDPN8*$(XFCQBDLBHF
19. .FSLMF
    *OUFHSJUZ
    $POUFOU
    &ODPEJOH )BTI "cc1SPPG#ccY " # $ " # $ )551
    3FTQPOTF
    #PEZ ST SFDPSE
    TJ[F ST " 1SPPG# # 1SPPG$ $ .*$& %JHFTU
    NJTIB'037ʜ )BTI #cc1SPPG$ccY )BTI $ccY 1SPPG$ 1SPPG# )551Ϩεϙϯεϔομ ϔομ৘ใͰ#PEZͷ ׬શੑΛνΣοΫ 49(࢓༷Ͱ͸
    SFDPSE
    TJ[F͸
    ,#ҎԼʹ੍ݶ
20. 49(ϑΝΠϧͷத਎ C sxg1-b3 ϚδοΫ fallbackURL 49(ݕূ͕ࣦഊͨ͠৔߹ʹΞ Ϋηε͢Δ63- signature ॺ໊σʔλ signedHeaders )551Ϩεϙϯεϔομ
    $#03ܗࣜ payload body )551ϨεϙϯεͷϘσΟ
    .*$&ܗࣜ sig ॺ໊஋ integrity )551ϨεϙϯεϘσΟͷϋογϡΞϧΰϦ ζϜ validity-url ৽͍͠ॺ໊σʔλΛऔಘ63-
    ݱࡏະ࣮૷ cert-url ূ໌ॻσʔλͷ63-
    ॺ໊ର৅֎ cert-sh256 ূ໌ॻσʔλͷϋογϡ஋ ed25519key ॺ໊ݕূ͢Δެ։ݤ
    ݱࡏະ࣮૷ date ॺ໊ͨ࣌ؒ͠ expire ॺ໊ͷ༗ޮظݶ
    ࠷େ೔ؒ sxg1-b3 (8) fallbackUrl length (2) fallbackURL sigLength (3) headerLength (3) signature signedHeaders payload body
21. 49(Ͱॺ໊͍ͯ͠Δσʔλ Y Y YY
     )551
    &YDIBOHF
      Y  DFSUTIB  WBMJEJUZVSM
    MFO
     WBMJEJUZVSM EBUF  FYQJSFT  SFRVFTU6SM
    MFO  SFRVFTU6SM SFTQPOTF)FBEFST
    MFO  SFTQPOTF)FBEFST C͔ΒSFRVFTUϔομ͸আ֎ w 49(ূ໌ॻͷൿີ伴Λ࢖ͬͯ
    FDETBXJUI4)" TFDQS
    Ͱॺ໊
    w 49(ূ໌ॻͷެ։伴Λ࢖ͬͯॺ໊Λ
    7FSJGZ
    w ॺ໊ͷ7FSJGZ͕੒ޭͯ͠ϨεϙϯεϘσΟͷ.*$&νΣοΫ͕Ͱ͖ͨΒ49(͕WBMJE
22. 49(ͷத਎ $#03 .*$& ॺ໊
23. 49(ͷத਎
24. $FSU$IBJO $#03ͷத਎ $#03ܗࣜ ݱࡏͷ࣌ࠁ Ͱ༗ޮʁ 49(֦ு༗ $5 ϩά༗ʁ ೔Ҏ಺ɺݱࡏ༗ޮʁʁ SPPU$"·Ͱ ॺ໊ݕূ 6 '%$
    
    4DSPMM 6 %
    ⛓
    $IBJOT
    
25. 49(ېࢭ)551ϔομ $POOFDUJPO ,FFQ"MJWF 1SPYZ$POOFDUJPO 5SBJMFS 5SBOTGFS&ODPEJOH 6QHSBEF "VUIFOUJDBUJPO$POUSPM "VUIFOUJDBUJPO*OGP $MFBS4JUF%BUB 0QUJPOBM888"VUIFOUJDBUF 1SPYZ"VUIFOUJDBUF 1SPYZ"VUIFOUJDBUF*OGP 1VCMJD,FZ1JOT 4FD8FC4PDLFU"DDFQU 4FU$PPLJF 4FU$PPLJF 4FU1SPpMF 4USJDU5SBOTQPSU4FDVSJUZ 888"VUIFOUJDBUF )PQCZ)PQϨεϙϯεϔομ 4UBUFGVMϨεϙϯεϔομ 49(Խ͢Δ".1αʔό͔ΒͷϨεϙϯεʹ্هϔομ͕ೖ͍ͬͯͳ͍͔஫ҙ͢Δ BNQQLHͰ͸&SSPS0O4UBUFGVM)FBEFSTͷઃఆͰ੍ޚͰ͖·͢ɻ
26. BNQQBDLBHFS
    ʹ͍ͭͯ HJUIVCDPNBNQQSPKFDUBNQQBDLBHFS SFMFBTF
    CSBODI
    1SPEVDUJPO༻ϒϥϯν NBTUFS
    CSBODI
    ։ൃϒϥϯν
27. BNQQBDLBHFS
    ఏڙίϚϯυ w DNEBNQQLH
    
