運用の観点から見たTLSプロトコルの動き

ӡ༻ͷ؍఺͔Βݟͨ 5-4ϓϩτίϧͷಈ͖ େ௡ൟथ Ϡϑʔגࣜձࣾ ̌̕෼Ͱ෼͔Δαʔόূ໌ॻͷ࠷৽ಈ޲ʙ͍·5-4ͱτϥετ͕ॵ͍ΜͰ͢ʙ ೥݄̑೔ *OUFSOFU8FFLγϣʔέʔεJO޿ౡ

ࣗݾ঺հ w Ϡϑʔגࣜձࣾ$%/νʔϜॴଐɺ*&5'ඪ४ԽࢀՃɺࠇ ଳʢωοτϫʔΫɾηΩϡϦςΟʣ w /PEFKTίϛολʔUMT DSZQUPपΓͷ࣮૷ɺηΩϡϦςΟ νʔϜॴଐ Ϡϑʔגࣜձࣾ044σϕϩούʔೝఆऀ

4:/ 4:/"$, "$, 5$1ϋϯυγΣΠΫ (&5)551 )5510, (&5)551 )5510, )551௨৴ )5514௨৴
4:/ 4:/"$, "$, 5$1ϋϯυγΣΠΫ )551ϦΫΤετɾϨεϙϯε )551ϦΫΤετɾϨεϙϯε 5-4ϋϯυγΣΠΫ ҉߸௨৴ ฏจ௨৴ ΫϥΠΞϯτ αʔό ΫϥΠΞϯτ )551ͱ)5514௨৴ͷҧ͍

ࠓ೥ळɺ)551௨৴ʹର͢ΔܯࠂڧԽ ೥݄ϦϦʔε༧ఆͷ$ISPNF͔Β ೥݄ϦϦʔε༧ఆͷ$ISPNF͔Β

ຊ೔ͷ಺༰ ࠓޙͷ)5514αʔϏεӡ༻Ͱ஌͓ͬͯ͘΂͖5-4ϓϩτίϧͷݱঢ় ͷ՝୊ͱ࠷৽ಈ޲ʹ͍ͭͯղઆ͠·͢ɻ͜Μͳٙ໰ʹ͓౴͑͠·͢ɻ w ͳͥશ෦)5514ʹ͠ͳ͍ͱ͍͚ͳ͍ͷʁ w ϒϥ΢βʔɺ)5514αʔόɺূ໌ॻ ೝূہ ɺͲ͏͍͏ؔ܎ʁ w
͏ͪͷ)5514αʔόɺ͜ͷ··Ͱେৎ෉ʁ͜ͷޙͲ͏ͳΔͷʁ

Ϣʔβʔʢ͓٬༷ʣ 04ɾϒϥ΢βϕϯμʔ 5-4ΫϥΠΞϯτ։ൃऀ ೝূہ 8FCαʔϏεఏڙऀ )5514FWFSZXIFSF࣌୅ͷεςʔΫϗϧμʔ )5514 SPPUূ໌ॻ ιϑτ΢ΣΞఏڙ ࣦޮ֬ೝ
ূ໌ॻఏڙ

Ϣʔβʔʢ͓٬༷ʣ 04ɾϒϥ΢βϕϯμʔ 5-4ΫϥΠΞϯτ։ൃऀ ೝূہ 8FCαʔϏεఏڙऀ ̎ͭͷϙδγϣϯΛ࢖͍෼͚ͯ͠࿩Λ͠·͢ )5514 SPPUূ໌ॻ ιϑτ΢ΣΞఏڙ ࣦޮ֬ೝ
ূ໌ॻఏڙ HTTPS everywhere TLS 1.0ഇࢭ ҉߸ํࣜͷSPOFղফ TLS1.3ɺQUICɺ଱ྔࢠ҉߸ ৴པੑͷཁɺτϥετΞ ϯΧʔΛΊ͙Δಈ͖ /PEFίϛολʔͱͯ͠ͷཱ৔ ϠϑʔαʔϏεఏڙɺ *&5'ࢀՃऀͱͯ͠ͷཱ৔

