Transcription

1

2

3 3 1 PC PC Unix FreeBSD VMplayer TCP/IP TCP/IP Wireshark Wireshark Wireshark I UTP MAC CSMA/CD ARP

4 4 4 II IP IP ICMP IP I IP Wireshark IP (2) CIDR VLAN VPN VPN VPN

5 ICMP ICMP ICMP ping traceroute TCP UDP TCP TCP PSH,URG PSH URG UDP Domain Name Service (DNS) telnet File Transfer Protocol(FTP) Secure SHell (SSH) SSH Network Time Protocol(NTP) Hyper Text Transfer Protocol(HTTP) Simple Mail Transfer Protocol(SMTP) Post Office Protocol(POP) Internet Message Access Protocol(IMAP) Network News Trasnfer Protocol(NNTP) Dynamic Host Configuration Protocol(DHCP) Common Internet File Service(CIFS) Lightweight Directory Access Protocol(LDAP)

6 ? DES Kerberos One Time Password (OTP) Prety Good Privacy(PGP) II GnuPG GnuPG GnuPG Mail

7

8

9 1 1 PC 1.1 IP 1.2 PC Windows ( OS ) PC PC VMware, QEMM, Xen, VirtualPC,VirtualBox VMware VMplayer ¼ zpcƒ\ ƒtƒg ƒq ƒxƒgos FreeBSD Windows Linux Windows PC PC OS( Windows) PC OS PC OS( OS ) PC PC OS PC OS OS

10 2 1 PC 1.3 Unix Unix OS OS Windows PC OS Unix Unix 1.1: VAX PDF11/40(1970 ) Dennis Richie( ) Ken Thompson (UNIX Thompson B Richie C ) PDP-11 ( Yet another PDF-11 page

11 1.4. FreeBSD FreeBSD FreeBSD Unix 20 TCP/IP OS BSD Berkeley Software Distribution (UCB) BSD AT&T Unix AT&T 4.4BSD-Lite BSD-Lite BSD OS FreeBSD 4.4BSD-Lite Unix Linux Unix OS (Linus Torvalds) 1991 BSD OS 1997 ( history-simple.png ) VM

12 4 1 PC VM j09xx Lhaplus CD-ROM FreeBSD-09.lzh VM/j09xx CD-ROM VM Properties VM/j08xx FreeBSD VMplayer 1 VM 2 VMplayer FreeBSD OK PC

13 FreeBSD 3 PC ( PC Windows Ctrl + ALT Windows ) 4 login: root password freebsd 5 startx Unix X-window GUI MS-Windows fvwm2

14 6 1 PC 1.6 X-window Firefox, kterm, gedit, Wireshark, thunderbird firefox, thunderbird, gedit fvwm2 Yes, Really Quit X-window ( ) X-window startx X-window 1.7 ( )

15 CUI ( 16 ) 2 GUI Windows Unix Windows PC FreeBSD Wireshark Wireshark 6 Wireshark Wireshark OK root Wireshark 7 Capture Options... ( )

16 8 1 PC Interface: VMplayer lnc0 PC ( 2 ) Caputre Capture Filter: ( ) ( ) 2 Display Options Update list of packets in real time Automatic scrolling in live capture Start 8 Capture Options Start ( ) Source IP IP Mac

17 Destination Protocol Info Capture Stop 2

18 10 1 PC 10 Capture Options ( ) Capture Filter: port 80 Start Continue without Saving 12 Continue without Saving 7 Firefox 13 Firefox Firefox Firefox Google Wireshark

19 URL Google Frame 2 Etherinet II 3 Internet Protocol IP IP 4 Transmission Control Protocol(TCP) TCP 5 Hypertext Transfer Protocol(HTTP HTTP VMPlayer X VM FreeBSD

20 12 1 PC 14 VMPlayer X FreeBSD kterm # shutdown -p now FreeBSD VMplayer

21 13 2 TCP/IP 2.1 (DOD) (DARPA) ARPANET ARPANET DARPA 60 ARPANET ( 68) 61 62, 63 ARPANET (UCLA, UCSB, ) 73 ( ) TCP/IP ( ARPANET CSNET 81 ARPANET ) 82 TCP/IP BSD TCP/IP Unix ( NCP 83 TCP/IP Internet ) Unix TCP/IP IPv6 TCP/IP ARPANET 90 ARPANET ( 89) CERN WWW 93 Mosaic WWW

22 14 2 TCP/IP 1957 ARPA 1961 L.Kleinrock, 1962 J.C.R.Licklider & W.Clark, 1963 P.Baran, 1968 ARPANET 1969 ARPANET 50Kbps 1970 ALOHA system( ) ARPANET mail PaloAlto, Ethernet (CSMA/CD 3Mbps) 1973 V.Cerf & B.Kahn, TCP 1974 TCP 1978 TCP/IP 1982 TCP/IP Internet BSD TCP/IP 1983 ARPANET TCP/IP 1984 DNS ,000 Internet 1991 WWW (CERN) ,000, InterNIC 1993 (Mosaic) WWW 341, Java,RealAudio, Internet TCP/IP TCP/IP ( )

23 i-mode Web IP TCP/IP TCP/IP TCP/IP 1. Transmission Control Protocol (TCP) 2. User Datagram Protocol (UDP) 3. Internet Control Message Protocol (ICMP) 4. Address Resolution Protocol (ARP) 5. Reverse Address Resolution Protocol (RARP) TCP/IP 2.3 TCP/IP ( )

24 16 2 TCP/IP ( ) IP IPv4 IPv6 ( ) ( ) ( ) ( ) TCP/IP 2.4 PC

25 OSI TCP/IP (ISO) (Open System Interconnect Reference Model: OSI model) OSI 7 OSI OSI TCP/IP OSI OSI TCP/IP OSI OSI TCP/IP OSI TCP/IP OSI TCP/IP TCP/IP OSI OSI TCP/IP OSI OSI (...) TCP/IP OSI TCP/IP ARP RARP TCP/IP OSI

26 18 2 TCP/IP ( ) TCP/IP TCP/IP OSI 1. ( ) 2. Ethernet( ) MAC ( ) IP ARP IP RARP (ARP RARP IP X IP ) 3. IP (Internet Protocol) IP IP IP IP IP ICMP (Internet Control Message Protocol) 4. ( ) TCP UDP TCP TCP UDP TCP UDP

27 TCP/IP berkley TCP/IP Web HTTP(Hyper Text Transfer Protocol) SMTP(Simple Mail Transfer Protocol) 2.5 API ( ) aplication ƒf [ƒ^ ƒgƒ ƒ ƒxƒ [ƒg w ƒwƒbƒ_ ƒf [ƒ^ ƒlƒbƒgƒ [ƒn w ƒwƒbƒ_ ƒf [ƒ^ ƒf [ƒ^ƒšƒ ƒn w ƒwƒbƒ_ ƒf [ƒ^ w ƒwƒbƒ_ ƒf [ƒ^ CRCƒ`ƒFƒbƒN ŠK w ƃf [ƒ^ Eƒwƒbƒ_ ÌŠÖŒW (