    
    BNQQLHຊମ
    w DNEBNQQLH@EM@TYH
    49(ͱূ໌ॻΛμ΢ϯϩʔυ
    w DNEBNQQLH@UFTU@DBDIF
    49(Λఏڙ͢Δ؆қΩϟογϡαʔό
    w DNEHBUFXBZ@TFSWFS
    
    H31$Ͱ49(Λੜ੒͢Δήʔτ΢ΣΠαʔό
    w DNEUSBOTGPSN
    ".1࠷దԽΛߦ͏ίϚϯυ
28. BNQQLHUPNM NBTUFS 1PSU -JTUFOϙʔτ EFGBVMU -PDBM0OMZ MPDBMIPTUͰ-JTUFO͢Δ͜ͱΛڧ੍
    EFGBVMU
    GBMTF $FSU'JMF 49(ূ໌ॻͷϑΝΠϧ αʔόূ໌ॻ தؒূ໌ॻ
    1&.ܗࣜ ,FZ'JMF 49(ূ໌ॻͷൿີ伴ϑΝΠϧ 1&.ܗࣜ 0$41$BDIF 0$41σʔλͷΩϟογϡϑΝΠϧͷύε 'PSXBSEFE3FRVFTU)FBEFS GFUDI͢Δࡍʹసૹ͢ΔϦΫΤετϔομ <<63-4FU>> <63-4FU4JHO> ॺ໊༻ͷઃఆ ඞਢ %PNBJO ॺ໊͢ΔυϝΠϯ 1BUI3& ॺ໊ΛڐՄ͢Δ1BUI EFGBVMU
     1BUI&YDMVEF3& ॺ໊ΛڐՄ͠ͳ͍1BUI 2VFSZ3& ॺ໊ΛڐՄ͢Δ2VFSZύϥϝʔλ
    EFGBVMU
     &SSPS0O4UBUFGVM)FBEFS TUBUFGVMϔομ͕͋ͬͨΒQSPYZͤ͞Δ͔࡟আ͢Δ͔ .BY-FOHUI 63-ͷ࠷େ௕ EFGBVMU
     <63-4FU'FUDI> ".1ίϯςϯπΛ'FUDI͢Δઃఆ Φϓγϣϯ 4DIFNF GFUDIΛڐՄ͢ΔTDIFNB
    EFGBVMU
    IUUQT 4BNF1BUI ॺ໊ͱಉ͡QBUIͰGFUDI͢Δ͜ͱΛڧ੍ͤ͞Δ %PNBJO3& GFUDIΛڐՄ͢ΔυϝΠϯͷύλʔϯ %PNBJO GFUDI͢ΔυϝΠϯ 1BUI3& GFUDIΛڐՄ͢Δ1"5)
    EFGBVMU  2VFSZ3& GFUDIΛڐՄ͢Δ2VFSZύϥϝʔλ
    EFGBVMU
    
