{"id":55146,"date":"2020-01-13T00:00:00","date_gmt":"2020-01-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov"},"modified":"2020-02-18T14:03:13","modified_gmt":"2020-02-18T11:03:13","slug":"mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","title":{"rendered":"Mozilla implementerer CRLite til kontrol af problematiske TLS-certifikater","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla Company har annonceret<\/a><\/noindex> om begyndelsen af testningen i natlige builds af Firefox af den nye mekanisme til bestemmelse af tilbagekaldte certifikater <\u2014 CRLite<\/a><\/noindex>. CRLite muligg\u00f8r effektiv kontrol af tilbagekaldte certifikater via en database, der hostes p\u00e5 brugerens system. Den version af CRLite, der udvikles i Mozilla, offentliggjort<\/a><\/noindex> er under den \u00e5bne licens MPL 2.0. Koden til generering af databasen og serverkomponenterne er skrevet i Python<\/a><\/noindex> og Go. De tilf\u00f8jede klientdele i Firefox til at l\u00e6se data fra databasen forberedes<\/a><\/noindex> er skrevet i Rust.<\/p>\n

Den hidtil anvendte kontrol af certifikater under involvering af eksterne tjenester baseret p\u00e5 protokollen OCSP<\/a><\/noindex> (Online Certificate Status Protocol) kr\u00e6ver garanteret netv\u00e6rksadgang, medf\u00f8rer en m\u00e6rkbar forsinkelse ved behandling af anmodningen (i gennemsnit 350 ms) og har problemer med at sikre fortroligheden (serverne, der svarer p\u00e5 anmodninger, om OCSP modtager oplysninger om specifikke certifikater, som kan indikere, hvilke websteder brugeren bes\u00f8ger). Der er ogs\u00e5 mulighed for lokal kontrol via listerne CRL<\/a><\/noindex> (Certificate Revocation List), men en ulempe ved denne metode er den meget store st\u00f8rrelse af de data, der downloades <\u2014 i \u00f8jeblikket fylder databasen med tilbagekaldte certifikater omkring 300 MB, og den forts\u00e6tter med at vokse.<\/p>\n

For at blokere kompromitterede og tilbagekaldte certifikater fra certifikatmyndighederne anvendes der i Firefox en centraliseret sortliste OneCRL<\/a><\/noindex> i kombination med adgang til tjenesten Google Safe Browsing<\/a><\/noindex> for at bestemme mulig skadelig aktivitet. OneCRL, ligesom CRLSets<\/a><\/noindex> i Chrome, fungerer som et mellemled, der aggregerer CRL-lister fra certifikatmyndighederne og giver en centraliseret OCSP-tjeneste til at kontrollere tilbagekaldte certifikater, hvilket g\u00f8r det muligt ikke at sende anmodninger direkte til certifikatmyndighederne. P\u00e5 trods af det store arbejde med at forbedre p\u00e5lideligheden af online-kontroltjenesten for certifikater viser telemetridata, at mere end 7% af OCSP-anmodningerne ender med timeout (for et par \u00e5r siden var denne procentdel 15%). <\/p>\n

Som standard, i tilf\u00e6lde af at det ikke er muligt at foretage en kontrol via OCSP, betragter browseren certifikatet som gyldigt. Tjenesten kan v\u00e6re utilg\u00e6ngelig b\u00e5de p\u00e5 grund af netv\u00e6rksproblemer og begr\u00e6nsninger i interne netv\u00e6rk, samt blive blokeret af angribere <\u2014 for at omg\u00e5 OCSP-kontrollen under en MITM-angreb er det tilstr\u00e6kkeligt blot at blokere adgangen til kontroltjenesten. Delvist for at forhindre s\u00e5danne angreb er teknikken blevet implementeret Must-Staple<\/a><\/noindex>, der g\u00f8r det muligt at betragte en fejl ved OCSP-adgang eller utilg\u00e6ngelighed af OCSP som et problem med certifikatet, men denne mulighed er valgfri og kr\u00e6ver en s\u00e6rlig udformning af certifikatet. <\/p>\n