28 20 2 TCP/IP ) TCP/IP ƒgƒ ƒ ƒxƒ [ƒg w ƒlƒbƒgƒ [ƒn w TCP UDP IP Apple Talk ƒf [ƒ^ƒšƒ ƒn w Ethernet w ½ d» ÆŠK w ( ) ( ) MPLS (MultiProtocol Label Switching) ƒšƒ ƒn w ƒw ƒb ƒ_ ƒvƒ ƒ ƒxƒ ƒw ƒb ƒ_ IPƒwƒbƒ_ IPƒyƒCƒ [ƒh TCP/IP TCP/IP

29 TCP/IP Wireshark TCP/IP ( ) 16 MS-Windows ( Unix ) ( ) Unix OS GUI Unix tcpdump [ ] Wireshark Ethereal Wireshark ( ) Wireshark IP Windows NT,2000,XP ipconfig /all

30 22 2 TCP/IP Unix ( Kterm) ifconfig # ifconfig lnc0: flags=8843<up,broadcast,running,simplex,multicast> metric 0 mtu 1500 options=9b<rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum> ether 00:10:18:01:55:e5 inet netmask 0xffffff00 broadcast media: Ethernet autoselect (100baseTX <full-duplex>) status: active lo0: flags=8049<up,loopback,running,multicast> metric 0 mtu inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 inet6 ::1 prefixlen 128 inet netmask 0xff IP lnc IP IP Wireshark Capture Options

31 Start ( Capture Start ) Capture Filter IP host Filter host and host (and host host ) host or host host [my IP] Start ( Stop )

32 24 2 TCP/IP Wireshark Wireshark (Source) ( Destination) (Protocol: TCP,UDP HTTP ) HTTP( TCP) HTTP GET Frame, Ethernet, IP, TCP, HTTP +

33 ( ) Wireshark ( Capture Stop Ctrl + E ) Wireshark Capture Options de Options Capture Filter: IP host ( ) Save capture file before starting a new capture? Continue without Saving ( ) URL URL URL Uniform Resource Locator URL (resource= )

34 26 2 TCP/IP Wireshark Wireshark IP IP IP Protocol TCP HTTP (, ) Info [FIN, ACK] Internet Protocol 16 2

35 27 3 I TCP/IP OSI IEEE802.3( ) TCP/IP TCP/IP ( ) ( ) 10Mbps 10BASE-5 10BASE-2 (1cm) (5mm) RG-58 10BASE-T UTP ( ) 10BASE-5 10BASE-2 ( ) ( )

36 28 3 I UTP (Unshealded Twist Pair cable) UTP 10BASE-T 10Mbps 3 (Cat.3) 100BASE-TP 100Mbps 5 (Cat.5) 1000BASE-T 1000Mbps 5 (enhanced Cat.5) 100Base 3 100Mbps UTP5 UTP (Cat.5 ) 100BASE BASE

37 ( 50UTP UTP (Unshealded) ( ) UTP ( ) ( ) 12.5mm

38 30 3 I ( 0.5 ) ( ) UTP UTP ( ) UTP ( AUTO-MDI/MDIX 3 UTP UTP RJ-45 ( ) RJ-45 8 UTP

39 ,100Base (TIA/EIA-568B) 1 (+) White( pair of Orange ) 2 (-) Orange 3 (+) White( pair of Green ) 4 None Blue 5 None White( pair of Blue ) 6 (-) Green 7 None White( pair of Brown ) 8 None Brown 1000BaseT (TIA/EIA-568A Green pair Orange pair ) A B AT&T TIA/EIA-568B ( )

40 32 3 I BASE-FX 100Mbps, 412,2000,20000m 1000BASE-SX 1000Mbps 550m 1000BASE-LX 1000Mbps 5Km 100BaseFX 100BaseTX 1000Base SX LX SX LX SX

41 3.1. 物理層 33 長が短いために マルチモードと呼ばれる光ファイバーケーブルしか利用出来ません 一方 LX はそれよ りも長い波長の光を用い 原理的にはマルチモード光ファイバーケーブルも使えますが (この場合には最大 伝送距離は 550m になります) あまり意味はないでしょう この光ケーブルの違いは 光が走るコアと呼 ばれる中心にある媒体の径の太さにあります そして 径が太いものは光が屈折のために色々なモードが 混じることが避けられないためにマルチモードと呼ばれており 伝送到達距離は 550m と短くなりますが プラスチックなどを使って作ることが出来るために安価で 折り曲げなどに強いという性質があります 現在ではあまり使われていませんが ステップインデックスというタイプの光ケーブルもありました (音 声やビデオの短距離伝送に使われています) このような光ケーブルでは 図のように光はコアとクラッドの境界部分で 反射することによって伝播 するタイプですが 原理的に直線的に進むものと 反射して進むものでは道のりが異なるために (反射す ると長い距離を走ることになる) 出口で光の位相がずれてしまい (光も波の一種なので 道のりが異なる と 波の山や谷の位置がずれてしまう) 伝送品質が非常に悪くなってしまいます このような問題を解決したのが グレーデッドインデックスと呼ばれる光ファイバーで マルチモード で使われる光ケーブルは現在では全てこれが使われています グレーデッドインデックスでは コアの中心から離れるに従って徐々に屈折率を変えて作ってあり こ のために光は中心から離れていくものはゆっくりと曲げられて 再び中心を通る軌道へと戻るようになっ ています 更に こうした物質中での光の速度は屈折率によって異なるので それを利用して 遠回りし た光は早く進み 中心を直線的に進んだ光が少し遅く進むことで 二つの経路による位相のずれを非常に 小さく抑えています このことによって マルチモードはステップインデックスに対して伝送距離が長く なり 接合など取り扱いが楽なケーブルになっていますが ある程度の損失はやはりあるために 長距離 には利用できません いずれにせよ マルチモードのモードは光が走る経路のことであり 多くのモードが伝送に関与すると いう意味で マルチモードと呼ばれています マルチモードのケーブルとしては ガラス製では コア径が 50µm のものと 62.5µm のものが使われてい ます プラスチック製では コア径 120µm が利用されています 一方 光の波長としては 1000BASE-SX では 850nm の波長の光が利用されています 径の細いシングルモード光ファイバーは物理的に一つのモードの光のみを伝達するために 非常に損失 が少なく 超長距離の伝送が可能になっています これは極微の世界の物理法則について勉強しないと中々 理解しづらいのですが 言わばコアの径の太さが光の粒子の大きさぎりぎりに作ってあるために 反射も

