TLS _final

Size: px

Start display at page:

Download "TLS _final"

ほだかさだい
5 years ago
Views:

1 TLS 1.3 IoT 2018/12/06, wolfssl Japan GK 1

2 woflssl 2

3 3

4 : 200 E H : 200 I N Q : 2 / MSJ Q : 20. : 2.. # I N TC L L P : 2 T T 4

5 5

6 6

7 wolfssl Japan 7

8 A 28F info@wolfssl.jp wolfssl Japan wolfssl 8

9 9 9

10 wolfssl 10

11 wolfssl kl 33/ /3 R kl T OR S M ü /3 (. /3 ü 210 ü 2 0 AB () ü 1 33/D C f p ü 13 T : 13 T o nn 33/ /3 R : 6- e L /3 ( T 11

12 12

13 ( ( ) (( ) ( 13

14 ( ( ) (( ) ( 14

15 MS D Wb (. /... O T / //. L T /). ).s / / (. ). c I W N Ib. e. T M I I Ab ). ). U ). ).bf PSH b C I 15

16 Wikipedia TLS Implementations. 16

17 SSL/TLS SSL1.0 SSL2.0 SSL3.0 TLS1.0 TLS1.1 TLS1.2 TLS IETF CBC AES SHA-256 (GCM,CCM) DH PSK TDES MD5 RC4, CBC SHA-1 SSL 17

18 18

19 19

20 RFC

21 SSL3 TLS1.0 TLS1.1 TLS1.2 21

22 22

23 TLS1.3 SSL3 TLS1.0 TLS1.1 TLS1.2 TLS1.3 23

24 100% 90% wolfssl.jp 80% 70% 60% 50% 40% 30% 20% 10% 0% TLS1.3 RFC

25 nopenssl1.1.1, Apatche2.4 nboringssl + NGINX n Facebook + Fizz TLS1.3 TLS1.3 (2018/10) 25

26 26

27 HK E K C A S L D 27

28 TLS1.2 28

29 TLS

30 (msec) TLS1.2 TLS (msec) 30

31 TLS1.2 31

32 TLS1.3 32

33 / TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (bit) 33

34 34

35 35

36 36!!

37 TLS1.3 37

38 l l - A - AEAD: Authenticated Encryption with Associated Data 38

39 / TLS1.2 / / RSA DH RSA 39

40 / TLS1.2 / / RSA DH RSA 40

41 / TLS1.3 / / DH RSA 41

42 TLS1.3 42

43 IoT (PSK) ID Early Data (0-RTT) 43

44 Early Data DH Early Data (0-RTT) Early Data (0-RTT) DH Early Data ED A C ED A C 44

45 IoT IoT IoT 45

46 96 h 0GFH yn d ar e a l ov m ST L i i i 30,)) ( ( (12 0 D CCB ) ECI ( A 0A r Pu M y d a 46

47 MB/Sec Chacha-Poly TDES AES-CBC AES-GCM ChaCha-Poly ( AEAD) (AEAD) 47

48 DH NIST Curve25519 DH 2048 ECDHE NIST 256 ECDH CURVE

49 49

50 50

51 51

52 . 52

53 2 wolfssl. 53

54 System Workbench Code Composer Studio 54

55 (Linux, Windows, Mac) IDE Visual Studio IDE IAR EWARM, MDK, IDE, configure make gcc, configure make gcc, 55

56 $ unzip wolfssl zip $ cd wolfssl $./configure $ make $./examples/server/server $./examples/client/client 56

57 57

58 $ unzip wolfssl zip $ cd wolfssl $./configure $ make $./examples/server/server $./examples/client/client 58

59 . 1 $ unzip wolfssl zip $ cd wolfssl $./configure enable-tls13 $ make TLS1.3 $./examples/server/server v 4 $./examples/client/client -v 4 TLS1.3 59

60 60

61 61

62 62

63 63

64 method = wolftlsv1_2_client_method(); /* */ Ctx = wolfssl_ctx_new(method); /* */ ssl = wolfssl_new(ctx); /* */ wolfssl_connect(ssl); /* TLS */ wolfssl_write(ssl, buff, size); /* */ wolfssl_read(ssl, buff, size); /* */ wolfssl_free(ssl); /* TLS */ wolfssl_ctx_free(ctx); /* */ 64

65 TLS1.3 TLS1.3 method = wolftlsv1_3_client_method(); /* */ Ctx = wolfssl_ctx_new(method); /* */ ssl = wolfssl_new(ctx); /* */ wolfssl_connect(ssl); /* TLS */ wolfssl_write(ssl, buff, size); /* */ wolfssl_read(ssl, buff, size); /* */ wolfssl_free(ssl); /* TLS */ wolfssl_ctx_free(ctx); /* */ 65

66 l TLS TLS1.2 int wolfssl_connect_tlsv13(wolfssl* ssl); int wolfssl_accept_tlsv13(wolfssl* ssl); l int wolfssl[_ctx]_no_ticket_tlsv13(wolfssl[_ctx]* ctx/ssl); int wolfssl_no_ticket_tlsv13(wolfssl* ssl); l DHE int wolfssl[_ctx]_no_dhe_psk(wolfssl[_ctx]* ctx/ssl); l int wolfssl_update_keys(wolfssl* ssl); l int wolfssl[_ctx]_allow_post_handshake_auth(wolfssl[_ctx]* ctx/ssl); int wolfssl_request_certificate(wolfssl* ssl); l Early Data int wolfssl_read/write_early_data(wolfssl*, const void*, int, int*); int wolfssl[_ctx]_set_max_early_data(wolfssl[_ctx]* ctx/ssl, unsigned int sz); 66

67 TLS 67

68 TLS1.3 68

69 TLS1.3 Early Data (0:RTT) 69

70 TLS TLS1.3 TLS1.3: TLS1.3 Early Data (0:RTT) 70

71 TLS TLS1.3 71

72 : 72

Copyright 2017, wolfssl Inc. All rights reserved. 今日 TLS 1. 3 IoT TLS 新ー話

Copyright 2017, wolfssl Inc. All rights reserved. 今日 TLS 1. 3 IoT TLS 新ー話今日 TLS 1. 3 IoT TLS 新ー話 woflssl ー専門技術ー IoT ー暗号技術 wolfssl Japan 本社米国世界各地専門 wolfssl ー世界最高水準製品提供 wolfssl Japan 一員日本客世界水準技術ー届 Internet Engineering Task Force (IETF) 安全存知通信通標準確保 TLS/SSL