JavaScriptを使って学ぶEnd-to-Endセキュリティ第4回

JavaScript End-to-End
4
1),2)
1)
2)
January 26, 2020
Jun Kurihara (Zettant Inc./U-Hyogo) E2E Security with JS 04 January 26, 2020 1 / 69

1,2,3
End-to-End (E2E)
JavaScript AES
JavaScript (RSA/ )
3

3 : Ephemeral Scheme
Ephemeral Scheme
1
Perfect Forward Secrecy1
Perfect Forward Secrecy End-to-End
1

Ephemeral Scheme
Ephemeral
? 2
2

E2E
MAC 3
4
JavaScript
3
HMAC (RFC2104 https://tools.ietf.org/html/rfc2104)
4
RSASSA PKCS#1-v1.5/PSS (PKCS#1 RFC8017 https://tools.ietf.org/html/rfc8017),
ECDSA (FIPS PUB186-4 https://csrc.nist.gov/publications/detail/fips/186/4/final)

:
Web Web
:
Bash, Git
Node.js, npm, yarn
Google Chrome and/or Firefox

:
1 &JS
2 AES
3
4 MAC

JavaScript
(Node.js) Hash/MAC/

src/commands-browser.html Node.JS
Ephemeral
Scheme

:
Node.js (> v10) yarn 5
Google Chrome ( )
Firefox
Visual Studio Code WebStorm
5
: npm i -g yarn

JavaScript
1 GitHub 6
Clone
$ git clone
https://github.com/junkurihara/slides-e2e-security-js.git
$ cd sample04
2
$ yarn install
3
$ yarn build
6
https://github.com/junkurihara/slides-e2e-security-js/

: Hash

Hash Hash
Hash Hash
Hash Hash 7
7
Hash Message Digest

1 Hash

Hash Hash
Checksum
Checksum
( )
⇒
Hash
Hash
8
⇒ Hash
Checksum ⊆ Hash
8
Hash Table

Hash
MD5, SHA-1, SHA-2 (SHA-256, 384, 512), SHA-3 Hash
MD5 SHA-1 Hash( )
9
9
MD5 220

Hash
SHA-2
bit (= )
bit
SHA-1/MD5
Checksum
IE/Edge
X.509 SHA-1
IE/Edge SHA-1
X.509
JavaScript API

JavaScript Hash
% yarn execute gen-hash ’hello hash world!’ // hash ’SHA-256’
<Computed Hash>
70c6b0c909b7a3b4932e6e6d27c6e3c8106b7b9487a4ab9fb27d698b0bee601d // ’SHA-256’
hash
=======
% yarn execute gen-hash ’hello hash world!!’ // 1
<Computed Hash>
c1a548f16bc6cd013fb76f59c982c6dbc57d390d9a470e09b35d716c7716ab47 // hash
=======
% yarn execute gen-hash ’hello hash world!’ -h ’SHA3-256’ // -h hash
<Computed Hash>
cb352b3d82d5911b99774fcf534bfd024fc58ef58fb67db14f504931da9a333d
=======
bash SHA-256 hash
% echo -n ’hello hash world!’ | shasum -a 256
70c6b0c909b7a3b4932e6e6d27c6e3c8106b7b9487a4ab9fb27d698b0bee601d -

Hash
jscu10
hash (src/test-apis.js)
// hashName = ’SHA-256’, ’SHA-384’, ’SHA-512’, ’SHA-1’, ’SHA3-256’, etc...
const jscu = getJscu(); // jscu
const binary = jseu.encoder.stringToArrayBuffer(data); // string uint8array
return jscu.hash.compute(binary, hashName); // hash promise
Node.js, SHA3
10
https://github.com/junkurihara/jscu

2
Message Authentication Code (MAC)
( )

MAC/
MAC/

MAC
pros/cons

MAC
(MAC)
MAC

MAC :
MAC
MAC
⇓
MAC

( )
11
11

:
(false )
12
MAC (= )
⇓
13
12
13

MAC pros/cons
MAC
Pros Cons
MAC 14
MAC
15
16
⇒ AES/
14
AES (CMAC) Hash (HMAC)
15
128–512bits
16
ECDSA 256–512bits RSA 2048bits

: MAC

MAC &
( )
1 MAC
2 MAC

MAC
HMAC; Hash-based Message Authentication Code
CMAC; Cipher-based Message Authentication Code
GMAC; Galois Message Authentication Code
etc.
JS HMAC

HMAC; Hash-based MAC
HMAC (RFC2104)17
Hash18
Hash MAC
HDKF (RFC5869) AWS Signature v419
17
https://tools.ietf.org/html/rfc2104
18
Keyed Hash
19
AWS S3 REST API MAC