42 34 3 I 1000BaseLX 5Km 10µm 1310nm (FTTH ) 10G µm 10 6 m = 0.001mm nm 10 9 m = 1000 µm FDDI 100M 100Base ATM 10G Base 10G

43 MAC MAC (Ethernet ) MAC 48bit(6byte) MAC 24bit(3byte) 24bit C 00000E Cisco Fujitsu Proteon 00AA00 Intel Com (Formerly Bridge) Hewlett-Packard Sun Sun machines Intel MAC 3byte : a-ed MAC 16 8bit 00:00:39:00:2f:04 Unix ifconfig MAC

44 36 3 I > ifconfig lnc0: flags=8843<up,broadcast,running,simplex,multicast> mtu 1500 options=3<rxcsum,txcsum> inet netmask 0xffffff00 broadcast ether 00:90:27:50:fa:1c media: Ethernet autoselect (100baseTX <full-duplex>) status: active Windows ipconfig MAC OS MAC MAC 01:00:5E:00:00:00 01:80:C2:00:00:00 09:00:4E:00:00:02 CF:00:00:00:00:00 FF:FF:FF:FF:FF:FF FF:FF:FF:FF:FF:FF FF:FF:FF:FF:FF:FF Internet Multicast [RFC1112] Spanning tree (for bridges) Novell IPX Ethernet Configuration Test protocol (Loopback) IP (e.g. RWHOD via UDP) as needed ARP (for IP and CHAOS) as needed EtherTalk MAC TYPE field MAC 0 1 MAC bit 1 Ether CSMA/CD Ethernet Ethernet

45 CSMA/CD (Carrier Sense Multiple Access with Collision Detection) Ethernet CSMA/CD (Carrier Sense) Ethernet (Collision Detection) Multiple Access CSMA/CD Ethernet 30% 50% CSMA/CD TokenRing FDDI CDMA/CD ( ) (

46 38 3 I CSMA/CD 100M Ether 100M Ether Gigabit Ether ARP MAC MAC MAC MAC MAC MAC ARP( Address Resolution Protocol) ARP ( ) ARP Ethernet MAC (ARP ) IP IP ARP MAC IP ARP Unix Windows arp

47 > arp -a -n? ( ) at 00:00:39:0e:08:04 on lnc0 [ethernet]? ( ) at 00:90:cc:22:00:3a on lnc0 permanent [ethernet]? ( ) at 00:00:0c:04:df:01 on lnc0 [ethernet] -a ARP -n IP Windows -n ARP MAC? ( ) at (incomplete) on lnc0 [ethernet] IP IP

48 40 3 I VMplayer vmx ( ) notepad ethernet0.connectiontype = "nat" ethernet0.connectiontype = "bridged" ( ) VMplayer # ifconfig... inet netmask 0xffff0000 broadcast inet IP x.y (x,y ) 3.2 FreeBSD MAC 2 MAC IP Wireshark ping # ping ( IP ) ping ARP IP ARP MAC MAC

49 41 4 II IP MAC IP Anon IP A,MAC a Blue ( IP B, MAC b ) Anon Blue Router IP: Rx MAC: rx ƒ [ƒ^ IP: Ry MAC: ry Host: Anon IP: A MAC: a Host: Blue IP: B MAC: b Annon IP A IP B IP Annon Router(IP Rx) Annon Router (IP Rx) ( DHCP Router IP Rx IP A

50 42 4 II Router Blue ARP Router MAC rx IP Blue B MAC Router MAC rx Router MAC Router Blue (IP B) Router ( ) Blue ( ) ARP MAC b Blue Annon Unix Windows ( Windows2000 XP IP (IP forwarding) ( ) Router ( ) Unix Windows ( ) > netstat -rn Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default UGSc 4 68 nge /24 link#1 UC 3 0 nge :00:39:00:00:01 UHLW nge :90:cc:01:c0:11 UHLW lo :00:0c:02:d0:21 UHLW 5 3 nge UH lo0 Unix default IP IP IPv4 32bit IPv4 IP 8bit

51 IPv bit 00,01,10,11 ( ) bit = 2 2 (2 10 ) = = 40 ( 2 10 = ) IP IP IPv4 IP 256 IP IPv4 ( ) CC IP 1 US 1,246,274, % 2 JP 103,830, % 3 CA 62,013, % 4 GB 50,894, % 5 DE 48,699, % 6 FR 37,210, % 7 CN 30,719, % 169 SR 1, % 173 BZ % 173 GD % 173 NE % 173 SZ % 173 TO % 345, % 1,858,318, %

52 44 4 II NIC IPv4 ( ) 1 US 1,445,547, % 2 167,045, % 3 149,272, % 4 EU 120,298, % 5 86,213, % 6 78,563, % 7 73,655, % 1 IP IT 7 JPNIC(IP ) IPv4 IPv ICANN IP 4 APNIC(JPNIC ) ISP IP IPv4 IPv6 IP 128bit IPv = (2 32 ) 4 ( ) 4 = IPv ( 340 ( ) ) 1m 2 IP IP AV IP ID(RFID) IP IP IP

53 OS DNS IP IPv4 IP bit 1 bit ICMP ICMP(Internet Control Messaging Protocol) ICMP

54 46 4 II ( ) ( ) ( ) ( IE Netscape) 1. P2P (P2P) P2P P2P IP 2 IP IP ( ) 0 IP IP IP IP Well-Known port address Unix /etc/services /etc/services

55 ftp-data 20/tcp #File Transfer [Default Data] ftp-data 20/udp #File Transfer [Default Data] ftp 21/tcp #File Transfer [Control] ftp 21/udp #File Transfer [Control] ssh 22/tcp #Secure Shell Login telnet 23/tcp smtp 25/tcp mail #Simple Mail Transfer... http 80/tcp www www-http #World Wide Web HTTP /etc/services http 80 IP 80 OS IP ICMP TCP(Transmission Control Protocol) TCP UDP(User Datagram Protocol) UDP TCP,UDP 4.3 TCP/IP TCP/IP

56 48 4 II HTTP (Hyper Text Transfer Protocol) SMTP (Simple Mail Transfer Protocol)

57 Wireshark Wireshark Capture Options Filter port 80 MAC MAC IP arp -a 4.2 FreeBSD Capture Options Filter IP 5 URL IP DNS ( ) DNS (query) (response) DNS IP ( IP ) IP DNS IP DNS

58

59 51 5 IP I TCP/IP 5.1 IP ARP MAC ARP IP IP IP ( ) (ID ) IP IPv4( ) IP IP IPv6 IPv6 IP IPv6 IPv IPv4 ( ) IP ( ). ( ) ( ) A 8 bit (1byte) 24 bit (3byte) B 16bit (2byte) 16 bit (2byte) C 24bit (3byte) 8 bit (1byte) IPv4 32bit 8bit 24bit IP

