Thursday, September 24, 2015

Neverbleed - RSAの秘密鍵演算を別プロセスに分離する話

機能毎にプロセスを分割し、それらを別個の権限のもとで実行することで、脆弱性があった場合の影響を抑え込むというのは、一定以上の規模をもつプログラムでは、しばしば見られるデザインパターンです。

qmailは、そのような設計がなされたメール配送デーモンとして名高いですし、OpenSSHもまた、認証プロセスと通信プロセスを分離することで、外部との通信を担当するコードにバグがあったとしても、ルート権限が奪われないように設計されています(参照: Privilege Separated OpenSSH)。

一方で、OpenSSLにはそのような権限分離は実装されていません。Heartbleedの際にサーバの秘密鍵が漏洩したのも、秘密鍵の取り扱いと、その他の通信の取り扱いを同一のメモリ空間の中で行っていたからだと考えることができます。

ないのなら、自分で作ればいいじゃない…ということで作りました。それが、Neverbleedです。

Neverbleedは、OpenSSLの拡張インターフェイスであるEngineを利用して、RSA秘密鍵を用いる処理を専用プロセスに分離します。OpenSSLの初期化時に専用プロセスを起動し、秘密鍵の読み込みと関連演算は全て専用プロセスで行われるため、OpenSSLを利用するサーバプロセスに脆弱性があったとしても秘密鍵が漏洩することはありません。

OpenSSLの拡張インターフェイスを利用しているため、OpenSSLへの変更は不要ですし、サーバプログラムへの変更もごく少量ですみます。また、専用プロセスとの通信のオーバーヘッドはRSAの秘密鍵演算と比べると非常に小さいため、そのオーバーヘッドは問題になりません。

そんな感じでうまく動いているので、Neverbleedは、今月リリース予定のH2Oバージョン1.5に組み込まれる予定です。

参照: http://www.citi.umich.edu/u/provos/ssh/privsep.html

75 comments:

  1. This is great do you have a catologue if so I would love one to share with friends and family.
    T20 World Cup 2016 U19 Watch Online
    Starsports Cricket Live streaming
    IPL 2016 players list

    ReplyDelete
  2. Get The T20 worldcup Updates Match details And match Schedule Of ICC t20 Worldcup Details..
    T20 Worldcup Livestreaming
    India vs Pak Live match

    ReplyDelete
  3. check out ! here you get the best reviews on movies and gadegts by professionals


    http://www.trendsreviewer.com/

    ReplyDelete
  4. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download


    http://www.spflashtooldownload.com/

    ReplyDelete
  5. Great! Thanks for sharing the information. That is very helpful for increasing my knowledge in this fiel.A good blog Apple Shooter . Thanks for sharing the information. It is very useful for my future. Stickman Games keep sharing
    Signature: Stickman Games

    ReplyDelete
  6. Want to know the schedule of Euro Cup 2016 and also get all the latest updates, just check Euro Cup Live Schedule to know everything about Euro Cup 2016,live scores,live streaming,schedule and all the detail news. Euro is due to start on 10th June in France with 24 teams. Stay updated.

    ReplyDelete

  7. Pega is a Java-based BPM tool which is used to build enterprise applications. Among all the BPM tools in the market Pega is the leading and No-1 BPM tool according to market standards far

    beyond its competitors. Pega enables in creating and managing web-based applications with less effort and faster deadlines using Agile or Scrum methodology.


    Pega Training |
    AWS Training |
    Informatica MDM Training |
    PlSQL Training |
    Qlikview Training |
    Teradata Training

    ReplyDelete
  8. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    wings io| earn to die 6
    earn to die 5| happy wheels
    |Red Ball | duck life

    ReplyDelete
  9. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success!
    slitherio | unfair mario 2 | age of war 2
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    cubefield | tank trouble | happy wheels |earn to die 1 |
    earn to die 6 | duck life

    ReplyDelete
  10. Hi i was browsing your blog and i found it really interesting! i too have a website.Kindly check it out here
    Rajhans Residency Noida Extension
    Rajhans Residency Noida
    Rajhans Residency

    ReplyDelete
  11. Rio 2016 is a major international multi-sport event in the tradition of the Olympic Games due to take place in Rio de Janeiro, Brazil.
    rio olympics 2016 schedule pdf

    ReplyDelete
  12. Hi i was browsing your blog and i found it really interesting! i too have a website.Kindly check it out here
    Galaxy Blue Sapphire Plaza
    Galaxy Blue Sapphire Noida Extension
    Galaxy Blue Sapphire
    Galaxy Blue Sapphire Plaza Noida

    ReplyDelete
  13. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    kids games free | games games | shooting games | tank games | apple shooter | stick war 2 | unblocked games

    ReplyDelete
  14. Friendship Day Images 2016
    Find Happy Friendship Day 2016 HD Images, Quotes, SMS, Greetings and Songs. Also Pictures and Wishes for Best Friends. Best Wallpaper, Wishes and Pictures you can find.



