Go to Qiita Advent Calendar 2024 Top
LoginSignup
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

@msakamoto_sf(Masahiko Sakamoto)

TLS関連のRFCリンク集メモ

Last updated at Posted at 2024-02-21

TLS関連のRFCのメモです。
時を経るごとに、過去のRFCがupdateされたりobsoleteされたりと動きが激しいです。
そこでポイントになりそうなものを主観で選び、obsolete には注記を入れてみました。
その中でも CipherSuite についてはなるべく網羅できるよう努力してみました（が、抜けてるものもあるかもです）。
なお主要なTLSバージョンに対応するRFCは太字タイトルにしてます。

※RFCタイトルについては読みやすいよう若干省略したりしてます。

SSL/TLS本体仕様 RFC

Cipher Suite の拡張系 RFC

細かいTLS拡張系RFC

ベストプラクティス系RFC

Datagram Transport Layer Security - DTLS 系RFC

鍵パラメータ系RFC

Online Certificate Status Protocol - OCSP 関連RFC

未分類RFC

RFC以外

OpenSSL の CHANGELOG で振り返る、CipherSuite の取り扱い

参考: https://github.com/openssl/openssl/blob/master/CHANGES.md

  • 0.9.8 [05 Jul 2005]
    • Change ./Configure so that certain algorithms can be disabled by default. The new counterpiece to "no-xxx" is "enable-xxx".
      • The patented RC5 and MDC2 algorithms will now be disabled unless "enable-rc5" and "enable-mdc2", respectively, are specified.
      • → RC5, MDC2 アルゴリズムがデフォルトで無効化
  • 1.0.0r [19 Mar 2015]
    • Removed the export ciphers from the DEFAULT ciphers
      • → EXPORT cipher が DEFAULT cipher 一覧から除外
  • 1.0.1 [14 Mar 2012]
    • Initial TLS v1.2 support.
  • 1.0.1m [19 Mar 2015]
    • Removed the export ciphers from the DEFAULT ciphers
      • → EXPORT cipher が DEFAULT cipher 一覧から除外
  • 1.0.1s [1 Mar 2016]
    • Disable SSLv2 default build, default negotiation and weak ciphers. SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2.
      • (...) Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. (CVE-2016-0800)
      • → SSLv2 および SSLv2 の 40bit EXPORT, 56bit DES cipher が完全に消滅。ビルド時の設定で "enable-ssl2" を指定しても、サポートしない。
  • 1.0.2a [19 Mar 2015]
    • Removed the export ciphers from the DEFAULT ciphers
      • → EXPORT cipher が DEFAULT cipher 一覧から除外
  • 1.0.2g [1 Mar 2016]
    • Disable SSLv2 default build, default negotiation and weak ciphers. SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2.
      • (...) Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. (CVE-2016-0800)
      • → SSLv2 および SSLv2 の 40bit EXPORT, 56bit DES cipher が完全に消滅。ビルド時の設定で "enable-ssl2" を指定しても、サポートしない。
  • 1.1.0 [25 Aug 2016]
    • To mitigate the SWEET32 attack (CVE-2016-2183), 3DES cipher suites have been disabled by default and removed from DEFAULT, just like RC4. See the RC4 item below to re-enable both.
    • Remove DSS, SEED, IDEA, CAMELLIA, and AES-CCM from the default cipherlist.
    • RC4 based libssl ciphersuites are now classed as "weak" ciphers and are disabled by default. They can be re-enabled using the enable-weak-ssl-ciphers option to Configure.
    • The GOST engine was out of date and therefore it has been removed.
    • Removed DES and RC4 ciphersuites from DEFAULT. Also removed RC2 although in 1.0.2 EXPORT was already removed and the only RC2 ciphersuite is also an EXPORT one. COMPLEMENTOFDEFAULT has been updated accordingly to add DES and RC4 ciphersuites.
    • Support for Kerberos ciphersuites in TLS (RFC2712) has been removed.
    • SSLv2 support has been removed.
    • → RC4と3DESがデフォルトで無効化。 有効にするには "enable-weak-ssl-ciphers" をビルド時に設定。
    • → DSS, SEED, IDEA, CAMELLIA, AEC-CCM が DEFAULT cipher list から除外。
    • → GOST エンジンが削除
    • → Kerberos cipher のサポートが削除
    • → SSLv2 サポートが削除
  • 1.1.1 [11 Sep 2018]
    • Support for TLSv1.3 added.

CentOS 5 - 8 における OpenSSL バージョン

CentOS バージョン OpenSSL バージョン 参考資料
5.0 0.9.7a -> 0.9.8b VaultのSRPM
5.11 0.9.8e VaultのSRPM
6.0 0.9.8e -> 1.0.0 VaultのSRPM
6.10 1.0.1e VaultのSRPM
7.0.1406 0.9.8e -> 1.0.1e VaultのSRPM
7.9.2009 1.0.2k VaultのSRPM
8-stream 1.1.1g -> 1.1.1k VaultのSRPM
  • OpenSSL で昔の CipuerSuite (RC4, MD5, SSLv2/v3/TLSv1.0 時代の EXPORT 用など) を使いたい時は CentOS 5.11 までを利用するのが確実。(5.11 で 0.9.8e )
  • OpenSSL 1.1.0 で SSLv2 等古いプロトコルや cipher をごっそり削ってる。
    • CentOS 7 までは max 1.0.2k なので、SSLv2 と 40bit EXPORT/56bit DES 以外ならまだRC4や3DESなどは使える。
  • TLSv1.3 を使いたいなら OpenSSL 1.1.1g 以降になった CentOS Stream 8 を使う。

TLSや暗号鍵の日本語ガイドライン

その他参考にした資料

1
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?