電子メールのセキュリティ

Size: px

Start display at page:

Download "電子メールのセキュリティ"

のぶみつひがき
5 years ago
Views:

1 S/MIME

2 PGP (CA) CRL ( ID ) CRL(Certificate Revocation List) Microsoft Outlook Express S/MIME S/MIME CRL Netscape Messenger S/MIME S/MIME

3 Winbiff S/MIME S/MIME S/MIME MIME

6 2 2.1 RC2 RC5DES Triple-DES IDEA - 3 -

7 2.2 public key private key RSADiffie-Hellman 2.3 ( ) MD2( 16 )MD5(16 ) SHA1(20 ) - 4 -

8 3 3 S/MIME PGP 3.1 OS - 5 -

9 3.2 1) - 6 -

10 2) A ( + ) A B ( + ) B ( ) - 7 -

11 3.3 1) ( ) GSIb3DQEH GSIb3DQEH GSIb3DQEH 2-8 -

12 ) 2) ( + ( ) 3) Microsoft Outlook Express ID Netscape Messenger Oangesoft Winbiff+S/Goma 4) BASE64 BASE64 Microsoft Outlook Express Netscape Messenger Oangesoft Winbiff+S/Goma ( ) - 9 -

13 3.4 1)

14 2) 2 1 Sign-Then-Envelop 1) S/MIME Sign-And-Envelop PEM S/MIME S/MIME PEM ( + ) ( ) ( ) A ( + ) A B ( + ) B ( )

15 4 PGP S/MIME 4.1 PGP A B A C D C D B B A B

16 4.2 (CA) A A A A A B C A A A A S/MIME

17 4.3 SHA.1 MD5 Thumbprint (fingerprint) SHA

18 5 CRL 5.1 ( ID ) X.509 (Certificate Signing Request) Certificate Chain

19 Web ISO/IEC X.509 X.509 V3 ID CRL

20 5.2 CRL(Certificate Revocation List) CRL CRL CRL CRL CRL CRL CRL CRL S/MIME CRL CRL S/MIME CRL X

21 6 Microsoft Outlook Express S/MIME ID S/MIME 1) Web "Enroll Now"

Contents of Your Digital ID First Name: Last Name: E-mail Address: Easy Web site Registration Include Additional

22 Contents of Your Digital ID First Name: Last Name: Address: Easy Web site Registration Include Additional Information?: Yes : Country: Japan Zip/Postal Code: Date of Birth: male /female Challenge Phrase Challenge Phrase

23 Choose a Full-service Class1 Digital ID, or a 60-day Trial Digital ID I'd like a one-year, full-service Digital ID for only US$14.95 per year.: US$14.95 I'd like to test drive a 60-day trial Digital ID for free.: 60 SM Billing Information Card Type: Card Number: Expiration Date: Name on Card: Street Address: Taishido Apartment/Unit Number: Hagitou Bldg 3F City: Setagaya-Ku Tokyo State/Province: JP ZIP/Postal Code: Country: Japan Option Internet Explorer Microsoft Base Cryptographic Provide v1.0 Netscape Communicator 512 Additional Security for Your Private Key Internet Explorer Check this Box to Protect Your Private Key: Digital ID Subscriber Agreement Accept Accept OK Netscape Communicator

24 Communicator Certificate DB

25 URL Your Digital ID PIN IS: PIN Web ID URL PIN Submit INSTALL ID

26 [ ] CA ID ID ID () ID Web Outlook Express ID Web

27 2) S/MIME Outlook Express ID S/MIME ID multipart/signed PKCS#7 ID

28 S/MIME

29 6.2 1) 2) Outlook Express

30 3) Web Web nt/search.htm Download S/MIME Format (Binary )

31 : CC:

33 RC

34 6.10 OutlookExpress ID

35 X.509V CRL CRL CRL CRL

36 7 Netscape Messenger S/MIME 7.1 S/MIME 4) Outlook Express

37 5) S/MIME S/MIME Messenger S/MIME 7.2 1) Microsoft Outlook Express 2) 3) Web Microsoft Outlook Express