29. BNQQLH
    DPOpH DPOpHϑΝΠϧͷࢦఆ EFWFMPQFNFOU w $BO4JHO)551&YDIBOHF֦ு͕ͳ͍ূ໌ॻͷར༻ΛڐՄ͢Δ
    w MPDBMIPTUѼͷ63-͚ͩڐՄ
    w ".1$BDIF5SBOTGPSN"DDFQUϔομ͸ඞཁͳ͍ JOWBMJEDFSU $BO4JHO)551&YDIBOHF֦ு͕ͳ͍ূ໌ॻͷར༻ΛڐՄ͢Δ ϩά͸ඪ४ग़ྗͷΈ ίϚϯυϥΠϯϑϥά
30. BNQQLH΁ͷϦΫΤετ QSJWEPDIUUQTFYBNQMFDPNBNQ QSJWEPD GFUDIIUUQ"''JOUFSOBMDPN'BNQTJHOIUUQT"''FYBNQMFDPN'BNQ QSJWEPD TJHOIUUQT"''FYBNQMFDPN'BNQ IUUQTFYBNQMFDPNBNQ BNQQLH BNQQLH BNQQLH IUUQTFYBNQMFDPNBNQ IUUQJOUFSOBMDPNBNQ ॺ໊υϝΠϯͱ'FUDIઌ͕ಉҰ ॺ໊υϝΠϯͱ'FUDIઌ͕ҟͳΔ BNQQLHલஈͰ5-4ऴ୺Λͯ͠ɺ֎෦͔Β௚઀QSJWEPDʹ઀ଓͤ͞ͳ͍͜ͱ 5 - 4
    ऴ
    ୺
    ɾ
    1 B
    U
    I
    ม
    ߋ IUUQTFYBNQMFDPNBNQ IUUQTFYBNQMFDPNBNQQLH 49(ূ໌ॻཁٻϦΫΤετ BNQQLH 49(ཁٻϦΫΤετ
31. 5SBOTGPSNFS w ͜Ε·Ͱ".1
    $BDIFͰ(PPHMF͕".1࠷దԽॲཧΛߦͬͯ ͖ͨ ".1ͷSVO
    UJNF
    WBMVFͷೖΕࠐΈ΍JOMJOFԽ
    FUD
    w 49(Ͱ͸ॺ໊ͨ͠ޙͰ͸࠷దԽ͕ෆՄೳɻ49(Խͷલʹ΍ Δඞཁ͕͋Δɻ
    w 5SBOTGPSNFSͷࢦఆΛ".1$BDIF5SBOTGPSNFSϔομͰ ωΰγΤʔγϣϯ͢Δɻόʔδϣϯ͸िؒͰ্͕Δ༧ఆ
    w ".1$BDIF5SBOTGPSN
    HPPHMFW 
    
    w ".1$BDIF5SBOTGPSN
    BOZ #PU IUUQTHJUIVCDPNBNQQSPKFDUBNQIUNMCMPCNBTUFSTQFDBNQDBDIFUSBOTGPSNNE 7BSZ
    ".1$BDIF5SBOTGPSN ".1$BDIF5SBOTGPSN
    HPPHMFW IUUQTHJUIVCDPNBNQQSPKFDUBNQIUNMCMPCNBTUFSTQFDBNQDBDIFNPEJpDBUJPOTNE
32. 49(ূ໌ॻ w 49(ΛαʔϏεͰఏڙ͢ΔͨΊʹඞཁෆՄܽ
    w ௨ৗͷ&$$ূ໌ॻ TFDQ ʹ49(֦ு͕෇͍ͨ΋ͷ
    w ௨ৗͷ)5514αʔό༻్ͷূ໌ॻʹ࢖͏͜ͱ͸ېࢭ
    w ݱࡏ%JHJDFSUࣾͷΈൃߦ
    w ೥݄೔ΑΓ
    w ূ໌ॻͷ༗ޮظݶΛ೔ʹ੍ݶ
    w %/4$""Ϩίʔυొ࿥ΛඞਢԽ 49(֦ு
33. $""ಋೖͷࡍͷ஫ҙࣄ߲ w $/".&෇͚͍ͯΔϨίʔυʹ͸ଞϨίʔυ෇͚Εͳ͍
    w $/".&ઌͷ$""Λݟʹߦ͕͘$/".&ͷ਌υϝΠϯΛḷΒͳ͍ 3'$
    &SSBUB
    w $/".&ઌͷ$""͕ͳ͚Ε͹਌υϝΠϯͷ$""Λࢀর͠ʹߦ͘ɻ FYBNQMFDPN
    $""
    