)5514&WFSZXIFSF

೥ͷ8FCϓϩτίϧελοΫਤ 44-5-4 5$1 )551 ηΩϡϦςΟ௨৴ͷ)5514͸ 44- 5-4Λར༻͍ͯͨ͠ IUUQT IUUQ

೥ͷ8FCϓϩτίϧελοΫਤ )551 ηϚϯςΟΫε )551 5$1 5-4 5-4 )551 5-4ͷར༻͕
ͷόʔδϣϯʹ޿͕Δ৽͘͠ 5-4্Ͱ)551ͷར༻͕Ͱ͖ΔΑ͏ʹͳͬͨɻ IUUQT IUUQ

কདྷͷ8FCϓϩτίϧελοΫਤ )551ηϚϯςΟΫε 5$1 5-4 )551 26*$ 6%1 5-4 )551 5-4
͕ഇࢭ͞Ε 5-4͕ར༻Ͱ͖Δ6%1্Ͱ 5$1 5-4 )551ͷҰ෦ػೳΛ࣮ݱ͢Δ26*$͕ొ৔͢Δ IUUQT IUUQ

)5514ͷಋೖঢ়گ ಡΈࠐΈϖʔδׂ߹ IUUQTMFUTFODSZQUPSHTUBUTQFSDFOUQBHFMPBET IUUQTUSBOTQBSFODZSFQPSUHPPHMFDPNIUUQTPWFSWJFX 'JSFGPY $ISPNF +BQBO ೔ຊ͸
Χࠃத࠷௿

ͳͥશ෦)5514ʹ͠ͳ͍ͱ ͍͚ͳ͍ͷʁ w /4" $()2ʹΑΔࠃՈϨϕϧͷ޿ൣғͳ౪ௌߦҝ͕໌Β͔ʹ w ௨৴ΩϟϦΞͱڠྗ͠ɺ%$಺΍ΠϯλʔωοτόοΫϘʔϯ ʹ౪ௌɾվ͟Μͷ࢓ֻ͚Λ഑ஔ w ฏจ௨৴Λ.J5.Ͱվ͟Μ͠ະ஌ͷϚϧ΢ΣΞΛײછͤ͞Δ
w ҉߸ͷඪ४Խ࢓༷ʹόοΫυΞΛ࢓ֻ͚͍ͯΔͱͷ࿩΋ CC BY 3.0 https://www.youtube.com/user/TheWikiLeaksChannel ೥݄ɿΤυϫʔυɾεϊʔσϯࣄ݅

/4"ʹΑΔαΠόʔ߈ܸͷҰྫ 26"/56. '09"$*% IUUQXXXFYBNQMFDPN XXXFYBNQMFDPN Ϛϧ΢ΣΞΛૹΓࠐΉ ్தܦ࿏Ͱվ͟ΜίϯςϯπΛૹ৴ '09"$*%ʹ༠ಋ վ͟Μίϯςϯπ IUUQTXXXTDIOFJFSDPNCMPHBSDIJWFTIPX@UIF@OTB@BUUIUNM

*"# ʹΑΔΠϯλʔωοτͷ ৴པੑʹؔ͢Δએݴ w ৽͘͠ϓϩτίϧΛઃܭ͢Δࡍʹ͸ɺ҉߸ԽػೳΛඞ ਢͱ͢΂͖ɻ w ωοτϫʔΫӡ༻ऀ΍αʔϏεఏڙऀʹ҉߸Խ௨৴ͷ ಋೖΛਪਐ͢ΔΑ͏ڧ͘ٻΊΔɻ
w ίϯςϯπϑΟϧλʔ΍*%4౳ฏจ௨৴͕ඞཁͳػೳ ʹ͍ͭͯ͸কདྷతʹ୅ସٕज़ͷ։ൃʹऔΓ૊Ήɻ *OUFSOFU"SDIJUFDUVSF#PBSE IUUQTXXXJBCPSHJBCTUBUFNFOUPOJOUFSOFUDPOpEFOUJBMJUZ

