Signed HTTP Exchanges (SXG)とはなにか/SXG Explained

4JHOFE)551&YDIBOHFT 49( ͱ͸ͳʹ͔ 49(ͷ࢓૊Έ͔Β".1࿈ܞͷಋೖ·Ͱ େ௡ൟथ 49(4UVEZ ೥݄̑̎̔೔

಺༰ 49(ͷ͘͠Έ 49(".1γεςϜࣄྫ BNQQBDLBHFSʹ͍ͭͯ 49(ಋೖৼΓฦΓ

49(ͷ͘͠Έ

໰୊ɿԿ͕ҧ͏ʁ 4JHOFE)551&YDIBOHFT 4JHOFE&YDIBOHF 49(

ղ౴ 4JHOFE)551&YDIBOHFT࢓༷ͷਖ਼໊ࣜশ 4JHOFE&YDIBOHF࿩͍ͯ͠Δ࣌ΈΜͳ࢖͍ͬͯΔݴ༿ 49(ɿ֦ுࢠ΋͘͠͸ུশදه

໰୊Ͳ͕ͬͪ49( " #

ղ౴ " # 49( ".1

໰୊Ͳ͕ͬͪ49( " #

ղ౴ " # 49( )5514

)5514ͱ49(ͷҧ͍ )5514 49( %JTUSJCVUPS 1VCMJTIFS ௨৴ΛकΔ ίϯςϯπΛकΔ ηΩϡΞνϟωϧ FYBNQMFDPN FYBNQMFDPN
QVCMJTIFSͷPSJHJOͰදࣔ ॺ໊ ॺ໊

)5514ͱ49(ͷҧ͍ )5514 49( ػີੑ 㾎 /" ׬શੑ 㾎㾎 ೝূ
㾎㾎 ൱ೝ๷ࢭ /" 㾎 0SJHJO ઀ଓઌ 1VCMJTIFS อޢ͍ͯ͠Δ࣌ؒ ௨৴͍ͯ͠Δؒ ਺ඦϛϦඵఔ౓ ॺ໊ͷ༗ޮظؒ ࠷େ̓೔ؒ )551ͷ੍ݶ /" ΩϟογϡՄೳͳίϯςϯπݶఆ (&5ݶఆɺېࢭϔομ༗

49(ͷ΍ΓऔΓํ๏छ 4BNF0SJHJO DSPTTPSJHJO 4FSWFS1VTI BQQMJDBUJPO TJHOFEFYDIBOHF ϑΥʔϚοτ 1VTI 1SPNJTF DSPTTPSJHJO
4FSWFS1VTI "DDFQUBQQMJDBUJPOTJHOFEFYDIBOHFWC 4JHOBUVSF 4JHOFE)FBEFST 49(ϑΝΠϧ &/"#-&@$3044@ 03*(*/@164) &/"#-&@$3044@ 03*(*/@164) ࠓ೔ͷ࿩

୅දతͳ49(ͷϢʔεέʔε ΦϑϥΠϯ ΦϯϥΠϯ ୅දྫ49(".1 49( $FSU 1VCMJTIFS %JTUSJCVUPS )551ϦΫΤετ )551Ϩεϙϯε
)551ϦΫΤετ )551Ϩεϙϯε ύοΫͯ͠ॺ໊ ॺ໊ݕূͯ͠࠶ੜ 49(ϑΝΠϧ

49(".1γʔέϯεਤ ݕࡧαʔϏε ".1$BDIF 0SJHJO 6" 4FBSDI 4&31 1SFGFUDI 49( (&5
$FSU$IBJO 0$41 49( $FSU$IBJO 0$41 -PDBM$BDIF 7FSJGZ OBWJHBUJPO -PDBM$BDIF ".1࠷దԽ 5SBOTGPNFS 0SJHJOʹΞΫηε͠ͳ͍ ͜ͱͰ1SJWBDZΛอޢ "DDFQUBQQMJDBUJPOTJHOFEFYDIBOHFWC ".1$BDIF5SBOTGPSNHPPHMFW 7BSZ".1$BDIF5SBOTGPSN #PUΫϩʔϧ (&5 #PUΫϩʔϧ DFSUVSMॻ͖׵͑ JOEFYԽ %JTUSJCVUPS 1VCMJTIFS