    Raksha Bandhan 2016 Quotes
    Find Raksha Bandhan 2016 Images, Quotes, Greetings and Songs. Also Pictures and Wishes for your Brother or Sister. Best Presents, Gifts Ideas and Quotes Poems.



    15 August Independence Day
    Happy Independence Day 15th of August 2016 images and pictures. Watch fireworks, events and celebrations Here

    ReplyDelete
  15. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    play now :
    al3ab-banat01
    العاب طبخ ، العاب طبخ بنات ، العاب طبخ جديدة

    ReplyDelete

  16. The blog or and best that is extremely useful to keep I can share the ideas
    of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
    tanki online | 2048 game |
    tanki online game

    ReplyDelete
  17. http://www.howtoremovepcvirus.com/way-remove-ransom32nw-js-ransomware

    ReplyDelete
  18. Thanks for this great post, i find it very interesting and very well thought out and put together. I look forward to reading your work in the future
    شركة نقل اثاث بالخبر
    ارخص شركة نقل اثاث بالدمام
    شركة نقل الاثاث بالدمام
    شركة نقل عفش بالدمام

    ReplyDelete
  19. Hey – great blog, just looking around some blogs, seems a really nice platform you are using. I’m currently using WordPress for a few of my blogs but looking to change one of them over to a platform similar to yours as a trial run. Anything in particular you would recommend about it?
    ارخص شركة نقل اثاث بالدمام
    شركة نقل عفش بالدمام
    شركة نقل اثاث بالخبر
    شركة نقل اثاث بالدمام

    ReplyDelete
  20. I have read a few of the articles on your website now, and I really like your style of blogging. I added it to my favorites blog site list and will be checking back soon. Please check out my site as well and let me know what you think
    شركة نقل اثاث بالقطيف
    نقل اثاث بالدمام رخيص

    ReplyDelete
  21. After exploring a handful of the blog articles on your web site, I really like your technique of blogging. I added it to my bookmark webpage list and will be checking back in the near future
    شركة تنظيف بالخبر
    شركة تنظيف بالجبيل
    شركة تنظيف بالدمام
    شركة تنظيف بالقطيف
    نفخر بخدمتكم في المنطقة الشرقية بالكامل الدمام والخبر والجبيل والاحساء باستخدام افضل وامهر فنيين التنظيف الداخلي للمنازل و البيوت وكذلك نقدم خدمات افضل شركة تنظيف بالدمام وتشمل التنظيف الخارجي ويشمل ذلك تنظيف واجهات الزجاج – تنظيف واجهات حجر وذلك عن طريق خدمات تنظيف الواجهات الحجر باستخدام ( ضرب الرمل – مسدس المياه ) من افضل شركة تنظيف بالدمام

    ReplyDelete
  22. I really enjoyed reading this post, big fan. Keep up the good work andplease tell me when can you publish more articles or where can I read more on the subject?
    شركة تنظيف بالجبيل
    شركة تنظيف بالدمام
    شركة تنظيف بالخبر
    شركة تنظيف بالقطيف

    ReplyDelete
  23. Its my great pleasure to visit your blog and to enjoy your great posts here. I like it a lot. I can feel that you paid much attention for those articles, as all of them make sense and are very useful
    شركة مكافحة الحشرات بالقطيف
    شركة مكافحة النمل الابيض بالقطيف
    شركة مكافحة الحشرات بالدمام
    شركة مكافحة الحشرات بالخبر

    ReplyDelete
  24. I really enjoyed reading this post, big fan. Keep up the good work andplease tell me when can you publish more articles or where can I read more on the subject?
    شركة مكافحة البق بالقطيف
    شركة مكافحة البق بالدمام
    شركة مكافحة النمل الابيض بالدمام
    شركة مكافحة النمل الابيض بالخبر
    شركة الوطنية بأمكانها تقديم خدمات المكافحة لحشرة النمل الابيض و التخلص منها في اسرع وقت وبنسبة 100% في جميع ارجاء المنزل

    ReplyDelete
  25. The article you have shared here very good. This is really interesting information for me. Thanks for sharing!
    hotmail login |hotmail sign in |free hotmail login

    ReplyDelete
  26. start and stop the vacuums. Previously,strikingly.com/ this feature had only been readily Click Here available with its top-of-the-line Ideal essential oil diffuser reviews Roomba. The Roomba 690, which is the successor.

    ReplyDelete