Hash
Hash
(=MAC )
MAC

JavaScript HMAC
// HMAC Hex hash
% yarn execute gen-hex-key 32
<Generated Hex Key>
6c9a34e979fc7701330ec75a1bc6acb589ebaf831c7941e042c9ded0b2741d8f
=======
// HMAC SHA-256 -h
% yarn execute gen-hmac ’hello hmac world!’
-k ’6c9a34e979fc7701330ec75a1bc6acb589ebaf831c7941e042c9ded0b2741d8f’ // Hex
<Computed HMAC with SHA-256>
862e28454f635541ce194d3e4919327c9823830cb7174286aaced5fc61e96a46
=======
// HMAC
% yarn execute verify-hmac ’hello hmac world!’
-k ’6c9a34e979fc7701330ec75a1bc6acb589ebaf831c7941e042c9ded0b2741d8f’ // Hex
-m ’862e28454f635541ce194d3e4919327c9823830cb7174286aaced5fc61e96a46’ // Hex HMAC
<Verification result of given HMAC>
true
=======

//
% yarn execute verify-hmac ’hello hmac world!?’ // ?
-k ’6c9a34e979fc7701330ec75a1bc6acb589ebaf831c7941e042c9ded0b2741d8f’
-m ’862e28454f635541ce194d3e4919327c9823830cb7174286aaced5fc61e96a46’
false
=======
// HMAC
% yarn execute verify-hmac ’hello hmac world!’
-k ’6c9a34e979fc7701330ec75a1bc6acb589ebaf831c7941e042c9ded0b2741d8f’
-m ’862e28454f635541ce194d3e4919327c9823830cb7174286aaced5fc61e96a47’ //
false
=======

HMAC (src/test-apis.js)
const jscu = getJscu();
// hex string string uint8array
const binaryData = jseu.encoder.stringToArrayBuffer(data);
const binaryKey = jseu.encoder.hexStringToArrayBuffer(key);
// Promsie hash = ’SHA-256’, etc...
return jscu.hmac.compute(binaryKey, binaryData, hash);
HMAC (src/test-apis.js)
// hex string string uint8array
const binaryKey = jseu.encoder.hexStringToArrayBuffer(key);
const binaryMac = jseu.encoder.hexStringToArrayBuffer(mac);
// Promise hash = ’SHA-256’, etc...
return jscu.hmac.verify(binaryKey, binaryData, binaryMac, hash);
MAC OK

MAC (JS )
CMAC; Cipher-based MAC (NIST SP800-38B20
)
(e.g., AES) CBC Hash
MAC
GMAC; Galois MAC (NIST SP800-38D21
)
(e.g., AES) Galois Counter Mode (GCM)
MAC 22
Hash
MAC GMAC
CMAC/GMAC
20
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf
21
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
22
F[x]/(x128 +x7 +x2 +x+1) = F2128

MAC
JS API23
MAC
HMAC
CMAC, GMAC or npmjs.com
23
WebCrypto API, Node.js Crypto

:

( ) &
:
1 D Hash 24
hash h = Hash(D)
2 hash h SK s = Sign(h, SK)
D s
:
1 D hash h = Hash(D)
2 hash h s PK
Verify(h, s, PK) ∈ {True, False}
24
D (e.g,
) (i.e., hash)

25
1 hash h s
2 s h
h = Hash(D )
25

RSA :
RSASSA PSS
RSASSA PKCS#1-v1.5
:
ECDSA
etc.26
JS RSASSA PSS & PKSC#1-v1.5 ECDSA
26
Digital Signature Algorithm; DSA (FIPS PUB 186-4
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf)

AES-128bits
RSA: ≥ 3072bits
ECC: ≥ 256bits
(i.e.,
)

RSASSA; RSA Signature Scheme with Appendix
RSASSA PKCS#1-v1.5 RSASSA PSS
h = Hash(D)

RSASSA PKCS#1-v1.5 (RFC801727
)
RSAES PKCS#1-v1.5 PCKS#1 v1.5
SSL/TLS
hash h = Hash(D) DER T
m = 0x00||0x01||RandomSequence||0x00||T
RSASSA PKCS#1-v1.5 hash
28
PCKS#1 v2.2 (RFC8017) hash
RSASSA-PSS
27
28
Y. Desmedt et al., “A Chosen Text Attack on the RSA Cryptosystem and Some Discrete
Logarithm Schemes,” in Proc. CRYPTO 1985, pp.516–522, 1985. J. Coron (CRYPTO 1999)

RSASSA-PSS (Probabilistic Signature Scheme, RFC801729
)
RSAES OAEP RFC3447/PKCS#1 v2.1 (2003 )
D (RandomSalt)
Hash 2 Padded data m
h = Hash(Hash(D), RandomSalt),
m = MaskedDataBlock||h||0xBC,
MaskedDataBlock
RSASSA PKCS#1-v1.5
OAEP RFC
PSS
29