ݕࡧ݁Ռ 4&31 ͔Β 49(Λ1SFGFUDI

49(7FSJGZͷঢ়گ EFWUPPM্ωοτϫʔΫύωϧͷ1SFWJFXͰ֬ೝͰ͖·͢

49(ͷঢ়گ w $ISPNF.ΑΓEFGBVMUͰFOBCMF όʔδϣϯC w J04൛͸ඇରԠɻݱঢ়ϞόΠϧ؀ڥͰ49(͕࢖͑Δͷ͸ "OESPJE$ISPNFͷΈ w .BD04൛*&&EHF
$ISPNJVNϕʔε Ͱ΋49(ಈ࡞֬ೝࡁ w (PPHMF4FBSDIͰ݄த०ΑΓ49(".1Λਖ਼ࣜରԠ w $MPVEqBSF΋49(ػೳఏڙ։࢝ (6*ϕʔε w ඪ४Խʜ·ͩΘ͔Γ·ͤΜɻ%*41"5$)&4$"1& 8PSLTIPQ

8FC1BDLBHJOH࢓༷֓ཁ ESBGUZBTTLJOIUUQPSJHJO TJHOFESFTQPOTF ESBGUJFUGIUUQCJT IFBEFSTUSVDUVSF ESBGUUIPNTPO IUUQNJD ESBGUZBTTLJOXQBDL CVOEMFEFYDIBOHFT -PBEJOH4JHOFE
&YDIBOHFT 8)"58( 'FUDI #VOEMF 49( 'FUDIʹର͢Δ ϞϯΩʔύον )551ϘσΟͷ )BTI%JHFTU ΑΓѻ͍΍͍͢)551 ϔομͷهड़ॻࣜ 8FC1BDLBHJOH࢓༷ 3'$ $#03 #JOBSZ+40/ͷ γϦΞϥΠζ C೥݄࣌఺ IUUQTHJUIVCDPN8*$(XFCQBDLBHF

.FSLMF*OUFHSJUZ$POUFOU&ODPEJOH )BTI "cc1SPPG#ccY " # $ " # $ )5513FTQPOTF#PEZ
ST SFDPSETJ[F ST " 1SPPG# # 1SPPG$ $ .*$& %JHFTUNJTIB'037ʜ )BTI #cc1SPPG$ccY )BTI $ccY 1SPPG$ 1SPPG# )551Ϩεϙϯεϔομ ϔομ৘ใͰ#PEZͷ ׬શੑΛνΣοΫ 49(࢓༷Ͱ͸SFDPSETJ[F͸,#ҎԼʹ੍ݶ

49(ϑΝΠϧͷத਎ C sxg1-b3 ϚδοΫ fallbackURL 49(ݕূ͕ࣦഊͨ͠৔߹ʹΞ Ϋηε͢Δ63- signature ॺ໊σʔλ signedHeaders
)551Ϩεϙϯεϔομ $#03ܗࣜ payload body )551ϨεϙϯεͷϘσΟ .*$&ܗࣜ sig ॺ໊஋ integrity )551ϨεϙϯεϘσΟͷϋογϡΞϧΰϦ ζϜ validity-url ৽͍͠ॺ໊σʔλΛऔಘ63- ݱࡏະ࣮૷ cert-url ূ໌ॻσʔλͷ63- ॺ໊ର৅֎ cert-sh256 ূ໌ॻσʔλͷϋογϡ஋ ed25519key ॺ໊ݕূ͢Δެ։ݤ ݱࡏະ࣮૷ date ॺ໊ͨ࣌ؒ͠ expire ॺ໊ͷ༗ޮظݶ ࠷େ೔ؒ sxg1-b3 (8) fallbackUrl length (2) fallbackURL sigLength (3) headerLength (3) signature signedHeaders payload body