60 52 5 IP I ( ) IPv4 IP IP 0 A 10 B 110 C 1110 D 1111 E ( ) 4bit IP 0 1 IP 0 A B , B C IP ( ) A C IP

61 5.1. IP 53 A A A B B (10) B C C (110) C C 256 IP IP D D (1110) D A B ( ) IP

62 54 5 IP I ( ).{ ( ). ( ) } B B C 24bit 8bit 8bit 24bit /24 IP ( ) B ( 256 ) / / / / /24 8bit /24 8bit bit 5bit ( 32 )

63 5.1. IP / / / / / / / /27 4byte 4byte 3bit (000), (001), (010), (011), (100), (101), (110), (111) ( ) 5bit (000) + (0 0000) = ( ) = 0 (001) + (0 0000) = ( ) = 32 (010) + (0 0000) = ( ) = 64 (011) + (0 0000) = ( ) = 96 (100) + (0 0000) = ( ) = 128 (101) + (0 0000) = ( ) = 160 (110) + (0 0000) = ( ) = 192 (111) + (0 0000) = ( ) = n 2 n 1 ( ) = = 224 IPv /27 /27 Unix B 256 netmask /24 (netmask OS ) netmask netmask netmask

64 56 5 IP I (netmask) IP ( ) IP ( ) /24 24bit IP & & 1 & 1 = 1, 1 & 0 = 0, 0 & 1 = 0, 0 & 0 = (1010) (1010) & (1100) = (1000) IP 2byte bit ( & ( ).( ) = 4.0 ( ) 8bit & = 4.0 IP byte(24bit) & = bit /27 27bit bit 24bit bit ( ) (224 ) bit & = / netmask

65 5.2. Wireshark 57 (netmask OS ) netmask netmask netmask netmask IP ( ) IP (IP crisis) IP ( ) RIP,OSPF BGP 5.2 Wireshark Wireshark Capture Options Capture Filter DNS IP dst host src host host host ip, arp, rarp

66 58 5 IP I gateway gateway dst net src net net dst port TCP/UDP src port TCP/UDP port TCP/UDP ether broadcast ether ip broadcast IP all 1 all ! not && and AND or OR ( ) (

67 5.2. Wireshark src host pca1 and src port 23 pca1 src host pca1 or src host pcb1 pca1 pcb1 src host pca1 and dst host pcb1 pca1 pcb1 host pca1 and host pcb1 pca1 pcb1 not ( host pca1 and host pcb1 ) pca1 pcb1

68 60 5 IP I IP , , , IP (1) (2) (3) IP 3 ( ) port 80

69 61 6 IP (2) 6.1 CIDR IPv4 Classless InterDomain Routing(CIDR) CIDR IP 4 C ( ) > > > > byte 96,97,98,99 96 = ( ) 97 = ( ) 98 = ( ) 99 = ( ) 96 = = bit ( ) 2bit 4 96/6 ( ( ) 96 ) 4 ( 16bit 6bit ) /22 ->

70 62 6 IP (2) CIDR IP A B CIDR / / / / / byte ( )/ ( )/ ( )/ ( )/27 /32 /0 IP / bit 4byte 3bit (110) (111) ( IP (000) (101) ) / / / /27, /27, /27, / / /27, /27, / /27 IP IP NAT (Network Address Translation) NAPT (Network Address and Port Translation) 6.2 IP

71 / / /16 NAT(NAPT)

72 64 6 IP (2) / /12 IP /

73 65 7 TCP/IP m BaseTX 100BaseFX( ) 100m B 100BaseTX MAC MAC

74 66 7 ƒu ƒšƒbƒw ( ) ASIC ASIC Application Specific Integrated Circuit CPU DSP LSI ASIC ASIC ƒxƒcƒbƒ` A B C D A,BŠÔ Ì Ê M ÆC,DŠÔ Í Æ

75 ( FDDI ATM ) Ethernet Ethernet L2 SNMP (Simple Network Management Protocol) L2 VLAN(Virtual LAN: ) L2 (Layer2) ASIC L IP CPU ASIC L2 L3

76 68 7 IPv

77 FDDI FDDI Ethernet ( ) ( )

78 70 7 s Ê L3 L3 L

79 /24 A B C D L2 L3 ƒ [ƒ^ /24 A B C D /24 E F G H

80 72 7 L2 VLAN L2 PC ( ) L VLAN VLAN (Virtual LAN) A B C D E F G H / /24 A E C G B F /24

81 VLAN Layer2 ( tagging VLAN ) VLAN VLAN VLAN VLAN VLAN VLAN VLAN VLAN VLAN VLAN L3 L2 VLAN L 3 (Link Aggregation ) L3 L2 VLAN L3 L2 VLAN A B C D E F G H

82 74 7 ( ) ( ) (STP) STP STP ( ) STP A B C D E F G H STP Å Ø f ášq A B C D E F G H STP Å Ø f µ È

83 STP (RSTP: Rapid STP) STP VLAN STP MSTP(Multiple STP) (MSTP VLAN ) MSTP Cisco PVST(Per VLAN STp) ( ) ( RIP(Routing Information Protocol),OSPF(Open Shortest Path Fast), BGP4(Border Gateway Protocol v4) RIP OSPF RIP RIP RIP ( 15 ) RIP RIP OS OSPF RIP OSPF ( ) OSPF

84 76 7 RIP 15 CPU RIP OSPF BGP4 BGP RIP OSPF BGP RIP RIP RIP BGP RIP BGP OSPF BGP RIP IP IP IP IP IP IP IP VRRP(Virtual Router Redundancy Protocol) Cisco HSRP(Hot Standby Routing Protocol)

85 7.4. VPN ð ¼ æ é ̃ [ƒ^ ªŒÌ á ð ¼ æ é 7.4 VPN VPN (Virtual Private Network) VPN B VPN VPN TCP/IP SSL/TLS SSL/TSL SSL/TSL IPsec OpenVPN IP in IP

86 78 7 VPN VPN OpenVPN, SoftEther, PacketiX L2 VPN VPN VPN ( L3VPN L2VPN ) L3VPN IP L3VPN L2VPN L3VPN IP L2VPN MAC MAC

87 BaseTX BaseTX L2 L3 10GBASE- LR(10GigabitEther ) A,B,C D A,B,C,D 150m ( ) L3 2 10G 4 Gigabit L2 10G 2 Gigabit 24 L3,L2 10G PowerPoint 10G Gigabit Ethernet L3 L3SW ,000,000 L3 L3SW ,800,000 L2 L2SW , m 1,000, m 50,000