ͳͥશ෦)5514ʹ͠ͳ͍ͱ ͍͚ͳ͍ͷʁ w Πϯλʔωοτͷ݈શੑΛ֬อ͢ΔͨΊɻ͕͜͜༳Β͙ ͱେखͷ8FCαʔϏεͷ৴པੑ͕ͳ͘ͳΔɻ w Ұ෦Ͱ΋ฏจ௨৴͕࢒͍ͬͯΔͱͦ͜Λಥ͔ΕΔՄೳੑ͕ ͋Δɻ w ࣗ෼͸ؔ܎ͳ͍ͱࢥ͍ͬͯͯ΋஌Βͳ͍͏ͪʹ࢓ࠐ·Εͯ
ར༻͞ΕΔڪΕ΋ɻ w ௕ظతͳࢹ఺Ͱ͸IUUQ͸ϑΣʔζΞ΢τͷํ޲Ͱ͢ɻ

τϥετΞϯΧʔΛΊ͙Δ ೤͖ઓ͍

5-4ηΩϡϦςΟͷ౔୆ 5-4ͷ ηΩϡϦςΟ ཚ਺ੜ੒ 1,* ൿີ伴ͷ ؅ཧ ҉߸ٕज़ Τϯ τϩϐʔෆ଍
ෆਖ਼ ൃߦ ࿙Ӯ ΞϧΰϦζϜɾ ڧ౓ͷةຆԽ 5-4͸ɺ͜ͷ̐ͭͷ֎෦ཁૉͷ্ͰΠϯλʔ ωοτͰ҆શͳ௨৴Λఏڙ͢Δ࢓૊ΈͰ͋Δɻ ٯʹݴ͑͹ɺͲΕ΄Ͳ׬ᘳͳ5-4ϓϩτίϧΛ࡞ͬͯ΋ ͜ͷ̐ͭͷ֎෦ཁૉ͕ഁΒΕͨΒ҆શΛ֬อͰ͖ͳ͍ɻ

৴པͷཁɺτϥετΞϯΧʔ αʔόূ໌ॻ தؒূ໌ॻ ϧʔτূ໌ॻ ΫϥΠΞϯτ಺ ΫϥΠΞϯτެ։伴ૹ৴ αʔόɾதؒূ໌ॻૹ৴ 5-4 ϋϯυγΣΠΫ ʹΑΔαʔόೝূ
੺৭͸ αʔό͔Βૹ৴ τϥετΞϯΧʔ ॺ໊ ॺ໊ αʔόެ։伴ૹ৴ ॺ໊

5-4ΫϥΠΞϯτͱ04Ͱม ΘΔSPPU$"ͷࢀরઌ 8JOEPXT .BD04 -JOVY "OESPJE *&&EHF 04ͷSPPU$" /" /"
/" 4BGBSJ /" 04ͷSPPU$" /" /" $ISPNF 04ͷSPPU$" 04ͷSPPU$" .P[JMMBͷ SPPU$" .P[JMMBͷ SPPU$" 'JSFGPY .P[JMMBͷ SPPU$" .P[JMMBͷ SPPU$" .P[JMMBͷ SPPU$" .P[JMMBͷ SPPU$" /PEFKT .P[JMMBͷ SPPU$" .P[JMMBͷ SPPU$" .P[JMMBͷ SPPU$" /" EJTUSJCVUJPOఏڙͷDBCVOEMFQLHΛࢀর͢Δ৔߹΋͋Γ มߋɺमਖ਼͞Ε͍ͯΔՄೳੑ͋Γʣ .P[JMMBͷSPPU$"ϦετIUUQTIHNP[JMMBPSHNP[JMMBDFOUSBMSBXpMFUJQTFDVSJUZOTTMJCDLGXCVJMUJOTDFSUEBUBUYU

ϒϥ΢βʹΑͬͯҟͳΔྫ .BD04্ͷ$ISPNF .BD04্ͷ'JSFGPY

ϒϥ΢βʔWTೝূہ αʔόূ໌ॻ தؒূ໌ॻ ϧʔτূ໌ॻ ΫϥΠΞϯτ಺ ॺ໊ ॺ໊ ಛఆͷϧʔτূ໌ॻͰॺ໊ ͞Εͨূ໌ॻΛΤϥʔʹ ൃߦ೔࣌ͳͲͷ৚݅΋෇༩Մ
04ͷSPPUূ໌ॻͷ؅ཧͱ͸ผʹΫϥΠΞϯτಠࣗͷ൑அͰϑΟϧλʔͰ͖Δɻ