39 7.6 RC

41 8 Winbiff S/MIME () Winbiff S/Goma S/MIME () () S/MIME 1) Winbiff 2 Web (Certificate)Signing Request Signing Request PKCS#10 PKCS#10 CSR CSR Winbiff CSR

42 CSR CSR

43 CSR Outgoing CSR DB

44 2) S/MIME 8.2 1) Microsoft Outlook Express Netscape Messenger 2) S/Goma V1.01 3) Web Web

48 9 S/MIME 9.1 1) RFC2311 "S/MIME Version 2 Message Specification" RFC2312 "S/MIME Version 2 Certificate Handling" 2) RSA RFC2313 "PKCS #1 : RSA Encryption Version 1.5" 3) RFC2314 "PKCS #10 : Certification Request Syntax Version 1.5" 4) RFC2315 "PKCS #7 : Cryptographic Message Syntax Version 1.5" + CRL 5) MIME 6) CRL RFC 1847 Security Multiparts for MIME RFC1422 "Privacy Enhancement for Internet Electronic Mail : Part II: Certificate-Based Key Management" 7) PKCS S/MIME RSA Data Security Inc. S/MIME PKCS(Public Key Crypt System) RSA Data Security Inc. 9.2 MIME S/MIME PKCS#7 Base64 RFC2311 MIME Internet Draft MIME

49 1) RFC Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name=smime.p7m Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7m Internet Draft Content-Type: application/x-pkcs7-mime; name=smime.p7m Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7m 2) RFC Content-Type: application/pkcs7-mime; smime-type=signed-data; name=smime.p7m Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7m Internet Draft Content-Type: application/x-pkcs7-mime; name=smime.p7m Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7m 3) RFC Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7s Internet Draft Content-Type: application/x-pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7s 4) RFC Content-Type: application/pkcs10; name=smime.p10 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p10 Internet Draft Content-Type: application/x-pkcs10; name=smime.p10 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p10 5) RFC Content-Type: application/pkcs7-mime; smime-type=cert-only; name=smime.p7c Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7c Internet Draft Content-Type: application/x-pkcs7-mime; name=smime.p7c Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=smime.p7c

50 9.3 1) multipart/signed To: Hiroyuki Sawano > From: Taro Sawano > Subject: Digital Sign MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary=" ms8b7876c5a4971b52e1d24e61" This is a cryptographically signed message in MIME format ms8b7876c5a4971b52e1d24e61 Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: 7bit JIS ms8b7876c5a4971b52e1d24e61 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIQDwYJKoZIhvcNAQcCoIIQADCCD/wCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC Dn0wggnHMIIJMKADAgECAhA4kcRP4QGC7RTq2FZKZF0TMA0GCSqGSIb3DQEBBAUAMGIxETAP MjQ2MzRaMB4GCSqGSIb3DQEJDzERMA8wDQYIKoZIhvcNAwICASgwDQYJKoZIhvcNAQEBBQAE QBOPytJm3nmFp6lYXCZHlDyG9VULk8hhgyU0vAHELLV/9Grx4+5fVbeerP/YXSmoZx8G6CTw J7/hi+ooJvN4cuM= ms8b7876c5a4971b52e1d24e61-- 2) PKCS#7 signeddata To: Hiroyuki Sawano <sawano@orangesoft.co.jp > From: Taro Sawano <sawano1@orangesoft.co.jp > Subject: Digital Sign MIME-Version: 1.0 Content-Type: application/x-pkcs7-mime; name="smime.p7m" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExDjAMBggqhkiG9w0CBQUAMIAGCSqGSIb3DQEHAaCAJIAEbkNv bnrlbnqtvhlwztogdgv4dc9wbgfpbg0kq29udgvudc1ucmfuc2zlci1fbmnvzgluzzogcxvvdgvk hvcnaqkemrieefe6im/mzqmtgdlaag17he4wdqyjkozihvcnaqebbqaeqc+f4fyqziv4qgzs3bab YpazDyMF61HtuVOU5rZ9lguQzFB/nH6K+G0cF1+hAmaGdpFkC3lCVh0Py2XnMPg5TvoAAAAAAAAA AA== 9.4 To: Hiroyuki Sawano <sawano@orangesoft.co.jp > From: Taro Sawano <sawano1@orangesoft.co.jp > Subject: Digital Envelop MIME-Version: 1.0 Content-Type: application/x-pkcs7-mime; name="smime.p7m" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7m" Content-Description: S/MIME Encrypted Message MIAGCSqGSIb3DQEHA6CAMIACAQAxgc8wgcwCAQAwdjBiMREwDwYDVQQHEwhJbnRlcm5ldDEX MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWduIENsYXNzIDEgQ0Eg Bh0SaWCqCd9p0OpbNnHyi2G3tvMEuC74u+nvWjZT8fXeBAggdxGjYOObZQQIUHE0vqb2lnIA AAAAAAAAAAAA