88

89 81 8 ICMP ICMP TCP/IP IP ( ICMP(Internet Control Message Protocol) 8.1 ICMP IP TCP ICMP (Internet Control Message Protocol) ICMP ( ) ICMP ICMP ICMP ICMP 1byte type message 0 Echo Reply 3 Host Unreacheable 4 Source Quench 5 Redirect 8 Echo 9 Router Advertisement 10 Router Solicitation 11 Time Exceeded 12 Parameter Problem 13 Time Stamp 14 Time Stamp Reply 15 Information Request 16 Information Reply 17 Address Mask Request 18 Address Mask Reply

90 82 8 ICMP Echo, Echo Reply Echo Reply Host Unreachable Source Quench Redirect Router Solicitation, Router Advertisement Time Exceeded TTL(Time To Live) 0 Fragmentation ( TTL ) Parameter Problem Time Stamp, Time Stamp Reply Information Request, Information Reply IP Information Reply Address Mask Request, Address Mask Reply ( ) type 3(Host Unreachable), type 11(Time Exceeded) TTL(Time To Live) IP 1 0 ICMP type 11 3 Host Unreacheable IP Host Unreachable ( ICMP 2byte )

91 8.1. ICMP code 0 code 3 type 11 type 3 ICMP IP 64bit ( TCP UDP ) ICMP ICMP RFC792 RFC RFC Request For Comments RFC RFC IETF(Internet Engineering Task Force : TCP UDP IP IDS( ) MTU MTU MTU ICMP unreachable Type4 ICMP MTU ( ICMP MTU ) MTU TCP MSS( ) ICMP ICMP icmp Filter: icmp Apply( ) Filter option ( Display Filter Wireshark )

92 84 8 ICMP ping ping Unix Windows ping ICMP Echo Request Echo reply Echo Request ping 20% ( ) IP ping 0% > ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=254 time=0.270 ms 64 bytes from : icmp_seq=1 ttl=254 time=0.201 ms 64 bytes from : icmp_seq=2 ttl=254 time=0.189 ms 64 bytes from : icmp_seq=3 ttl=254 time=0.192 ms 64 bytes from : icmp_seq=4 ttl=254 time=0.173 ms 64 bytes from : icmp_seq=5 ttl=254 time=0.188 ms 64 bytes from : icmp_seq=6 ttl=254 time=0.202 ms 64 bytes from : icmp_seq=7 ttl=254 time=0.194 ms ^C ping statistics packets transmitted, 8 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.173/0.201/0.270/0.027 ms ping

93 > ping PING ( ): 56 data bytes 64 bytes from : icmp_seq=0 ttl=245 time= ms 64 bytes from : icmp_seq=1 ttl=245 time= ms 64 bytes from : icmp_seq=2 ttl=245 time= ms 64 bytes from : icmp_seq=3 ttl=245 time= ms 64 bytes from : icmp_seq=4 ttl=245 time= ms 64 bytes from : icmp_seq=5 ttl=245 time= ms 64 bytes from : icmp_seq=6 ttl=245 time= ms 64 bytes from : icmp_seq=7 ttl=245 time= ms 64 bytes from : icmp_seq=8 ttl=245 time= ms 64 bytes from : icmp_seq=9 ttl=245 time= ms 64 bytes from : icmp_seq=10 ttl=245 time= ms 64 bytes from : icmp_seq=11 ttl=245 time= ms ^C ping statistics packets transmitted, 12 packets received, 0% packet loss round-trip min/avg/max/stddev = /44.915/ / ms ICMP ICMP ICMP ECHO(,Reply) ICMP traceroute ping traceroute Windows tracert traceroute IP TTL(Time To Live) TTL ( ICMP ) TTL 1 TTL 0 ICMP type 11(Time Exceeded) ICMP IP TTL traceroute

94 86 8 ICMP > traceroute -n traceroute to ( ), 64 hops max, 44 byte packets ms ms ms x ms ms ms 3 10.x.0.x ms ms ms x.x ms ms ms x.x ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ( -n IP ) traceroute ( ) traceroute TTL traceroute traceroute traceroute Unix traceroute UDP Windows tracert ICMP Echo

95 guru.it.matsue-ct.jp ( ) ping Wireshark ping echo request Sequence number ( ) ID(Identifier) Echo request 10 Sequence number ID 8.2 traceroute traceroute UDP 8.3 ICMP traceroute ICMP type code

96

97 89 9 TCP UDP 9.1 TCP,UDP IP TCP/UDP IP Well Known( : ) IANA (Internet Assigned Numbers Authority) ( RFC ) well known port ( ) registered port ( ) private port ( ) well known port IETF 1024 well known root Unix /etc/services

98 90 9 TCP UDP ftp-data 20/tcp #File Transfer [Default Data] ftp-data 20/udp #File Transfer [Default Data] ftp 21/tcp #File Transfer [Control] ftp 21/udp #File Transfer [Control] ssh 22/tcp #Secure Shell Login ssh 22/udp #Secure Shell Login telnet telnet 23/tcp 23/udp # 24/tcp any private mail system # 24/udp any private mail system smtp 25/tcp mail #Simple Mail Transfer smtp 25/udp mail #Simple Mail Transfer # FTP (TCP,UDP TCP ) SSH(Secure SHell) 22 telnet 23 SMTP(Simple Mail Transfer Protocol) 25 UDP UDP domain 53/tcp #Domain Name Server bootps 67/udp dhcps #Bootstrap Protocol Server bootpc 68/udp dhcpc #Bootstrap Protocol Client http 80/tcp www www-http #World Wide Web HTTP pop3 110/tcp #Post Office Protocol - Version 3 nntp 119/tcp usenet #Network News Transfer Protocol ntp 123/tcp #Network Time Protocol netbios-ns 137/tcp #NETBIOS Name Service netbios-dgm 138/tcp #NETBIOS Datagram Service netbios-ssn 139/tcp #NETBIOS Session Service imap 143/tcp imap2 imap4 #Interim Mail Access Protocol v2 snmp 161/tcp snmptrap 162/tcp snmp-trap ldap 389/tcp #Lightweight Directory Access Protocol https 443/tcp smtps 465/tcp #smtp protocol over TLS/SSL (was ssmtp) rtsp 554/tcp #Real Time Stream Control Protocol ldaps 636/tcp sldap #ldap protocol over TLS/SSL imaps 993/tcp # imap4 protocol over TLS/SSL pop3s 995/tcp spop3 # pop3 protocol over TLS/SSL IANA /etc/services 443 https HTTP(Hyper Text Trasnfer Protocol: WWW )

99 9.2. TCP 91 HTTP over TLS/SSL TLS/SSL well known registered port private IP, TCP,UDP TCP UDP ( ) IP A Port X TCP IP B Port Y IP A Port X UDP IP B Port Y 9.2 TCP TCP (Transmission Control Protocl) TCP TCP Ethereal

100 92 9 TCP UDP TCP ( IP ) TCP sequence number( ) 1byte 50byte ( )

