Lock in $30 Savings on PRO—Offer Ends Soon! ⏳

AWS KMSの Encryption Contextを利用して より安全に暗号化する

quiver
December 06, 2015

AWS KMSの Encryption Contextを利用して より安全に暗号化する

~JAWS-UG京王線 第4回 攻めと守りのセキュリティ&監視~2015/12/06
Keywords : AWS KMS, Encryption Context, Cryptography, AEAD, AE, AAD

quiver

December 06, 2015
Tweet

More Decks by quiver

Other Decks in Technology

Transcript

  1. ೝূ෇͖҉߸ͱ͸ lೝূ෇͖҉߸ʢAE:Authenticated Encryption͋Δ͍͸AEAD:Authenticated Encryption with Associated Data ͱ͸ɺ σʔλͷൿಗੑɺ׬શੑɺ͓ΑͼೝূੑΛಉ࣌ʹ ఏڙ͢Δ҉߸ར༻ϞʔυͰ͋Δɻz

    IUUQTKBXJLJQFEJBPSHXJLJ&""%&"#$&##&%&"&'# ࣮ଶ͸ର৅҉߸ ൿಗੑ ͱϝοηʔδೝূίʔυ ׬શੑ ೝূੑ ͷ߹Θٕͤ 
  2. ೝূ෇͖҉߸ͱ͸ lೝূ෇͖҉߸ʢAE:Authenticated Encryption͋Δ͍͸AEAD:Authenticated Encryption with Associated Data ͱ͸ɺ σʔλͷൿಗੑɺ׬શੑɺ͓ΑͼೝূੑΛಉ࣌ʹ ఏڙ͢Δ҉߸ར༻ϞʔυͰ͋Δɻz

    IUUQTKBXJLJQFEJBPSHXJLJ&""%&"#$&##&%&"&'# ࣮ଶ͸ର৅҉߸ ൿಗੑ ͱϝοηʔδೝূίʔυ ׬શੑ ೝূੑ ͷ߹Θٕͤ 
  3. ༻ޠઆ໌ w ൿಗੑ Confidentiality  w ୈࡾऀͷ౪ௌΛ๷͙ɻผ໊ʮػີੑʯ w ׬શੑ Integrity

     w σʔλ͕ਖ਼ਅਖ਼໏ຊ෺ɻվ͟ΜΛ๷͙ɻผ໊ʮਖ਼ਅੑʯ w ೝূੑ Authenticity  w ຊਓͰ͋Δ͜ͱΛ֬ೝɻͳΓ͢·͠Λ๷͙ɻ 
  4. ΍ͬͯΈͨ w ಉ͡伴Λ࢖ͬͯkms::EncryptͰ҉߸Խ  # Encrypt ciphertext = kms.encrypt( KeyId

    = KEYID, Plaintext = plaintext)['CiphertextBlob'] # Decrypt decrypted = kms.decrypt( CiphertextBlob = ciphertext)['Plaintext']
  5. &ODSZQUJPO$POUFYUͱ͸ w ҉߸ɾ෮߸࣌ʹ౉͢ΩʔɾόϦϡʔϖΞ w "EEJUJPOBM"VUIFOUJDBUFE%BUB ""% ͱͯ͠ ϝοηʔδೝূίʔυ ."$ ͷੜ੒ʹར༻

    w ."$͸ʮ׬શੑʯͱʮೝূੑʯΛอূ w &ODSZQUJPO$POUFYU͸ೝূ͖ͭ҉߸ͷ,.4࣮૷ IUUQEPDTBXTBNB[PODPNLNTMBUFTUEFWFMPQFSHVJEFDSZQUP@BVUIFOIUNM
 IUUQEPDTBXTBNB[PODPNLNTMBUFTUEFWFMPQFSHVJEFFODSZQUJPODPOUFYUIUNM 
  6. ΍ͬͯΈͨ w ҉߸࣌ʹEncryptionContextΛ౉͢  # Encrypt ciphertext = kms.encrypt( KeyId

    = KEYID, EncryptionContext={'user': '1234'}, Plaintext = plaintext)['CiphertextBlob'] # Decrypt decrypted = kms.decrypt( EncryptionContext={'user': '1234'}, CiphertextBlob = ciphertext)['Plaintext']
  7. σʔλ͕ॻ͖׵͑ΒΕͨΒ w &ODSZQUJPO$POUFYU 㲈."$஋ ͕Ұக͠ͳ͚Ε͹ InvalidCiphertextException͕ൃੜ  # Decrypt decrypted

    = kms.decrypt( EncryptionContext={'user': '1235'}, CiphertextBlob = ciphertext)[‘Plaintext'] ⇒ {"__type":"InvalidCiphertextException"}
  8. "84ͷར༻ྫ w "84αʔϏεͷ,.4αʔόʔαΠυ҉߸Ͱ͸ &ODSZQUJPO$POUFYUΛ׆༻  "844FSWJDF &ODSZQUJPO$POUFYU &#4 "encryptionContext": {

    "aws:ebs:id": "vol-2cfb133e" } 4 "encryptionContext": { "aws:s3:arn": "arn:aws:s3:::bucket_name/file_name"}