)5514αʔόͷӡ༻ ٕज़ෛ࠴ ࠓޙ5-4ΛͲ͏ͨ͠Β͍͍ͷ͔ʁ

·ͣ͸ ࠓͷߏ੒Λ͔ͬ͠ΓνΣοΫ͢Δɻ ࠷ۙͷ044͸EFGBVMU͕҆શଆʹͳΔΑ͏ʹ͍ͯ͠·͢ɻ ࠷৽ͷ-54όʔδϣϯʹਵ࣌Ξοϓσʔτ͠·͠ΐ͏ɻ

ͪΌΜͱͨ͠҉߸ํࣜͷઃఆ 伴ަ׵ 34" 'PSXBSE4FDSFDZ %)& &$%)& /*451 &$%)& 9 σδλϧॺ໊
34" %44 %4" &$%4" &E%4" ରশ҉߸ %&43$ %&4 "&4 $IB$IB ͦͷଞ ҉߸Ϟʔυ $#$ "&"% $$. ($. 1PMZ ϝοηʔδೝূ 13' .% 4)" 4)" 4)" ஫ҙ͸ɺ҉߸ֶత஫ҙͱকདྷతʹීٴ͕ݟࠐ·Εͳ͍஫ҙ΋ؚ·Ε·͢ ੺ةݥ ԫ஫ҙ ྘҆શ ੨͜Ε͔Β ஫ҙ$3:153&$*1"ͷʮ44-5-4҉߸ઃఆΨΠυϥΠϯୈ൛ʯͱධՁ͕ҟͳΓ·͢ɻ

ٕज़ෛ࠴ͷฦࡁʹඋ͑Δ ग़యIUUQTXXXTMJEFTIBSFOFUUFDICMPHZBIPPXFCIUNMKIUNMKC Φϫίϯϓϩτίϧ 5-4

5-4͸ɺͳͥΦϫίϯʁ w ೥ʹ࢓༷ࡦఆɻ΋ͱ΋ͱ͸44-ͷඪ४ԽΛ໨ࢦͨ͠΋ͷ w "&4બఆ ೥ લͩͬͨͷͰ౰ॳ͸3$ͱ%&4ͷΈαϙʔτɻ3$ ͸طʹةຆԽɺ%&4͸48&&5߈ܸΛड͚Δ͜ͱ͕஌ΒΕ͍ͯΔ w ϒϩοΫ҉߸Λ࢖͏ࡍͷॳظϕΫτϧͰ#&"45߈ܸΛड͚Δ͜ͱ͕஌
ΒΕ͍ͯΔ ΫϥΠΞϯτଆͰཁରࡦ w $#$Ϟʔυͷ࣮૷͸աڈ਺ଟ͘ͷ੬ऑੑΛੜΈग़ͨ͠ͷͰ"&"% ೝূ ෇҉߸ ΁ͷҠߦ͕ओྲྀʹ w ."$13' 伴ੜ੒ Ͱ͸.%ͱ4)"Λ૊Έ߹Θͤͨ΋ͷɻ͜Ε͕͋ ΔݶΓةຆԽ͞Εͨ.%ͷίʔυΛͳ͘͢͜ͱ͸Ͱ͖ͳ͍ 5-4ͱڞ௨߲໨

5-4ϓϩτίϧͷൺֱ ࡦఆ ϒϩοΫ҉߸ͷ ॳظϕΫτϧ $#$ Ϟʔυ "&"% ."$13' 5-4 ೥
ͳ͠ ༗ ͳ͠ 4)" .% 5-4 ೥ ༗ ༗ ͳ͠ 4)" .% 5-4 ೥ ༗ ༗ ༗ 4)"Ҏ্ 5-4 ೥ ഇࢭ ഇࢭ ඞਢ ),%' 4)"Ҏ্ 1$*%44 ېࢭʙ ਪ঑ ஫ҙ$3:153&$*1"ͷʮ44-5-4҉߸ઃఆΨΠυϥΠϯୈ൛ʯͱධՁ͕ҟͳΓ·͢ɻ