    JTTVF
    EJHJDFSUDPNDBOTJHOIUUQFYDIBOHFTZFT
34. )5514ͱ49(ͷηΩϡϦςΟͷҧ͍
    ൿີ伴͕࿙Ӯͨ͠৔߹ ΦϑϥΠϯ؀ڥ POQBUI %/4Λม͑Εͳ͔ͬͨ Β.*5.͔͠ͳ͍ ωοτϫʔΫ؀ڥ ͍Βͳ͍ ෆਖ਼49( )5514 49( վ͟Μ
    ౪ௌ
    ͳΓ͢·͠ վ͟Μ
    ͳΓ͢·͠ P⒎QBUI $""Ͱূ໌ॻͷෆਖ਼ൃߦɾޡൃߦΛ๷͗
    ୹ظؒ ೔ ͷ49(ূ໌ॻͰةຆԽ࣌ͷϦεΫΛ௿ݮ ࿙Ӯ
35. 49(".1
    γεςϜࣄྫ
36. ".149(γεςϜ֓ཁ ݕࡧαʔϏε
    ".1Ωϟογϡ 49( ݕࡧ
    1SFGFUDI 0$4αʔό ".1
    $%/ ".1αʔό BNQQLH 49(
    3PVUFS )5514
    1SPYZ
37. )5514
    1SPYZ w Πϯλʔωοτ͔Βͷ)5514઀ଓͷऴ୺
    w Ωϟογϡػೳ
    w ಺෦αʔϏε΁ͷৼΓ෼͚ BNQ
    ".1αʔϏε
    BNQQLH
    49(ূ໌ॻऔಘ $SBXMFS
    CPU BNQ
    BNQQLH ".1޲͚ϦΫΤετ ".1Ҏ֎ϦΫΤετ 49(
    3PVUFS ".1Ҏ֎ͷαʔϏε
38. 49(
    3PVUFS w $SBXMFSʹ49(ରԠͰ͋Δ͜ͱΛ஌ΒͤΔ 7BSZ
    ".1 $BDIF5SBOTGPSN
    w 49(औಘϦΫΤετ ".1$BDIF5SBOTGPSN
    HPPHMFW ͕དྷͨΒBNQQLʹ;Δɻ
    w ϦΫΤετΛ
    BNQQLH༻ͷRVFSZ
    QBSBNFUFSʹมߋ )5514
    1SPYZ 49(
    3PVUFS BNQQLH ".1αʔό
39. BNQQLH w ".1ίϯςϯπ͔Β49(Λੜ੒͠ఏڙ͢Δ ࠷େ.#
    w ΫϥΠΞϯτͷ࣌ؒͣΕΛߟྀͯ͠ॺ໊ظؒ͸̍೔લ͔Β̒೔ޙ
    w 49(ੜ੒࣌ʹ".1࠷దԽ 5SBOTGPSN Λߦ͏
    w 49(ূ໌ॻͱ0$41Λ·ͱΊͨσʔλ DFSU DCPS Λੜ੒͠ɺఏڙ ͢Δ
    w ύϒϦοΫΩϟογϡʹద͞ͳ͍ϔομͷνΣοΫ΍࡟আΛߦ͏
    w TUBUVT$PEF
    Ҏ֎͸جຊεϧʔ QSPYZ IUUQTHJUIVCDPNBNQQSPKFDUBNQQBDLBHFS BNQQLH ".1
    $%/ 0$41αʔό 49(
    3PVUFS ".1αʔό ".1$BDIF5SBOTGPSN ෇͖ϦΫΤετ 49(ূ໌ॻऔಘϦΫΤετ $44 357 ࣦޮ৘ใ )551ϦΫΤετ )551Ϩεϙϯε
    ".1ίϯςϯπ
40. 49(ಋೖৼΓฦΓ
41. 49(".1γεςϜಋೖɺৼΓฦΓ  طଘΠϯϑϥ΁ͷӨڹΛ࠷খݶʹͯ͠ɺಋೖ͕Մೳͩͬ ͨɻ
     Ϣʔβ΁ͷ௚઀ϦΫΤετͷӨڹΛ͋·Γؾʹͤͣʹ͢ Μͩ ओཁϦΫΤετ͕#PUͷΫϩʔϦϯάͰ͋ͬͨͨΊ
     ࣄલʹ4UBHJOH؀ڥͰͷςετ͕ݶఆతͩͬͨɻ#PUΫ ϩʔϧ΍".1ΩϟογϡԽͷࢼݧ͸ϦϦʔεޙʹ͔͠Ͱ ͖ͳ͍ɻ
42. 49(".1γεςϜಋೖʹؔ ͢Δ஫ҙࣄ߲ w ΩϟογϡՄೳͳίϯςϯπ͔ʁ
    49(ېࢭϔομ
    w ݸਓ৘ใ΍ηΩϡϦςΟ৘ใ͕ೖ͍ͬͯͳ͍͔ʁ
    w 4BNF
    0SJHJOʹͳͬͨΒΤϥʔʹͳΒͳ͍͔ʁ
    FH
    ".1 JGSBNF
    w 4PGU OPU
    GPVOEΛͰฦ͢ ͱ͔͍ͯ͠ͳ͍͔ʁ
43. ·ͱΊ PSJHJOΛೖΕସ͑Δ4JHOFE
    )551
    &YDIBOHFT͸ɺ͜Ε·Ͱ ͷ8FCϓϩτίϧͷ֓೦Λࠜຊతʹม͑Δٕज़Ͱ͢ɻ
    ͜ͷٕज़ʹΑͬͯ
    1VCMJTIFS%JTUSJCVUPS
    ͦΕͧΕͷؔ܎͕ কདྷେ͖͘มΘΔՄೳੑ͕͋Γ·͢ɻ
    ࠓޙɺ49(͕ఱ࢖ͱͳΔͷ͔ɺͦΕͱ΋ѱຐͱͳΔͷ͔ɺ օ͞ΜͰͦͷӨڹΛΑ͘ߟ্͑ͨͰ49(Λ൑அͯ͠Լ͍͞ɻ