49(Ͱॺ໊͍ͯ͠Δσʔλ Y Y YY )551&YDIBOHF Y DFSUTIB
WBMJEJUZVSMMFO WBMJEJUZVSM EBUF FYQJSFT SFRVFTU6SMMFO SFRVFTU6SM SFTQPOTF)FBEFSTMFO SFTQPOTF)FBEFST C͔ΒSFRVFTUϔομ͸আ֎ w 49(ূ໌ॻͷൿີ伴Λ࢖ͬͯFDETBXJUI4)" TFDQS Ͱॺ໊ w 49(ূ໌ॻͷެ։伴Λ࢖ͬͯॺ໊Λ7FSJGZ w ॺ໊ͷ7FSJGZ͕੒ޭͯ͠ϨεϙϯεϘσΟͷ.*$&νΣοΫ͕Ͱ͖ͨΒ49(͕WBMJE

49(ͷத਎ $#03 .*$& ॺ໊

49(ͷத਎

$FSU$IBJO $#03ͷத਎ $#03ܗࣜ ݱࡏͷ࣌ࠁ Ͱ༗ޮʁ 49(֦ு༗ $5 ϩά༗ʁ ೔Ҏ಺ɺݱࡏ༗ޮʁʁ SPPU$"·Ͱ
ॺ໊ݕূ 6 '%$4DSPMM 6 %⛓$IBJOT

49(ېࢭ)551ϔομ $POOFDUJPO ,FFQ"MJWF 1SPYZ$POOFDUJPO 5SBJMFS 5SBOTGFS&ODPEJOH 6QHSBEF "VUIFOUJDBUJPO$POUSPM "VUIFOUJDBUJPO*OGP $MFBS4JUF%BUB
0QUJPOBM888"VUIFOUJDBUF 1SPYZ"VUIFOUJDBUF 1SPYZ"VUIFOUJDBUF*OGP 1VCMJD,FZ1JOT 4FD8FC4PDLFU"DDFQU 4FU$PPLJF 4FU$PPLJF 4FU1SPpMF 4USJDU5SBOTQPSU4FDVSJUZ 888"VUIFOUJDBUF )PQCZ)PQϨεϙϯεϔομ 4UBUFGVMϨεϙϯεϔομ 49(Խ͢Δ".1αʔό͔ΒͷϨεϙϯεʹ্هϔομ͕ೖ͍ͬͯͳ͍͔஫ҙ͢Δ BNQQLHͰ͸&SSPS0O4UBUFGVM)FBEFSTͷઃఆͰ੍ޚͰ͖·͢ɻ

BNQQBDLBHFS ʹ͍ͭͯ HJUIVCDPNBNQQSPKFDUBNQQBDLBHFS SFMFBTFCSBODI1SPEVDUJPO༻ϒϥϯν NBTUFSCSBODI։ൃϒϥϯν

BNQQBDLBHFSఏڙίϚϯυ w DNEBNQQLHBNQQLHຊମ w DNEBNQQLH@EM@TYH49(ͱূ໌ॻΛμ΢ϯϩʔυ w DNEBNQQLH@UFTU@DBDIF49(Λఏڙ͢Δ؆қΩϟογϡαʔό w DNEHBUFXBZ@TFSWFSH31$Ͱ49(Λੜ੒͢Δήʔτ΢ΣΠαʔό w
DNEUSBOTGPSN".1࠷దԽΛߦ͏ίϚϯυ