CRLite g\u00f8r det muligt at samle fuldst\u00e6ndige oplysninger om alle tilbagekaldte certifikater i en let opdaterbar struktur, der kun fylder 1 MB, hvilket giver mulighed for at gemme en komplet CRL-database p\u00e5 klientsiden.
\nBrowseren vil kunne synkronisere sin kopi af dataene om tilbagekaldte certifikater dagligt, og denne database vil v\u00e6re tilg\u00e6ngelig under alle omst\u00e6ndigheder. <\/p>\n

CRLite kombinerer oplysninger fra Certificate Transparency<\/a><\/noindex>, den offentlige log over alle udstedte og tilbagekaldte certifikater, og resultaterne af scanning af certifikater p\u00e5 internettet (forskellige CRL-lister fra certifikatmyndigheder indsamles, og oplysninger om alle kendte certifikater aggregeres). Dataene pakkes ved hj\u00e6lp af kaskade- Bloom-filtre<\/a><\/noindex>, en probabilistisk struktur, der tillader falsk bestemmelse af et manglende element, men udelukker overspring af et eksisterende element (dvs. der er en vis sandsynlighed for falsk aktivering p\u00e5 et korrekt certifikat, men tilbagekaldte certifikater vil bestemt blive identificeret). <\/p>\n

For excluding false positives in CRLite, additional correction levels have been introduced. After generating the structure, all source records are processed to identify the false positives that have arisen. Based on the results of this check, an additional structure is created, which is cascaded onto the first one and corrects any false positives. This operation is repeated until false positives are completely excluded during the control check. Usually, to fully cover all data, creating 7-10 layers is sufficient. Since the state of the database lags slightly behind the actual state of the CRL due to periodic synchronization, the check for new certificates issued after the last database update is performed using the OCSP protocol, including the use of the technique. OCSP Stapling<\/a><\/noindex> (den verificerede OCSP-svar fra certifikatudstederen sendes af webstedets server under TLS-forbindelsesaftalen).<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Using Bloom filters, the December snapshot of data from WebPKI, covering 100 million active certificates and 750,000 revoked certificates, was managed to be packed into a structure sized at 1.3 MB. The process of generating the structure is quite resource-intensive, but it is carried out on the Mozilla server, and the user receives a ready-made update. For example, in binary form, the original data used for generation requires about 16 GB of memory when stored in the Redis database, and the hexadecimal dump of all certificate serial numbers takes about 6.7 GB. The process of aggregating all revoked and active certificates takes about 40 minutes, while the process of generating the packed structure based on the Bloom filter requires another 20 minutes.<\/p>\n

I \u00f8jeblikket sikrer Mozilla opdateringen af CRLite-databasen fire gange om dagen (ikke alle opdateringer leveres til kunderne). Generering af delta-opdateringer er endnu ikke blevet implementeret <\u2014 anvendelsen af bsdiff4, der bruges til at oprette delta-opdateringer af udgivelser, sikrer ikke den \u00f8nskede effektivitet for CRLite, og opdateringerne bliver uforholdsm\u00e6ssigt store. For at l\u00f8se denne ulempe planl\u00e6gges det at revidere lagringsstrukturens format for at undg\u00e5 un\u00f8dvendig genopbygning og fjernelse af lag.<\/p>\n

CRLite fungerer i \u00f8jeblikket i Firefox i passiv tilstand og bruges parallelt med OCSP til at indsamle statistik om korrekt drift. CRLite kan omstilles til hovedkontroltilstand; for dette skal indstillingen security.pki.crlite_mode = 2 s\u00e6ttes i about:config.<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox \u043d\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 — CRLite. CRLite \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043f\u043e \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u0432 Mozilla \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f CRLite \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u043f\u043e\u0434 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MPL 2.0. \u041a\u043e\u0434 \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0411\u0414 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 Python \u0438 Go. \u0414\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55146","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla implementerer CRLite til kontrol af problematiske TLS-certifikater | ProHoster","description":"Mozilla har annonceret, at de begynder at teste i nattebygningerne af Firefox.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 CRLite \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55146","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:50:02","updated":"2022-10-10 06:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=55146"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55146\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=55146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=55146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=55146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}