SSLの必要性，Let's Encryptのちょっとした使い方について概観する．
͍ͬͯΔਓίʔυॻ͍͍ͯͯͩ͘͞Tech.Yuichi YoshidaResearcher, DENSO IT Laboratory, Inc.#yidev@sonson_twit© 2014 DENSO IT Laboratory, Inc., All rights reserved. Redistribution or public display not permitted without written permission from DENSO IT Laboratory, Inc.Let’s Encrypt~SSL~Autolayout
View Slide
ࣗݾհ• sonson• twitter: sonson_twit• github: sonsongithub• portfolio• reddift(SwiftͰॻ͍ͨreddit.comͷAPIϥούʔ)• ࣄ• ը૾ೝࣝ/ݕࡧ/ͦΕΛͬͨΞϓϦ• ػցֶशͷ͓ษڧͱ͔ॾʑͱ͔
ࠓͷ༰• SSLͬͯඞཁͰ͔͢ʙLet’s Encrypt• AutolayoutΛ͍ͬͯΔ͕ɼԶ͏ݶք͔͠Εͳ͍
SSLͬͯඞཁͰ͔͢ʁLet’s EncryptͰ͍͍ͷ͔ɼѱ͍ͷ͔
໔͜ͷൃද༰ɼ٢ా༔ҰͷݸਓతͳݟղͰ͋Γɼॴଐ͢ΔஂମͷެࣜతͳݟղͰ͋Γ·ͤΜɽ·ͨຊൃද༰Λฉ͖ɼͦͷཧղʹج͍ͮͯͦͷຊਓ͕ͱͬͨԿͳΔߦಈʹΑΔଛʹର͠ɼΛෛ͍·ͤΜɽҎ্ͷ͜ͱΛཧղͰ͖ͳ͍ਓɼ͋Δ͍ड͚ೖΕΒΕͳ͍ਓຊൃදΛฉ͘͜ͱ͝ԕྀ͍ͩ͘͞ɽ
എܠ• iOS9Ҏ߱ɼATSಋೖ͞ΕΔ• σϑΥϧτͰͯ͢https௨৴ʹஔ͖͑ΒΕΔ• iOSͰSSLجຊཁ݅ʹͳΓͭͭ͋Δ• ࣗͰӡ༻͍ͯ͠ΔαʔόͷSSLରԠ• sonson.jpɼgithub hostingҎ֎ͯ͢SSL• 2tchͷόοΫΤϯυ৽͍͠όʔδϣϯSSL• ͦΜͱ͖ʹ৭ʑษڧͨ͠• ϝΠϯͷڵຯRSA҉߸ͷֶͩͬͨΜ͕ͩ
എܠ• ͖͔͚ͬ• LINE Bot API• LINE Bot API• SSL௨৴ඞਢ• Let’s Encryptͩͱ͑ͳ͍• AWS͔Β͑Δ• SSLͷূ໌ॻ• Կͷҧ͍͕͋Δͷʁ• ҰମɼԿͷͨΊʹඞཁͳͷʁ
SSLͷඞཁੑ• Wi-FiͷηΩϡϦςΟ• httpsͰͳ͍ͱةݥ• DNSͷηΩϡϦςΟ• ѱҙͷ͋ΔDNS• ηΩϡΞͳDNS͕ͳ͔ͳ͔Ͱͯ͜ͳ͍• httpͰDNS໊͚ͩͰ૬खΛ֬ೝ͢Δͷةݥ• DNSΫϥοΫʹΑΔͳΓ͢·͠
ѱҙ͋ΔDNSͷڴҖΫϥΠΞϯτ %/4ۜߦ*1χηۜߦ*1bank.co.jp1.1.1.1bank.co.jp
ѱҙ͋ΔDNSͷڴҖΫϥΠΞϯτ͏ͦͬ͜%/4ۜߦ*1χηۜߦ*1bank.co.jp2.2.2.2bank.co.jp%/4ͷਖ਼ੑΛνΣοΫ͢Δज़͕ͳ͍
҉߸௨৴ͷ3ཁ݅• ൿಗ• ୭ʹ౪ΈݟΒΕͳ͍• શੑ• ୭ʹվ᜵͞Εͳ͍• ೝূ• ୭ʹͳΓ͢·͞Εͳ͍