BNQQLHUPNM NBTUFS 1PSU -JTUFOϙʔτ EFGBVMU -PDBM0OMZ MPDBMIPTUͰ-JTUFO͢Δ͜ͱΛڧ੍ EFGBVMUGBMTF $FSU'JMF 49(ূ໌ॻͷϑΝΠϧ
αʔόূ໌ॻ தؒূ໌ॻ 1&.ܗࣜ ,FZ'JMF 49(ূ໌ॻͷൿີ伴ϑΝΠϧ 1&.ܗࣜ 0$41$BDIF 0$41σʔλͷΩϟογϡϑΝΠϧͷύε 'PSXBSEFE3FRVFTU)FBEFS GFUDI͢Δࡍʹసૹ͢ΔϦΫΤετϔομ <<63-4FU>> <63-4FU4JHO> ॺ໊༻ͷઃఆ ඞਢ %PNBJO ॺ໊͢ΔυϝΠϯ 1BUI3& ॺ໊ΛڐՄ͢Δ1BUI EFGBVMU 1BUI&YDMVEF3& ॺ໊ΛڐՄ͠ͳ͍1BUI 2VFSZ3& ॺ໊ΛڐՄ͢Δ2VFSZύϥϝʔλ EFGBVMU &SSPS0O4UBUFGVM)FBEFS TUBUFGVMϔομ͕͋ͬͨΒQSPYZͤ͞Δ͔࡟আ͢Δ͔ .BY-FOHUI 63-ͷ࠷େ௕ EFGBVMU <63-4FU'FUDI> ".1ίϯςϯπΛ'FUDI͢Δઃఆ Φϓγϣϯ 4DIFNF GFUDIΛڐՄ͢ΔTDIFNB EFGBVMUIUUQT 4BNF1BUI ॺ໊ͱಉ͡QBUIͰGFUDI͢Δ͜ͱΛڧ੍ͤ͞Δ %PNBJO3& GFUDIΛڐՄ͢ΔυϝΠϯͷύλʔϯ %PNBJO GFUDI͢ΔυϝΠϯ 1BUI3& GFUDIΛڐՄ͢Δ1"5) EFGBVMU 2VFSZ3& GFUDIΛڐՄ͢Δ2VFSZύϥϝʔλ EFGBVMU

BNQQLH DPOpH DPOpHϑΝΠϧͷࢦఆ EFWFMPQFNFOU w $BO4JHO)551&YDIBOHF֦ு͕ͳ͍ূ໌ॻͷར༻ΛڐՄ͢Δ w MPDBMIPTUѼͷ63-͚ͩڐՄ w ".1$BDIF5SBOTGPSN"DDFQUϔομ͸ඞཁͳ͍
JOWBMJEDFSU $BO4JHO)551&YDIBOHF֦ு͕ͳ͍ূ໌ॻͷར༻ΛڐՄ͢Δ ϩά͸ඪ४ग़ྗͷΈ ίϚϯυϥΠϯϑϥά

BNQQLH΁ͷϦΫΤετ QSJWEPDIUUQTFYBNQMFDPNBNQ QSJWEPD GFUDIIUUQ"''JOUFSOBMDPN'BNQTJHOIUUQT"''FYBNQMFDPN'BNQ QSJWEPD TJHOIUUQT"''FYBNQMFDPN'BNQ IUUQTFYBNQMFDPNBNQ BNQQLH BNQQLH BNQQLH
IUUQTFYBNQMFDPNBNQ IUUQJOUFSOBMDPNBNQ ॺ໊υϝΠϯͱ'FUDIઌ͕ಉҰ ॺ໊υϝΠϯͱ'FUDIઌ͕ҟͳΔ BNQQLHલஈͰ5-4ऴ୺Λͯ͠ɺ֎෦͔Β௚઀QSJWEPDʹ઀ଓͤ͞ͳ͍͜ͱ 5 - 4 ऴ ୺ ɾ 1 B U I ม ߋ IUUQTFYBNQMFDPNBNQ IUUQTFYBNQMFDPNBNQQLH 49(ূ໌ॻཁٻϦΫΤετ BNQQLH 49(ཁٻϦΫΤετ

