openssl网络钓鱼:V声称是A [英] openssl phishing : V claims to be A

问题描述

我的应用程序有多个组件，需要从原产地验证的意义上保证它们的通信安全.这些组件不能共享一个共同的秘密.因此，我必须选择非对称密钥加密.假设我有两个组成部分A和B A向B发送了一些数据F，并且B必须验证它确实来自A

there are several components of my application, needs their communication secure in the sense Origin Verified. these components cannot share a common secret. So I have to opt for asymmetric key encryption. assuming I've two components A and B A sends some data F to B and B has to verify that it really came from A

A使用其私钥生成F的摘要H A将A_pub，H附加到其请求参数，发送F并将源/发件人声明为A
B使用针对F

A generates digest H of F with its private Key
A attaches A_pub, H to its request Parameters, sends F and declares origin/sender as A
B verifies the digest H with the A_pub provided against F

显然看起来还可以，但是如果其他某些组件V与V_pub相同并且声称自己为A，则B仍认为该请求来自A，因为此H是通过V_prv openssl验证确定.

apparently it looks Okay But if some other component V does the same with V_pub and claims itself as A, B still thinks the request came from A as this H is made with V_prv openssl verifies Okay.

我想保护自己免受V

我正在使用ecparam secp112r1来最小化密钥长度.和键会反复更改.

I am using ecparam secp112r1 to minimize key length. and keys are repeatedly changed.

-编辑-

A，B和V是由唯一的URI标识的应用程序组件.它当前旨在限制安全的页面流.例如您可以假设A，B，V是url我想要的是只有A可以进入B，只有B可以进入C ....但我没有想要为此维护一个全局/应用程序范围的会话.因此，如果B可以仅基于特殊参数A以无状态/会话的方式传递给该链接，来验证此链接的来源.并且越通用，在其他情况下实现的重用性就越强.

A, B and V are application components identified by unique URI. Its currently intended to constraint secure page flow. e.g. you can assume A, B, V be urls What I want is Only A can procced to B and only B can proceed to C .... and I don't want to maintain a global/application wide session for that. so If B can just verify the origin of this link based on the special parameters A have passed to it in a state/session-less manner. and the more generic it can be the more reusable it will be to implement in other scenarios too.

我曾经想过在受信任的全局存储中维护A_pub的校验和.但是我担心那不是工程过度吗?

Once I thought to maintain a checksums of A_pub in a trusted global storage. however I am afraid wouldn't that be an over engineering ?

我想到的另一种方法是查询有关公钥的原始URL.但是我想避免这种情况.

another way comes in my mind is to query back the origin url regarding the public key. However I want to avoid that.

推荐答案

此技术无法验证发送方的身份，只是密钥是匹配对.

This technique cannot verify the identity of the sender, only that the keys are a matching pair.

通常，B已经拥有一些可信信息，可用于验证A的身份.该信息通常是先前已验证的A_pub的副本，或已由受信任的第三方签名的副本，在这种情况下，B必须有权访问该第三方的公共密钥.

Typically, B would already possess some piece of trusted information that it can use to validate A's identity. The information is generally a copy of A_pub that it had previously validated, or that has been signed by a trusted third party, in which case B must have access to that third party's public key.

没有这些附加信息，B无法验证A的身份.

Without this additional information, B cannot verify the identity of A.

这篇关于openssl网络钓鱼:V声称是A的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！