ϓϩτίϧͷഇࢭ͸೉͍͠ w ΋ͱ΋ͱ1$*%44͸೥݄೔ʹ5-4Λഇࢭ༧ఆ ͩͬͨɻͦΕΛ̎೥Ԇظɻ w େख 4BMFT'PSDF *#. 0SBDMF ͷαʔϏε͸طʹରԠࡁɻ͕ͩ
Ҡߦ࡞ۀ͸Ͳ͜΋Ұ౓͸ࣦഊͯ͠ϩʔϧόοΫ͍ͯ͠Δɻ w "OESPJEYͷඪ४ϒϥ΢βʔَ͕໳ɻ"1*ར༻ͳͲ͸ΫϥΠΞ ϯτଆͷվमͱ͔ඞཁɻ w ࣄલʹϢʔβ΁ͷೝ஌͕೉͍͠ɻഇࢭޙ͸Τϥʔը໘ʹɻ w 44-͸100%-&੬ऑੑͷެදͰΨϥέʔରԠΛؚΊഇࢭͰ͖ ͨɻ5-4͸ಉ͡Α͏ʹͳΔͷ͔ɺͳΒͳ͍ͷ͔ɻ

Ͱ͸Ͳ͏͢Ε͹ʁ w ·ͣ͸Ϟχλʔ w 5-4όʔδϣϯΛΞΫηεϩάʹग़͢ w ׂ߹΍6"ɺTSDJQ౳ͷ܏޲Λ೺Ѳ w Πϯγσϯτൃੜ࣌ʹӨڹ౓Λ೺ѲͰ͖ΔΑ͏४උ͕େ ࣄɻ

কདྷʹඋ͑Δ 5-4

5-4͕ٻΊΒΕΔഎܠ ৗ࣌5-4࣌୅Λܴ͑Δʹ͋ͨͬͯɺ͔ͬ͠Γͨ͠ϓ ϩτίϧ͕ඞཁ 5-4ͷݶք w ༷ʑͳٕज़ෛ࠴ͷ஝ੵ ௕ظʹ࢖͑ΔΑΓ҆શͰߴੑೳͳ5-4ϓϩτίϧΛ࡞Δ

5-4ͷݶք w ݱࡏͷ5-4Ͱఆٛ͞Ε͍ͯΔػೳͷ Ұ෦͸ɺطʹར༻͢ΔͱةݥͰ͋Δɻ w աڈ༷ʑͳ5-4ͷ߈ܸख๏΍੬ऑੑ͕ެ ։͞Εɺͦͷ౎౓ରࡦ͕औΒΕ͖ͯͨɻ w ͔͠͠Ұ࣌తͳରԠͰࠜຊతɾൈຊతͳ ରࡦʹͳ͍ͬͯͳ͍΋ͷ΋ଟ͍ɻ
ຊདྷ͜ͷΑ͏ͳΨΠυϥΠ ϯ͕ͳͯ͘ࡁΉͷ͕๬·͍͠

5-4ͷಛ௃ ༷ʑͳػೳɺ߲໨ͷݟ௚͠ɾഇࢭ ࣌୅ʹ߹Θͳ͘ͳͬͨ΋ͷɺΑΓޮ཰తʹมߋमਖ਼Ͱ͖Δ΋ͷΛ5-4 ͔Βػೳɾ߲໨Λ਺ଟ͘ഇࢭ ΑΓηΩϡΞʹ ฏจ௨৴͕ඞཁͳ෦෼Λۃྗগͳͯ͘͠৘ใΛൿಗ ͜Ε·Ͱ߈ܸର৅ͱͳͬͨػೳΛۃྗഉআ͠কདྷతͳ߈ܸʹඋ͑Δ
ੑೳ޲্ ॳظ઀ଓͷ୹ॖʹΑΔੑೳ޲্ த਎తʹ͸5-4Ϩϕϧͷେมߋ