101 9.2. TCP 93 Wireshark (relative sequence number) 0 16 (93a7 976c) Wireshark 0 Wireshark ack(acknowlegement: )

102 94 9 TCP UDP ack ( ) 1099 ack ACK ACK TCP TCP ( ) SYN SYN,ACK ACK (2 SYN,ACK ) 3 SYN SYN,ACK ACK TCP

103 9.2. TCP 95 SYN ACK FIN PSH URG RST 1 SYN RST SYN 6bit 8bit TCP 2bit ( ) OS ACK FIN,ACK FIN,ACK ACK FIN ACK ACK TCP SYN ACK Web

104 96 9 TCP UDP TCP TCP TCP ( 20byte ) 0 31 Mƒ [ƒg Ô ˆ æƒ [ƒg Ô Ô Žó MŠm F Ô ƒiƒt ƒzƒbƒg \ ñ Œä ƒeƒbƒ ƒhƒe ƒ`ƒfƒbƒnƒt ƒ ƒiƒv ƒvƒ ƒ UR Gƒ ƒc ƒ ƒ^ ƒpƒf ƒbƒ ƒo (2byte) (2byte) (2byte) (4byte) TCP (4byte ) (4bit) URG (4byte) ( 0) (6bit) URG,ACK,PSH,RST,SYN,FIN (6bit) ACK (2byte) 0 (2byte) URG (2byte) ( 1byte, 1byte, ) 4byte PSH,URG TCP SYN,FIN,ACK RST PSH URG PSH TCP/IP (

105 9.2. TCP 97 ) 1byte telnet telnet PSH(push) k a n a y a m URG URG(Urgent: ) Break URG ƒf [ƒ^ ò Ñ z

106 98 9 TCP UDP 9.3 UDP UDP (User Datagram Protocol) TCP (connectionless) TCP UDP UDP ( ) DNS IPv4 NAT TCP UDP 0 31 Mƒ [ƒg Ô ƒf [ƒ^ ˆ æƒ [ƒg Ô ƒ`ƒfƒbƒnƒtƒ

107 Wireshark Web 3-way handshake ( ) ( (relative sequence number) ack 3-way handshake 3 1

108

109 DNS telnet SSH FTP WWW POP IMAP NTP NNTP DHCP CIFS NFS LDAP IP (HTTP) IP TCP 10.2 Domain Name Service (DNS) IP IP ( ) DNS DNS IP

110 ( ) matsue-ct.ac.jp matsue-ct.ac.jp..( ) jp ac matsue-ct DNS DNS DNS jp. com. DNS jp. ac.jp. matsue-ct.ac.jp. IP DNS DNS ( FQDN (Full Qualified Domain Name) DNS DNS DNS IP DNS DHCP IPv6.( ピリオッド ) com. jp. fr. ne.jp. ac.jp. co.jp. go.jp. matsue-ct.ac.jp. shimane.ac.jp. DNS IP DNS ( CIDR ) DNS 53 DNS (query ) UDP

111 10.3. telnet telnet telnet telnet telnet SSH telnet telnet telnet 23 telnet telnet 80 (HTTP) HTTP GET

112 telnet 80 Trying Connected to Escape character is ^]. GET /index.html <?xml version="1.0" encoding="shift_jis"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" " <html xmlns=" lang="ja" xml:lang="ja">... ( ) Unix ( ) inetd inetd /etc/inetd.conf Unix DNS inetd inetd inetd telnet telnetd ftpd 10.4 File Transfer Protocol(FTP) FTP FTP FTP WWW ftp:// FTP FTP 21 ( ) NAT NAT NAT NAT FTP

113 10.5. Secure SHell (SSH) 105 ƒnƒ ƒcƒaƒ ƒg ƒt [ƒo FTP control 21 FTP data 20 FTP ftp 10.5 Secure SHell (SSH) SSH Unix telnet FTP sftp(secure FTP) VPN (Virtual Private Network)

114 telnet telnetd mail imap client ˆÃ ñ ü sendmail imapd server SSH SMTP POP,IMAP telnet SSH VPN VPN VPN SoftEther TCP,UDP SSH VPN IPsec IPsec SSH SSH(Secure SHell) FreeBSD Fsecure SSH OpenSSH SSH

115 10.5. Secure SHell (SSH) 107 > ssh Enter passphrase for key /home/kanayama/.ssh/id_rsa : Password: Last login: Thu May 27 13:34: from Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 7.1-RELEASE-p9 (GENERIC) #0: Tue Dec 8 18:09:12 JST > ( passphrase ) (Password) 3 > ssh kanayama@stu.cc.matsue-ct.jp Enter passphrase for key /home/kanayama/.ssh/id_rsa : Password: Password: Password: Permission denied (publickey,keyboard-interactive). SSH SSH % mkdir ~/.ssh % ls -ld ~/.ssh drwxr-xr-x 2 kanayama staff :04 /home/kanayama/.ssh/ FreeBSD ssh-keygen

116 %ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/home/kanayama/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/kanayama/.ssh/id_rsa. Your public key has been saved in /home/kanayama/.ssh/id_rsa.pub. The key fingerprint is: d5:7e:39:97:18:a1:dd:ea:5f:f7:2c:ff:90:2a:bd:47 ~/.ssh/id_rsa.pub (RSA2 ) ~/.ssh/id_rsa (RSA2) 2 ( ) (16 ) passphrase too short: have 4 byetes, need > 4 Saving the key failed: /home/kanayama/id_rsa ~/.ssh/authorized_keys sftp(ssh ftp) ~/.ssh id_rsa.pub authorized_keys

117 10.5. Secure SHell (SSH) 109 > cd ~/.ssh > sftp sftp> mkdir.ssh sftp> cd.ssh sftp> put id_rsa.pub authorized_keys sftp> ls -l -rw-r--r-- 1 kanayama j-staff 6021 Jun 21 14:03 authrized_keys sftp> sftp> quit (pathphrase) > ssh kanayama@stu.cc.matsue-ct.jp The authenticity of host stu can t be established. RSA key fingerprint is 0a:c0:43:fe:4f:ab:72:b4:51:e1:f0:08:81:f6:4c:a7. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added stu (RSA) to the list of known hosts. Enter passphrase for RSA key /home/kanayama/.ssh/id_rsa : SSH rsh yes telnet ~/.ssh/known_hosts ) > ssh -2 kanayama@stu.cc.matsue-ct.jp DNS SSH ~/.ssh/known_hosts known hosts

118 stu.cc.matsue-ct.jp ssh-rsa XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXX XXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== 10.6 Network Time Protocol(NTP) NTP GPS stratum 1 stratum 2 ( ) NTP NTP stratum1,2 DNS pool.ntp.org NTP NTP NiCT( ) ( # NICT # ntp.nict.jp( ) server NiCT server server server server ( ntp.nict.jp DNS IP ) NTP NTP (stratum2,3) stratum1 GPS NTP 1 123