51 9.5 + To: Hiroyuki Sawano <sawano@orangesoft.co.jp > From: Taro Sawano <sawano1@orangesoft.co.jp > Subject: Digital Sign And Digital Envelop MIME-Version: 1.0 Content-Type: application/x-pkcs7-mime; name="smime.p7m" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7m" Content-Description: S/MIME Encrypted Message MIAGCSqGSIb3DQEHA6CAMIACAQAxgc8wgcwCAQAwdjBiMREwDwYDVQQHEwhJbnRlcm5ldDEX MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWduIENsYXNzIDEgQ0Eg LSBJbmRpdmlkdWFsIFN1YnNjcmliZXICEDiRxE/hAYLtFOrYVkpkXRMwDQYJKoZIhvcNAQEB BJ/HfTc8/7A5BBBpHHa3fZXWmE4T/uRhx4NiBDCGvxP7QFMih9lWyt6FPuCfmwwHJOrjqBkQ eorm8+hsw8f50a47pk7vz6cebs7nxw8ecihy5kf/fcvhaaaaaaaaaaaaaa== 9.6 To: smime-enroll@digitalid.verisign.com From: sawano1@orangesoft.co.jp Reply-To: sawano1@orangesoft.co.jp Subject: Cert Request Mime-Version: 1.0 Content-Type: application/x-pkcs10 Content-Transfer-Encoding: base64 MIIBQDCB6wIBADA9MRkwFwYDVQQDExBBbGV4YW5kcmUgRGVhY29uMSAwHgYJKoZI YTEwDQYJKoZIhvcNAQECBQADQQABpH1/eqAnA6bA6zxDYZvJp8I8qXabr1ltGda7 j5spulsbuzkpia0dgw2o21fythz5nyb6oo9mjeiythgw3voh

52 9.7 1) From: To: Subject: Your VeriSign Class 1 S/MIME Digital ID Errors-to: errors@verisign.co.jp MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=================verisignonlineca_ _" X-winbiff-flags: Seen --=================VeriSignOnlineCA_ _ Content-Type: application/x-pkcs7-mime; name="verisign.p7c" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="verisign.p7c" MIIH4gYJKoZIhvcNAQcCoIIH0zCAAgEBMQAwCwYJKoZIhvcNAQcBoIAwggRzMIID 3KADAgECAhBSHbxudA47yQAkoRWHwCk0MA0GCSqGSIb3DQEBBAUAMIG1MRwwGgYD nbbrrt38ggtb5uzc1d3ltwruluuewztysgqfzdipgmnwlihsvrq+8lcnl0hzjk4b htmvd1ekbp84wuohkzi2m7b9ochvlvj0rjjxfqjgi2d/bjccgfyzg4lpzaz1gwbz AAAxAAAA --=================VeriSignOnlineCA_ _ Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: 7bit S/MIME ID JIS VeriSign Digital ID Center id-center@verisign.co.jp --=================VeriSignOnlineCA_ _ Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: 7bit --=================VeriSignOnlineCA_ _-- 2) PKCS#7 1 From: Taro Sawano <sawano1@orangesoft.co.jp> Mime-Version: 1.0 Content-Type: MultiPart/Mixed; Boundary=" " X-winbiff-flags: Seen Content-Type: text/plain; charset=iso-2022-jp JIS Content-Transfer-Encoding: Base64 Content-Type: application/pkcs7-mime; name="sawano1.p7c" Content-Disposition: attachment; filename=" sawano1.p7c" MIAGCSqGSIb3DQEHAqCAMIACAQExADALBgkqhkiG9w0BBwGggDCCBHQwggPdoAMCAQICED8 lxampnts5jp/o62cvbmwdqyjkozihvcnaqeebqawgbuxhdaabgnvbaote1zlcmltawduieph ZdIPGMNWLiHsVRQ+8lCnL0Hzjk4bhtMvd1ekbp84WuohKzi2m7b9OcHvlVJ0rJJxfqjgi2D/ bjccgfyzg4lpzaz1gwbzaaaxaaaaaaaaaa==