5SBOTGPSNFS w ͜Ε·Ͱ".1$BDIFͰ(PPHMF͕".1࠷దԽॲཧΛߦͬͯ ͖ͨ ".1ͷSVOUJNFWBMVFͷೖΕࠐΈ΍JOMJOFԽFUD w 49(Ͱ͸ॺ໊ͨ͠ޙͰ͸࠷దԽ͕ෆՄೳɻ49(Խͷલʹ΍ Δඞཁ͕͋Δɻ w
5SBOTGPSNFSͷࢦఆΛ".1$BDIF5SBOTGPSNFSϔομͰ ωΰγΤʔγϣϯ͢Δɻόʔδϣϯ͸िؒͰ্͕Δ༧ఆ w ".1$BDIF5SBOTGPSNHPPHMFW w ".1$BDIF5SBOTGPSNBOZ #PU IUUQTHJUIVCDPNBNQQSPKFDUBNQIUNMCMPCNBTUFSTQFDBNQDBDIFUSBOTGPSNNE 7BSZ".1$BDIF5SBOTGPSN ".1$BDIF5SBOTGPSNHPPHMFW IUUQTHJUIVCDPNBNQQSPKFDUBNQIUNMCMPCNBTUFSTQFDBNQDBDIFNPEJpDBUJPOTNE

49(ূ໌ॻ w 49(ΛαʔϏεͰఏڙ͢ΔͨΊʹඞཁෆՄܽ w ௨ৗͷ&$$ূ໌ॻ TFDQ ʹ49(֦ு͕෇͍ͨ΋ͷ w ௨ৗͷ)5514αʔό༻్ͷূ໌ॻʹ࢖͏͜ͱ͸ېࢭ w
ݱࡏ%JHJDFSUࣾͷΈൃߦ w ೥݄೔ΑΓ w ূ໌ॻͷ༗ޮظݶΛ೔ʹ੍ݶ w %/4$""Ϩίʔυొ࿥ΛඞਢԽ 49(֦ு

$""ಋೖͷࡍͷ஫ҙࣄ߲ w $/".&෇͚͍ͯΔϨίʔυʹ͸ଞϨίʔυ෇͚Εͳ͍ w $/".&ઌͷ$""Λݟʹߦ͕͘$/".&ͷ਌υϝΠϯΛḷΒͳ͍ 3'$&SSBUB w $/".&ઌͷ$""͕ͳ͚Ε͹਌υϝΠϯͷ$""Λࢀর͠ʹߦ͘ɻ FYBNQMFDPN$""JTTVFEJHJDFSUDPNDBOTJHOIUUQFYDIBOHFTZFT

)5514ͱ49(ͷηΩϡϦςΟͷҧ͍ ൿີ伴͕࿙Ӯͨ͠৔߹ ΦϑϥΠϯ؀ڥ POQBUI %/4Λม͑Εͳ͔ͬͨ Β.*5.͔͠ͳ͍ ωοτϫʔΫ؀ڥ ͍Βͳ͍ ෆਖ਼49( )5514
49( վ͟Μ ౪ௌ ͳΓ͢·͠ վ͟Μ ͳΓ͢·͠ P⒎QBUI $""Ͱূ໌ॻͷෆਖ਼ൃߦɾޡൃߦΛ๷͗ ୹ظؒ ೔ ͷ49(ূ໌ॻͰةຆԽ࣌ͷϦεΫΛ௿ݮ ࿙Ӯ

49(".1 γεςϜࣄྫ

".149(γεςϜ֓ཁ ݕࡧαʔϏε ".1Ωϟογϡ 49( ݕࡧ 1SFGFUDI 0$4αʔό ".1$%/ ".1αʔό BNQQLH
49(3PVUFS )55141SPYZ

)55141SPYZ w Πϯλʔωοτ͔Βͷ)5514઀ଓͷऴ୺ w Ωϟογϡػೳ w ಺෦αʔϏε΁ͷৼΓ෼͚ BNQ".1αʔϏε BNQQLH 49(ূ໌ॻऔಘ
$SBXMFSCPU BNQ BNQQLH ".1޲͚ϦΫΤετ ".1Ҏ֎ϦΫΤετ 49(3PVUFS ".1Ҏ֎ͷαʔϏε