119 10.7. Hyper Text Transfer Protocol(HTTP) Hyper Text Transfer Protocol(HTTP) HTTP cgi URL(Unified Resource Location) URL HTTP / telnet > telnet 80 Trying Connected to Escape character is ^]. GET / HTML (Hyper Text Markup Language ) HTTP GET / HTTP/1.1\r\n HOST: USER-Agent: Mozilla/5.x (Windows; U; Windows NT 5.0; ja-jp;...)...\r\n Accept: application/x-shockwave-flash,text/xml,application/xml,...\r\n Accept-Language: ja,en-us;q=0.7,en;q=0.3\r\n Accept-Encodeing: gzip,deflate,compress;q=0.9\r\n Accept-Charset: EUC-JP,utf-8;q=0.7,*;q=0.7\r\n Keep-Alive: 300\r\n Connection: keep-alive\r\n HTTP URL

120 Simple Mail Transfer Protocol(SMTP) SMTP SMTP SMTP POP IMAP SMTP SMTP > telnet stu.cc.matsue-ct.ac.jp 25 Trying Connected to stu.cc.matsue-ct.ac.jp Escape character is ^]. 220 stu.cc.matsue-ct.ac.jp ESMTP Sendmail; Mon, 7 Jun :41: (JST) helo mastue-ct.ac.jp 250 stu.cc.matsue-ct.ac.jp mail from:<kanayama@mastue-ct.jp> 250 <kanayama@matsue-ct.jp>... Sender ok rcpt to:<hoge@virtual.domain.jp> 250 <hoge@virtual.domain.jp>... Recipient ok data 354 Enter mail, end with. on a line by itself subject: test this is a test mail UAA18096 Message accepted for delivery quit 221 stu.cc.matsue-ct.ac.jp closing connection Connection closed by foreign host. SMTP kanayama@matsue-ct.jp hoge@virtual.domain.jp (subject:) test this is a mail. From To subject (body) ( )

121 10.9. Post Office Protocol(POP) 113 Received: from stu.cc.matsue-ct.ac.jp ([ ]) by pc2f002.dum.matsue-ct.ac.jp (R8/cf1.0) with ESMTP id f6u9c8k89707 for Mon, 30 Jul :38: (JST) (envelope-from Received: from by pc2f001.dum.matsue-ct.ac.jp (R8/cf1.0) with ESMTP id RAA01100 for Mon, 30 Jul :38: (JST) Date: Mon, 30 Jul :38: (JST) From: mytest Message-Id: To: Subject: test [ ] From To SMTP mail from rcpt to ( ) From To SMTP SMTP Received (Received SMTP 3 Received 3 SMTP ) 2 SMTP Received SMTP Received SMTP (Received ) Received (envelope-from) (for ) ( SMTP ) From To SMTP 10.9 Post Office Protocol(POP) SMTP Unix Unix POP POP

122 POP POP POP POP POP version3 110 TCP Internet Message Access Protocol(IMAP) POP IMAP IMAP POP ( ) IMAP CPU IMAP Network News Trasnfer Protocol(NNTP) NNTP ( blog ) NNTP SMTP Dynamic Host Configuration Protocol(DHCP) DHCP IP ( ) DNS DHCP DHCP IP DHCP (IP ) IP IP

123 Common Internet File Service(CIFS) 115 DHCP ( ) DHCP IP DHCP DHCP BOOTP BOOTP BOOTP DHCP IP MAC IP PC DHCP DHCP TCP/IP DHCP IP IPv6 IP DNS DHCP IPv6 DHCP IP ISC(Internet Software Consortium:DNS BIND ) DHCP DNS Common Internet File Service(CIFS) CIFS Microsoft ( ) Unix NFS(Network File System) CIFS Unix Samba Unix CIFS Sharity

124 CIFS NFS NFS Unix Samba Windows Lightweight Directory Access Protocol(LDAP) LDAP LDAP DNS HTTP API LDAP ( OpenLDAP SQL ) ( Unix NIS(Network Information Service)) LDAP MS-Windows ActiveDirectory LDAP LDAP LDAP 389 SSL/TLS RPC(Remote Procedure Call) Unix Windows HTTP WebDAV HTTP 80

125 Wireshark telnet stu (stu.matsue-ct.jp) FreeBSD -y # telnet -y stu.matsue-ct.jp telnet X-Window ( - ) 10.2 Wireshark ssh stu (stu.cc.matsue-ct.jp) ( ) 10.3 stu ssh ssh

126

127 ? (authentication) ID ( ) 2

128 ( ) K( ) K 1 ( ) K K 1 K 1 K K 1 K 1 ( ) K( )

129 K K 1 ( ) ( ) K = K 1 ( ) K( ) K( ) Unix DES (Deta Encryption Standard) AES(Adbanced Encryption Standard) Free Blowfish ( AES Rijndael (J.Daeman and V.Rijmen) ) K K 1 2 2

130 MŽÒ Žó MŽÒ ŒöŠJŒ BK ˆÃ» é Œ BP œ» A B BK B BP B A AK 2 RSA RSA ( Ronald Rivest, Adi Shamir, Len Adleman) RSA Rivest ( ) RSA RSA ( 1024bit 2048bit ) RSA AES ( VPN DES DES 3 3DES DES

131 VPN AES ) Unix ƒvƒxƒe ƒ ƒ [ƒu ½ ƒpƒxƒ [ƒh ç µ ½ ˆÃ»ƒpƒXƒ [ƒh ½ ƒpƒxƒ [ƒh ˆÃ»ƒpƒXƒ [ƒh ˆê v µ ½ È ç Î { l 3

132 DES DES DES DES 56bit 1bit DES DES Unix NIS ( ) 10 MD5 (Message Digest 5) SHA (Secure Hash Algorism) MD5 FreeBSD OpenBSD Kerberos Kerberos MIT( ) Athena Kerberos Windows Kerbros ( Kerberos ) Kerberos Kerberos (KDC) KDC

133 Kerberos version4 DES version5 Kerberos KDC KDC KDC KDC Kerberos Kerberos Kerberos One Time Password (OTP) OTP OTP OTP OTP OTP S/KEY, OPIE Prety Good Privacy(PGP) PGP PGP PGP PGP OpenPGP IDEA GNU GnuPG IDEA AES 3DES

134 ( ) ATM 11.4 TCP/IP ( ) VPN(Virtual Private Network) VPN A B X Y

135 Y Internet X private net B private net A A B P X X Y A B P X,Y X Y Y (A B ) B VPN IPsec IPsec(IP Securyt Protocol) VPN IPsec ( AH:Authentication Header) ( ESP: Encapsulating Security Payload) DES 3DES,IDEA Blowfish ( )