ࠓͷٕज़ͷݶք• ൿಗ• ૉҼղ͕࣮࣌ؒͰղ͔Εͳ͍ݶΓ҆શ• શੑ• SHAͳͲͰ֬อͰ͖Δ• ೝূ• ࠓͷͱ͜Ζٕज़తʹղܾͰ͖͍ͯͳ͍
ൿಗ• ެ։伴҉߸ํࣜ• RSA҉߸• కΊΔ伴ɼ։͚Δ伴͕ҟͳΔ҉߸ํࣜ• 伴ͷૹΛղܾͨ͠ʢ͍ͯ͠ΔʣͱݴΘΕΔ• ར༻͢Δֶ• ૉҼղ͕࣮࣌ؒͰܭࢉͰ͖ͳ͍• ࢄର࣮࣌ؒͰܭࢉͰ͖ͳ͍
શੑ• MD5, SHA• ͋ΔσʔλͷϋογϡΛ࡞Δ• MD5ͱαΠζͷখ͍͞SHAةݥ• ϋογϡͷੑ࣭• σʔλΛೖΕΔͱϋογϡ͕ಘΒΕΔ• ೖྗ͕গ͠ͰมΘΔͱϋογϡେ͖͘มΘΔ• σʔλΛվ᜵ͨ݁͠ՌʹରԠ͢ΔϋογϡΛ༧ଌ͢Δ͜ͱ͍͠• →ͭ·ΓϋογϡΛ֬ೝ͢Δͱվ᜵͞Ε͍ͯͳ͍͔Λ֬ೝͰ͖Δ
ೝূ• ղܾ͢ΔֶతͳΈະͩʹͳ͍
ൿಗͱશੑΛୡͯ͠ૹ৴ऀ ड৴ऀ҉߸Խσʔλൿಗ҉߸Խશੑվ᜵ෆՄड͚औΔ૬ख͕୭ͳͷ͔Θ͔Βͳ͍߈ܸऀ
߈ܸྫ: man in the middle attack(MTM)ૹ৴ऀ தؒऀ҉߸Խσʔλ҉߸Խվ᜵ෆՄۜߦ҉߸ԽσʔλೝূͷΈ͕ͳ͍ͱɼ୭ͱ௨৴͍ͯ͠Δ͔ͷอূ͕ಘΒΕͳ͍
ݱঢ়ͷରࡦʔSSLೝূہ• ೝূہ - Certificate Authority(CA)
ݱঢ়ͷରࡦʔSSLೝূہΫϥΠΞϯτ %/4ۜߦ*1χηۜߦ*1bank.co.jp1.1.1.1bank.co.jpೝূہূ໌ॻͦΕۜߦͷূ໌ॻͰ͢
ݱঢ়ͷରࡦʔSSLೝূہΫϥΠΞϯτ %/4ۜߦ*1χηۜߦ*1bank.co.jp2.2.2.2bank.co.jpೝূہূ໌ॻͦΕͩΕʁ
OSXʹσϑΥϧτͰೖΔূ໌ॻ
ΦϨΦϨূ໌͕μϝͳཧ༝• man in the middle attack(MTM)ͷ㕒৯• ͱ͍͑ɼMTM͘Β͍͍ͬͯͬͯݴ͏ͳΒɼผʹΦϨΦϨূ໌ॻͰΑ͍ͱ͍͏͜ͱ• ΦϨΦϨূ໌ॻͰ͋ͬͯɼͦͷ૬खͱͷ௨৴ͷൿಗɼશੑอͨΕΔ
ͳͥೝূ͕͍͠ͷ͔• ʮ৴͡Δʯͱ͍͏͜ͱͷఆ͕ٛᐆດ͔ͩΒ
ೝূہͷ৴༻ੑhttps://www.jp.websecurity.symantec.com/repository/faq/class.html৴༻ੑຊͷࣾձతͳ৴༻ੑΛಘΔͷͱಉ͡ΈͰߏங͍ͯ͠Δ
SSLূ໌ॻʹ͍ͭͯ• ೝূͷͨΊͷΈ• ҉߸Խͱ͔ɼࠜຊతʹؔͳ͍• ࣮ࡍͷΈ্͋Δ͕• ͏·͘ղܾ͢Δֶ/ֶతͳΈ͕ະͩͳ͍• ೝূہɾূ໌ॻͷΫϥε• ೝূʹ͕͔͔ۚΔ• Let’s EncryptStartSSLʹ৴པੑ͕Γͳ͍• VerisignͳͲͷCLASS3৴པੑ͕ߴ͍ˠՁ֨ߴ͍
Let’s Encrypt• ແྉͷSSLূ໌ॻ• ϝʔϧΞυϨεͷΈͷূ໌• ࣗಈߋ৽ͷͨΊͷεΫϦϓτ͞Ε͍ͯΔ• https://github.com/certbot/certbot• ߋ৽ͷͨΊͷπʔϧ͕ͪΐͬͱલʹ͔Θͬͨ