49(3PVUFS w $SBXMFSʹ49(ରԠͰ͋Δ͜ͱΛ஌ΒͤΔ 7BSZ".1 $BDIF5SBOTGPSN w 49(औಘϦΫΤετ ".1$BDIF5SBOTGPSN HPPHMFW
͕དྷͨΒBNQQLʹ;Δɻ w ϦΫΤετΛBNQQLH༻ͷRVFSZQBSBNFUFSʹมߋ )55141SPYZ 49(3PVUFS BNQQLH ".1αʔό

BNQQLH w ".1ίϯςϯπ͔Β49(Λੜ੒͠ఏڙ͢Δ ࠷େ.# w ΫϥΠΞϯτͷ࣌ؒͣΕΛߟྀͯ͠ॺ໊ظؒ͸̍೔લ͔Β̒೔ޙ w 49(ੜ੒࣌ʹ".1࠷దԽ 5SBOTGPSN
Λߦ͏ w 49(ূ໌ॻͱ0$41Λ·ͱΊͨσʔλ DFSU DCPS Λੜ੒͠ɺఏڙ ͢Δ w ύϒϦοΫΩϟογϡʹద͞ͳ͍ϔομͷνΣοΫ΍࡟আΛߦ͏ w TUBUVT$PEFҎ֎͸جຊεϧʔ QSPYZ IUUQTHJUIVCDPNBNQQSPKFDUBNQQBDLBHFS BNQQLH ".1$%/ 0$41αʔό 49(3PVUFS ".1αʔό ".1$BDIF5SBOTGPSN ෇͖ϦΫΤετ 49(ূ໌ॻऔಘϦΫΤετ $44 357 ࣦޮ৘ใ )551ϦΫΤετ )551Ϩεϙϯε ".1ίϯςϯπ

49(ಋೖৼΓฦΓ

49(".1γεςϜಋೖɺৼΓฦΓ طଘΠϯϑϥ΁ͷӨڹΛ࠷খݶʹͯ͠ɺಋೖ͕Մೳͩͬ ͨɻ Ϣʔβ΁ͷ௚઀ϦΫΤετͷӨڹΛ͋·Γؾʹͤͣʹ͢ Μͩ ओཁϦΫΤετ͕#PUͷΫϩʔϦϯάͰ͋ͬͨͨΊ
ࣄલʹ4UBHJOH؀ڥͰͷςετ͕ݶఆతͩͬͨɻ#PUΫ ϩʔϧ΍".1ΩϟογϡԽͷࢼݧ͸ϦϦʔεޙʹ͔͠Ͱ ͖ͳ͍ɻ

49(".1γεςϜಋೖʹؔ ͢Δ஫ҙࣄ߲ w ΩϟογϡՄೳͳίϯςϯπ͔ʁ 49(ېࢭϔομ w ݸਓ৘ใ΍ηΩϡϦςΟ৘ใ͕ೖ͍ͬͯͳ͍͔ʁ w 4BNF0SJHJOʹͳͬͨΒΤϥʔʹͳΒͳ͍͔ʁ
FH".1 JGSBNF w 4PGU OPUGPVOEΛͰฦ͢ ͱ͔͍ͯ͠ͳ͍͔ʁ

·ͱΊ PSJHJOΛೖΕସ͑Δ4JHOFE)551&YDIBOHFT͸ɺ͜Ε·Ͱ ͷ8FCϓϩτίϧͷ֓೦Λࠜຊతʹม͑Δٕज़Ͱ͢ɻ ͜ͷٕज़ʹΑͬͯ1VCMJTIFS%JTUSJCVUPSͦΕͧΕͷؔ܎͕ কདྷେ͖͘มΘΔՄೳੑ͕͋Γ·͢ɻ ࠓޙɺ49(͕ఱ࢖ͱͳΔͷ͔ɺͦΕͱ΋ѱຐͱͳΔͷ͔ɺ օ͞ΜͰͦͷӨڹΛΑ͘ߟ্͑ͨͰ49(Λ൑அͯ͠Լ͍͞ɻ

Signed HTTP Exchanges (SXG)とはなにか/SXG Explained

Signed HTTP Exchanges (SXG)とはなにか/SXG Explained

More Decks by Shigeki Ohtsu

Other Decks in Technology

Featured

Transcript