53 3) DER X.509 From: Taro Sawano Mime-Version: 1.0 Content-Type: MultiPart/Mixed; Boundary=" " X-winbiff-flags: Seen Content-Type: text/plain; charset=iso-2022-jp JIS Content-Transfer-Encoding: Base64 Content-Type: application/ pkix-cert; name="sawano1.cer" Content-Disposition: attachment; filename=" sawano1.cer" MIAGCSqGSIb3DQEHAqCAMIACAQExADALBgkqhkiG9w0BBwGggDCCBHQwggPdoAMCAQICED8 lxampnts5jp/o62cvbmwdqyjkozihvcnaqeebqawgbuxhdaabgnvbaote1zlcmltawduieph ZdIPGMNWLiHsVRQ+8lCnL0Hzjk4bhtMvd1ekbp84WuohKzi2m7b9OcHvlVJ0rJJxfqjgi2D/ bjccgfyzg4lpzaz1gwbzaaaxaaaaaaaaaa==

54 10 VeriSign md5withrsaencryption RSA(1024 )

55 md5withrsaencryption 49 AB 1D AC 7A BF 6D E0 53 0C DB CF 53 8E 32 7D 0E 1E EB 17 F9 A6 BC 5B 12 D2 8A 6D C3 DE CC 7C 4B 47 A9 20 DA 31 3F B9 C

56 11 14 Class1( )4( ) Class1 OK X.500 OU = Class 1 Public Primary Certification Authority O = VeriSign, Inc. C = US OU = Class 1 Public Primary Certification Authority O = VeriSign, Inc. C = US CA X.500 CN = VeriSign Class 1 CA - Individual Subscriber OU = Terms of use at (c) 98 OU = VeriSign Trust Network O = VeriSign Japan K.K. X.500 E = sawano@orangesoft.co.jp CN = Hiroyuki Sawano OU = Digital ID Class 1 - SMIME Orangesoft Inc./Winbiff/2.1 OU = Incorp. by Ref.,LIAB.LTD(c)96 OU = VeriSign Class 1 CA - Individual Subscriber O = VeriSign Japan K.K. C = JP VeriSign VeriSign Web Repository VeriSign PKI Hierarchy

57 12 1) 2) Web Microsoft Outlook Express Internet Explorer 3) SHA.1 20 MD

58 13 () () PKI () PGP Simon Garfinkel () () UNIX & Simon Garfinkel Gene Spafford () Bruce Schneier () () IPA RFC () (ECOM) PKIX Working Group S/MIME Working Group

59 FAX:

3. /dev/urandom 1024 ~CA0/private/cakey.pem $ openssl genrsa -rand /dev/urandom -out \ private/cakey.pem 1024 Generating RSA private key

$3. /dev/urandom 1024 ~CA0/private/cakey.pem $ openssl genrsa -rand /dev/urandom -out \ private/cakey.pem 1024 Generating RSA private key$ PKI : OpenSSL CA NISOC @ 2007/01/06 1 CA:Certificate Authority OpenSSL CA CA0 CA0 2 CA CA1 CA2 3 CA CA1 CA2 PC CA CA 2 CA CA0 1. CA ~CA0 openssl.cnf [ CA default ] dir ~CA0 [ req distinguished name ] CSR