೥ɺ5-4࢓༷Խ׬ྃ 3'$ൃߦ଴ͪ օ͞Μɺ஌Βͳ͍͏ͪʹ5-4Λ࢖͍ͬͯ·͢ɻ

5-4ͱ5-4ͷҧ͍ 5$1 ϋϯυγΣΠΫ 5-4 ΫϥΠΞϯτ αʔό ΫϥΠΞϯτ αʔό )551 ϦΫΤετ
Ϩεϙϯε 5-4 )5510, $MJFOU)FMMP 4FSWFS)FMMP $FSUJpDBUF $FSUJpDBUF7FSJGZ 'JOJTIFE 'JOJTIFE (&5)551 5-4 ϋϯυγΣΠΫ 4:/ 4:/"$, "$, )5510, (&5)551 $MJFOU)FMMP $IBOHF$JQIFS4QFD 'JOJTIFE 4FSWFS)FMMP $FSUJpDBUF 4FSWFS,FZ&YDIBOHF 4FSWFS)FMMP%POF $MJFOU,FZ&YDIBOHF $IBOHF$JQIFS4QFD 'JOJTIFE 355 355 4:/ 4:/"$, "$, ૣ͍ϋϯυγΣΠΫ

5-4ͷϋϯυγΣΠΫ355 ClientHello+νέοτ ApplicationData end_of_early_data Finished ServerHello EncryptedExtension ServerConfiguration Certificate CertificateVerify
Finished ApplicationData 355 355 ҉߸Խ 355 1SF4IBSFE ,FZ 1SF4IBSFE ,FZ ࠷ॳͷϋϯυγΣΠΫ νέοτ ࠶઀ଓ

$MJFOU)FMMP 355 ྫɿ1045ೖֹۚۚʣ 5-4αʔόΫϥελʔ ೖۚ ೖۚ ೖۚ ೖۚ 5-4355ͷڴҖ SFQMBZ߈ܸͷҰྫ
̌355Λར༻͢Δʹ͸஫ҙ͕ඞཁ

ΞϓϦ։ൃऀ΍αʔό؅ཧऀ͕ԿΛؾΛ ͚ͭΕ͹͍͍ͷ͔ʁ w ӡ༻తͳ՝୊ w 5-4͕༗ޮʹͳΔ͜ͱͰϛυϧϘοΫεɺ'8ɺ*%4*14ͳ Ͳதؒ௨৴૷ஔͷো֐΍ػೳఀࢭͳͲͷӨڹ͸ͳ͍͔ʁ w 5-4ͰഇࢭʹͳΔػೳ ಛʹ34"伴ަ׵
Λલఏͱͨ͠γε ςϜͷػೳΛ࢖͍ͬͯͳ͍͔ʁ w ٕज़తͳ՝୊ w 355Λຊ౰ʹ҆શʹར༻͢Δ͜ͱ͕Ͱ͖Δͷ͔ʁ w 355Λ࢖Θͳ͔ͬͨ৔߹ʹ໰୊͸ൃੜ͠ͳ͍ͷ͔ʁ

5-4ҠߦͷλΠϛϯά͸ʁ w 5-4ͷ࢓༷ԽʹΑͬͯ5-4͕ഇࢭ͞ΕΔ͜ͱ͸ͳ͍ɻ5-4 Λܧଓͯ͠࢖͍ଓ͚Δͷ΋Ұͭͷબ୒ࢶɻ5-4͸λΠϛϯά Λݟͯഇࢭ͞ΕΔ͔΋͠Εͳ͍ɻ w 0QFO44- ۙ೔ϦϦʔε༧ఆ Ͱ͸5-4͕EFGBVMUͰ༗ޮ w
ݱࡏͷ-540QFO44-͸ɺ೥݄຤Ͱ&P- w ࠓ೥຤͔Βདྷ೥ʹ͔͚ͯόʔδϣϯΞοϓ͸ඞਢɻࣗવʹ5-4ʹ ͳͬͯ͠·͏͜ͱ΋ɻ5-4͚ͩͷ҉߸ઃఆͩͱΤϥʔʹͳΔՄೳ ੑ΋͋Γ·͢ɻ w /*45͸ถࠃ੓෎ܥͷ)5514αʔό͸·Ͱ 355Λ࢖Θͳ ͍ 5-4ରԠΛٻΊΔ༧ఆɻ

運用の観点から見たTLSプロトコルの動き

運用の観点から見たTLSプロトコルの動き

More Decks by Shigeki Ohtsu

Other Decks in Technology

Featured

Transcript