Έ• certbot͕Let’s Encryptͱ௨৴ͯ͠ূ໌ॻΛൃߦ• apacheͱnginx• ࣗಈͰূ໌ॻͷΠϯετʔϧ·ͰΔΒ͍͠• ಈ͔ͳ͍ͬͯBBSʹ͔͋ͬͨΒͬͯͳ͍• webroot• ಛఆͷύεΛҰ࣌తʹ͏• letsencryptͷύεʹূ໌ॻ͕ίϐʔ͞ΕΔ• standalone• ಛఆͷϙʔτͰμΠϨΫτʹ௨৴͢ΔʢΒ͍͠ʣ• 80ͱ͔͏ͷͰҰ࣌తʹαʔόΛด͡Δඞཁ͕͋Δ• manual• ڵຯͳ͍ͷͰݟͯͳ͍
͜Μ͚ͩͰΑ͍./letsencrypt-auto certonly --webroot \\-w /var/www/example/ \\-d www.example.com
ใ• ༗ޮظݶ• 90• Let’s EncryptӡӦ60Ͱߋ৽͢Δ͜ͱΛਪ• ੍ݶ• ͻͱͭͷIP͔ΒൃߦͰ͖ΔυϝΠϯ• ͻͱͭͷIP͔ΒൃߦͰ͖Δূ໌ॻͷ• ੍ݶ̓͘Β͍Ͱղআ͞ΕΔ• ೝূہͱͯ͠• iOS/Windows/OSXʹ৴༻͞Ε͍ͯΔ• ΫϥΠΞϯτʹΑͬͯ৴༻͍ͯ͠ͳ͍ͷͰཁҙ
ࢀߟจݙ• ҉߸શൠ• ݁ߒ, ҉߸ٕज़ೖ• RSA҉߸/ૉपΓ• ϚʔΧεɾσϡɾιʔτΠ,ૉͷԻָ• ʴͦͷลͷେֶͷઌੜͷαΠτͳͲ
AutolayoutΛ͍ͬͯΔ͕Զ͏ݶք͔͠Εͳ͍GUIͷݶք
ݱࡏ࡞ͬͯΔΞϓϦΛྫʹ
Ϗϡʔͷ༁͜Μͳײ͡
Έͳ͞ΜɼͲ͏͍ͬͯͬͯ·͔͢ʁ• Storyboard• Storyboard + xib• ίʔυ
Storyboard͜ΜͳෳࡶͳϏϡʔΛGUI͔Β࡞Δͱ͔ෆՄೳ9999 +10013h sonson_twit imgur.com11 imagesJust installed iOS 9.3 Beta without a developeraccount (iPhone 6S Plus), 3D Touch animationlag gone!SearchSketch 9:41 AM 100%
Storyboard + xibҙຯෆ໌த͕Θ͔Βͳ͍
ίʔυҙຯෆ໌͕ͩσβΠφ͕͍ͳ͍ͷͰͳΜͱ͔ͳΔ
ίʔυҙຯෆ໌͕ͩσβΠφ͕͍ͳ͍ͷͰͳΜͱ͔ͳΔΘ͚ͳ͍
͜͜Ͱɼ͍ٞͨ͠• AutolayoutɼࠓޙͲ͏͠·͔͢ʁ• Storyboard• Storyboard + xib• ίʔυ• Ή͠ΖɼAutolayoutΘͳ͍• έʔε• ҰਓͰझຯͰॻ͘߹• ਓͷίʔσΟϯάɼنখ͍͞• ҙঊ/UI/UXͷσβΠφ͍Δنͷେ͖͍
·ͱΊ• SSLʹ͍ͭͯͷ෮श• ऍᷟʹઆ๏Ͱ͢Έ·ͤΜ• ৴༻ʹ͓͕͔͔ۚΓ·͢• SSL͕ԿͷͨΊʹඞཁ͔ɼৗʹߟ͑·͠ΐ͏• Let’s Encryptͷ͍ํʹ͍ͭͯ• Autolayout• ٧Μͩ
sonsongithub
miyuki2203
mackey0225
niftycorp
pospome
afilina
nrslib
yuhei_fujita
atinfinity
kinocoboy2
cer
seike460
tmm1
keavy
dotmariusz
danielanewman
marcelosomers
soudai
mojombo
quramy
jasonvnalue
trishagee
stephaniewalter
shlominoach