: PSS
D padded data m Salt

JavaScript RSASSA-PSS
RFC PSS ( )
% yarn execute gen-rsa-key // RSA -b
<Generated RSA Public Key>
30820122300d06092a864886f70d01010105000... //
<Generated RSA Private Key>
308204be020100300d06092a864886f70d01010... //
=======
% yarn execute sign-rsa-pss ’hello rsa-pss world!’ // RSASSA-PSS
-s ’308204be020100300d06092a864886f70d0...’ //
<Generated RSASSA-PSS Signature>
6e7c4632f62e354f0ac40f65c92cd3e5bec5f6f... //
=======
% yarn execute verify-rsa-pss ’hello rsa-pss world!’ // RSASSA-PSS
-p ’30820122300d06092a864886f70d0101010...’ //
-t ’6e7c4632f62e354f0ac40f65c92cd3e5bec...’ //
<Verification Result of RSASSA-PSS Signature>
true //
=======
hash -h

(src/test-apis.js)
// uint8array
const privateKeyDer = jseu.encoder.hexStringToArrayBuffer(privateKeyHex);
const privateKey = new jscu.Key(’der’, privateKeyDer); // DER
// hash = ’SHA-256’, saltLength = 32
return jscu.pkc.sign(
binaryData,
privateKey,
hash, // hash
{name: ’RSA-PSS’, saltLength}
);
RSASSA Hash API
Hash

(src/test-apis.js)
// uint8array
const publicKeyDer = jseu.encoder.hexStringToArrayBuffer(publicKeyHex);
const signature = jseu.encoder.hexStringToArrayBuffer(signatureHex);
const publicKey = new jscu.Key(’der’, publicKeyDer); // DER
// hash = ’SHA-256’, saltLength = 32
jscu.pkc.verify(
binaryData,
signature,
publicKey,
hash, // hash
{name: ’RSA-PSS’, saltLength}
);

RSASSA-PSS Node.js Crypto/WebCrypto
WebCrypto
OAEP PSS
( OpenSSL )

ECDSA; Elliptic Curve Digital Signature Algorithm
ECDSA (NIST FIPS 186-430
)
ECDH 31
NIST FIPS 186-3 (2009 )
Bitcoin blockchain
RSASSA padding
hash h
Signature = SignECDSA(D, SK),
{True, False} VerifyECDSA(Signature, D, PK),
API 32
OpenSSL
30
https://csrc.nist.gov/publications/detail/fips/186/4/final
31
32
RSASSA Sign/Verify API
RSA

RSASSA ECDSA ( )
Pros Cons
RSASSA
ECDSA (e.g.,
3072bits)
ECDSA
(e.g.,
512bits (256bits key))
ECDSA

JavaScript ECDSA
% yarn execute gen-ecc-key // ECC -c
<Generated ECC Public Key>
3059301306072a8648ce3d020106082a8648ce3d03010703... //
<Generated ECC Private Key>
308193020100301306072a8648ce3d020106082a8648ce3d... //
=======
% yarn execute sign-ecdsa ’hello ecdsa world!’ // ECDSA
-s ’308193020100301306072a8648ce3d020106082a8648c...’ //
<Generated ECDSA Signature>
58e5d15be4e71f7e6fbd4662cdb31eca463ed855114ef8357bed9.... //
=======
% yarn execute verify-ecdsa ’hello ecdsa world!’
-p ’3059301306072a8648ce3d020106082a8648ce3d03010...’ //
-t ’58e5d15be4e71f7e6fbd4662cdb31eca463ed855114ef...’ //
<Verification Result of ECDSA Signature>
true //
=======
hash -h

(src/test-apis.js)
// uint8array
const privateKeyDer = jseu.encoder.hexStringToArrayBuffer(privateKeyHex);
const privateKey = new jscu.Key(’der’, privateKeyDer); // DER
// hash = ’SHA-256’
return jscu.pkc.sign(
binaryData,
privateKey,
hash, // hash
);

(src/test-apis.js)
// uint8array
const publicKeyDer = jseu.encoder.hexStringToArrayBuffer(publicKeyHex);
const signature = jseu.encoder.hexStringToArrayBuffer(signatureHex);
const publicKey = new jscu.Key(’der’, publicKeyDer); // DER
// hash = ’SHA-256’
jscu.pkc.verify(
binaryData,
signature,
publicKey,
hash // hash
);
RSASSA-PSS Salt API

ECDSA Node.js Crypto/WebCrypto
33
33
JavaScript ’P-256K’ Bitcoin blockchain
ECDSA jscu pure js

MAC/

Q:
⇒ OK

1: Trust Anchor
End
SSH GitHub
Trust Anchor

2: PKI
Verisign
Verisign Trust Anchor (Verisign
)
2 Verisign 1 Trust Anchor
34
34
Let’s encrypt (https://letsencrypt.org/)
Let’s encrypt

MAC
MAC
:
1 ECDH-ephemeral
2 ECDH-ephemeral + AES HMAC/AES
3 AES HMAC

:

Hash: SHA-2
MAC:
JS HMAC
:
MAC
RSASSA: RSASSA-PSS
ECDSA:
JavaScript /
MAC

: iTransfy by Zettant

:
: recruit@zettant.com
URL: https://www.zettant.com

JavaScriptを使って学ぶEnd-to-Endセキュリティ 第4回

More Related Content

Similar to JavaScriptを使って学ぶEnd-to-Endセキュリティ 第4回

More from Jun Kurihara

Recently uploaded