Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Tokbind-fido

5,016 views

Published on

#idcon vol. 20 通称 #fidocon で発表したtoken bindingのスライドです。

- イベントリンク: https://idcon.doorkeeper.jp/events/23320
- togetter: http://togetter.com/li/827484

Published in: Internet
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Tokbind-fido

  1. 1. https://lepidum.co.jp/ Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved. Token BindingとFIDO 株式会社レピダム 前田 薫 (@mad_p) #fidcon 2015/05/27 #fidocon 2015/05/27
  2. 2. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ bearer tokenとholder-of-key token  bearer token  holder-of-key token #fidocon 2015/05/27
  3. 3. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding  ベアラーセキュリティートークン  OAuth token  HTTPクッキー  盗まれて行使できてしまう  特定の者だけに許可したい  IDと関連づけて管理 → 行使時のIDを確認  draft-ietf-tokbind-protocol-00 #fidocon 2015/05/27
  4. 4. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ IETF92 in Dallas  tokbind WG (Security エリア)  token bindingを標準化するWG #fidocon 2015/05/27
  5. 5. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding ID #fidocon 2015/05/27 Public Keyを使って Token Binding IDを定義 サーバーごとに 1組の鍵ペア セキュアストレージ 鍵ペア
  6. 6. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding(1) トークン要求 #fidocon 2015/05/27 TLS接続 tls-unique tls-unique tls-uniqueを秘密鍵で署名、 TokenBindingIDとセットにして送る もらった公開鍵と tls-uniqueで署名検証 • いま話してる相手が • この公開鍵に対応し た秘密鍵を持ってい る TokenBinding
  7. 7. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding(2) トークン発行 #fidocon 2015/05/27 TokenBindingIDと トークンを関連づける
  8. 8. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding(3) トークン行使 #fidocon 2015/05/27 tls-unique TokenBinding トークンと TokenBindingを送る TokenBindingを検証 トークンに関連づけて おいたTokenBindingID と比較 tls-unique • いま話してる相手が • トークン発行先
  9. 9. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Token Binding IDの詳細  以下の要素を持つバイナリ構造体  TokenBindingType: providedまたはreferred  SignatureAndHashAlgorithm: p256またはrsa2048  公開鍵  タイプは後述  署名/ハッシュ方式もIDの一部とする  ダウングレード攻撃を防ぐ #fidocon 2015/05/27
  10. 10. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ ネゴシエーション  TokenBindingを使うかどうか  ALPNで決める案  ALPN IDが長くなっちゃうのがいまいち  TLSの新しい拡張を作る案  TLSセッション確立後の最初の ユーザープロトコルで送信 #fidocon 2015/05/27
  11. 11. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ 注意すべき点  プライバシー  Token Binding IDはサーバーごとに別にする  複数サーバーの結託「こいつ同じやつだ」を防ぐ  Token Binding IDはクリアテキストで送らない  横から見て「あいつあのサーバー行った」を防ぐ  ユーザー要求で削除できるように  セキュリティー  Man-in-the-Browserは防げない点に注意  秘密鍵をエキスポート不可な場所に保存  取り出して他のマシンで使われることを防ぐ #fidocon 2015/05/27
  12. 12. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ ChannelIDってのもありましたね?  #idcon 16th でちょろっと話が  draft-balfanz-tls-channelid-01  Google Chromeなどに実装済  individual draftのままexpire  著者のDirk Balfanzはtokbind-protocol-00の著者に も入っている  Channel IDとtokbindの比較  公開鍵と署名を送るのは同じ  ChannelIDはTLS拡張で送信 #fidocon 2015/05/27
  13. 13. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ HTTPでのToken Binding  draft-ietf-tokbind-https-00  Token-Binding HTTPヘッダを使って TokenBindingMessageを送る  クッキーやOAuthトークンを TokenBindingIDと関連づける  トークン内に記入して署名  データベースに保存 #fidocon 2015/05/27 GET / HTTP/1.1 Host: example.com Token-Binding: DLF02LDSK3DMS28SA… User-Agent: … おなじみ Url-safe Base64
  14. 14. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ フェデレーションサポート  IdPから得たid_tokenをRPに提示  RPがid_tokenを見て 確かに今これを持ってきた人は IdPからこのトークンをもらった人だ と確認したい  id_tokenにToken Binding ID入れればいい!  Token Binding IDはIdP用とRP用で異なる  RP用のToken Binding IDをid_tokenに入れる 必要がある  クライアントがRP用のToken Binding IDをIdPに 渡す #fidocon 2015/05/27
  15. 15. http://www.ietf.org/proceedings/92/slides/slides-92-tokbind-2.pdf
  16. 16. http://www.ietf.org/proceedings/92/slides/slides-92-tokbind-2.pdf TokenBinding RP用 TokenBinding RP用TokenBinding IdP用 tls-unique-r tls-unique-i providedタイプ providedタイプ referredタイプ
  17. 17. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ FIDO #fidocon 2015/05/27 challenge challengechallenge
  18. 18. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ tls-unique Token BindingとFIDO #fidocon 2015/05/27 challenge challenge tls-unique TokenBinding challenge tls-unique FIDOデバイスを持っていればトークンが使える
  19. 19. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ まとめ  TokenBinding  鍵ペアとtls-uniqueで相手を特定  トークンを関連づけて行使者を限定  フェデレーションサポート  FIDOを使って署名 #fidocon 2015/05/27
  20. 20. Copyright © 2004-2015 Lepidum Co. Ltd. All rights reserved.https://lepidum.co.jp/ Any Questions? / Please Feedback! https://lepidum.co.jp/ mailto:maeda@lepidum.co.jp / twitter: @mad_p #fidocon 2015/05/27

×