{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Kina er begyndt at blokere HTTPS-forbindelser etableret med TLS 1.3 og ESNI.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kina implementerede<\/a><\/noindex> blokkering<\/a><\/noindex> af alle HTTPS-forbindelser, der bruger TLS 1.3-protokollen og TLS-udvidelsen ESNI (Encrypted Server Name Indication), som sikrer kryptering af data om den anmodede v\u00e6rt. Blokeringen udf\u00f8res p\u00e5 transitroutere b\u00e5de for forbindelser, der etableres fra Kina til omverdenen, og fra omverdenen til Kina.<\/p>\n

For blokeringen kasseres pakker fra klienten til serveren, i stedet for at inds\u00e6tte pakker med RST-flag, som tidligere blev udf\u00f8rt ved selektiv blokering baseret p\u00e5 SNI-indhold. Efter en blokering af en pakke med ESNI vil alle netv\u00e6rkspakker, der svarer til forbindelsen fra den oprindelige IP, den m\u00e5l-IP og destinationsporten, ogs\u00e5 blive blokeret i en periode p\u00e5 120 til 180 sekunder. HTTPS-forbindelser baseret p\u00e5 \u00e6ldre versioner af TLS og TLS 1.3 uden ESNI slipper igennem som normalt. <\/p>\n

Lad os minde om, at udvidelsen SNI blev udviklet for at muligg\u00f8re drift af flere HTTPS-websteder p\u00e5 samme IP-adresse, hvilket overf\u00f8rer v\u00e6rtsnavnet i klar tekst i ClientHello-beskeden, der sendes f\u00f8r etableringen af den krypterede kommunikationskanal. Denne funktion giver internetudbyderen mulighed for selektivt at filtrere HTTPS-trafik og analysere, hvilke websteder brugeren bes\u00f8ger, hvilket ikke tillader fuld fortrolighed ved brug af HTTPS.<\/p>\n

Den nye TLS-udvidelse ECH (tidligere ESNI), som kan anvendes sammen med TLS 1.3, fjerner denne ulempe og udelukker fuldst\u00e6ndig l\u00e6kage af oplysninger om det anmodede websted ved analyse af HTTPS-forbindelser. I kombination med adgang gennem indholdsleveringsnetv\u00e6rk giver anvendelsen af ECH\/ESNI ogs\u00e5 mulighed for at skjule IP-adressen for den anmodede ressource for udbyderen. Trafikinspektionssystemer vil kun se anmodninger til CDN og vil ikke kunne anvende blokering uden at \u00e6ndre TLS-sessionen, hvilket i s\u00e5 fald vil vise en tilsvarende meddelelse om certifikat\u00e6ndring i brugerens browser. Den mulige l\u00e6kagekanal forbliver DNS, men for at skjule DNS-anmodningen kan klienten anvende DNS-over-HTTPS eller DNS-over-TLS.<\/p>\n

Forskere har allerede har identificeret<\/a><\/noindex> Flere m\u00e5der at omg\u00e5 den kinesiske blokade p\u00e5 klientsiden og serversiden, men de kan miste relevans og b\u00f8r kun betragtes som en midlertidig l\u00f8sning. For eksempel blokeres der i \u00f8jeblikket kun pakker med udvidelsesidentifikatoren ESNI 0xffce (encrypted_server_name), som blev brugt i den femte version af standardudkastet<\/a><\/noindex>, men der sendes stadig pakker med den aktuelle identifikator 0xff02 (encrypted_client_hello), som er foresl\u00e5et i det syvende udkast til specifikationen ECH<\/a><\/noindex>. <\/p>\n

En anden metode til at omg\u00e5 blokeringen er at bruge en ikke-standardiseret forhandlingsproces, for eksempel aktiveres blokeringen ikke, n\u00e5r der sendes et ekstra SYN-pakke med et forkert sekvensnummer, manipulation af fragmenteringsflaggene i pakker, sending af en pakke med b\u00e5de FIN- og SYN-flaggene aktiveret, inds\u00e6ttelse af en RST-pakke med en forkert checksum, eller sending af en pakke med SYN- og ACK-flag, inden forhandlingen starter. De beskrevne metoder er allerede implementeret som en plugin til v\u00e6rkt\u00f8jet Geneve<\/a><\/noindex>, som videreudvikles<\/a><\/noindex> til omg\u00e5else af censureringsmetoder.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kina er begyndt at blokere HTTPS-forbindelser etableret med TLS 1.3 og ESNI | ProHoster","description":"Kina har indf\u00f8rt","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}