136 SSL SSL(Secure Socket Layer) SSL SSL SSL Netscape TLS/SSL SSL3.0 RFC2246 TLS1.0 TLS/SSL (SSL start TLS TLS ) SSH SSH(Secure SHell) 1000 SSH SSH

137 Score 85 ( HTTPS ) Hide Score byte MD5 SHA1 % ls -l test.txt -rw-r--r-- 1 kanayama staff :42 test.txt ls -l 1838byte 1byte (4 ) MD5 md5 SHA1 sha1 % md5 test.txt MD5 (test.txt) = 4a6be328f465b7d607a77413ad5868e4 % sha1 test.txt SHA1 (test.txt) = 622bb6d81b2de c27ef9ca95d304ba3504 =

138

139 II 12.1 GnuPG GnuPG GnuPG GnuPG FreeBSD # setenv PACKAGEROOT ftp:// # pkg_add -r gnupg... # pkg_add -r pinentry... # rehash GnuPG GnuPG GnuPG GnuPG # rehash # gpg Warning: using insecure memory! gpg: directory /home/test/.gnupg created gpg: new configuration file /home/test/.gnupg/gpg.conf created gpg: WARNING: options in /home/test/.gnupg/gpg.conf are not yet active during this run gpg: keyring /home/test/.gnupg/secring.gpg created gpg: keyring /home/test/.gnupg/pubring.gpg created gpg: Go ahead and type your message... Ctrl+C ^C gpg: signal Interrupt caught... exiting

140 II gpg:. gpg # gpg --gen-key GnuPG RSA 1 DSA and Elgamal 1 gpg (GnuPG) ; Copyright (C) 2009 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Warning: using insecure memory! Please select what kind of key you want: (1) DSA and Elgamal (default) (2) DSA (sign only) (5) RSA (sign only) Your selection? DSA 1024bit Elgamal bit 2048bit DSA keypair will have 1024 bits. ELG keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) ( ) Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0)

141 12.1. GnuPG 133 Key does not expire at all Is this correct? (y/n) y GnuPG needs to construct a user ID to identify your key. Real name: Noriyo Kanayama Noriyo Kanayama address: kanayama@matsue-ct.jp Comment: Prof. N.Kanayama USER-ID You selected this USER-ID: "Noriyo Kanayama (Prof. N.Kanayama) <kanayama@matsue-ct.jp>" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? OpenPGP Real Name USER-ID USER-ID kanayama@matsuect.jp USER o ( :Okay ) SSH X-Window 2 Enter passphrase Passphrase <OK> <Cancel>

142 II We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: /home/test/.gnupg/trustdb.gpg: trustdb created gpg: key 58AC4D3D marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u pub 1024D/58AC4D3D uid Key fingerprint = B CE97 57EB 7384 E845 30D6 58AC 4D3D sub 2048g/257A Noriyo Kanayama (Prof. N.Kanayama) <kanayama@matsue-ct.jp> ( JPNIC ) ( kanayama@matsue-ct.jp ) # gpg -a --export kanayama@matsue-ct.jp

143 12.1. GnuPG 135 Warning: using insecure memory! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v (FreeBSD) mqgibew4u2qrbacjxzjicxtefkizzozijbhiz+kj/kpbuoq4z7u/dbsl1arnfd1m m9tjof4dnzxfvfuayqvoue0v+vyhozonnjt0tux+aq9x2cypqk63cduactqnbbrk 5/G32Eoek+Guo0KkEDkgo5aFlvFBh0TnvjniAc0VgjlafIJ6VbQ6Tm9yaXlvIEth bmf5yw1hichqcm9mlibolkthbmf5yw1hksa8a2fuyxlhbwfabwf0c3vllwn0lmpw PohgBBMRAgAgBQJMOFNkAhsDBgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQ6EUw 1lisTT00IACfaDjf/izVspmshUse0phrHANgQXcAoIt3EU0n6vBkie8l43VJsPir hrccqzgppy8mps2p4vorb/zf7zcs6mt2wxftmhqr8ihqdd5y3ql5zuwr/xufrwl1 E+0UiEkEGBECAAkFAkw4U2QCGwwACgkQ6EUw1lisTT3eSACfWMJOLkI4VPhqHu2f zt7ann1oczean0pt3tadw2jn8qwe0mjby7rbejzi =LMS END PGP PUBLIC KEY BLOCK----- BEGIN END Enter ASCII-armord PGP key here: Submit this key to the keyserver! URL USER-ID ( ) Index: Verbose Index: Search String: kanayama Show OpenPGP "fingerprints" for keys Only return exact matches Do the search! Public Key Server Index kanayama Type bits /keyid Date User ID pub 1024D/A1802BF /07/10 Noriyo Kanayama (Prof. N.Kanayama) <kanayama@matsue-ct.jp> A1802BF0 ( )

144 II BEGIN END kanayama.pub # gpg --import kanayama.pub Warning: using insecure memory! gpg: key A1802BF0: public key "Noriyo Kanayama (Prof. N.Kanayama) <kanayama@matsue-ct.jp>" imported gpg: Total number processed: 1 gpg: imported: 1 kanayama %gpg --list-keys Warning: using insecure memory! /home/test/.gnupg/pubring.gpg pub 1024D/58AC4D3D uid sub 2048g/257A Noriyo Kanayama (Prof. N.Kanayama) <kanayama@matsue-ct.jp> pub 1024D/A1802BF uid test hogehoge (test User) <hogehoge@matsue-ct.jp> sub 2048g/E2E30DF ( ) # gpg -sa test test test.asc

145 12.1. GnuPG BEGIN PGP MESSAGE----- Version: GnuPG v (FreeBSD) owgbwmvmwctiexijvrbb+wpjmrykzuluvbqjvzkkeh8ln+sqjmxibsbkvchjls5r SMvMSVVIyy9SyE0tLk5MT1UozyzJUCjOTM9LLCktSlXIz1NwzysNcNfj4orML1XI LQXqKS5NKs3NLFEoARkF01eSr+Cbn5+SkwpUmVSp4JdflFmZr+CdmJdYmZibyNVh z8zkalif5jjbjtd4hvkrvh7c8asymv1+j0relvkefgz66a/dppxvgjtj9x6d/znz w/yub75hhg+mrwea =W95Y -----END PGP MESSAGE----- ( )... # gpg -d test.asc ( ) # gpg --clearsign test2 test2.asc test2.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a test BEGIN PGP SIGNATURE----- Version: GnuPG v (FreeBSD) id8dbqfmofvrdffcj6gak/araplgaj92dmtqwlyfur2crwpsl83/flmbcgcfe3k0 ut8xxfrjnct/8qfupcmdcbu= =wzwd -----END PGP SIGNATURE-----