{"id":104941,"date":"2022-08-26T09:36:42","date_gmt":"2022-08-26T07:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-biblioteku-dlya-vyyavleniya-problemnyh-kriptograficheskih-klyuchej"},"modified":"2022-08-26T09:36:42","modified_gmt":"2022-08-26T07:36:42","slug":"google-opublikoval-biblioteku-dlya-vyyavleniya-problemnyh-kriptograficheskih-klyuchej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/google-opublikoval-biblioteku-dlya-vyyavleniya-problemnyh-kriptograficheskih-klyuchej","title":{"rendered":"Google a publi\u00e9 une biblioth\u00e8que pour identifier les cl\u00e9s cryptographiques probl\u00e9matiques","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Les membres de l'\u00e9quipe de s\u00e9curit\u00e9 de Google ont publi\u00e9 une biblioth\u00e8que open source appel\u00e9e Paranoid, destin\u00e9e \u00e0 identifier les artefacts cryptographiques non fiables, tels que les cl\u00e9s publiques et les signatures num\u00e9riques, cr\u00e9\u00e9s dans des syst\u00e8mes mat\u00e9riels (HSM) et logiciels vuln\u00e9rables. Le code est \u00e9crit en Python et est distribu\u00e9 sous la licence Apache 2.0. <\/p>\n

Le projet peut s'av\u00e9rer utile pour \u00e9valuer indirectement l'application d'algorithmes et de biblioth\u00e8ques comportant des vuln\u00e9rabilit\u00e9s connues, affectant la fiabilit\u00e9 des cl\u00e9s g\u00e9n\u00e9r\u00e9es et des signatures num\u00e9riques, si les artefacts v\u00e9rifi\u00e9s sont g\u00e9n\u00e9r\u00e9s par des mat\u00e9riels inaccessibles \u00e0 l'\u00e9valuation ou par des composants propri\u00e9taires, consid\u00e9r\u00e9s comme des bo\u00eetes noires. La biblioth\u00e8que peut \u00e9galement analyser des ensembles de nombres pseudo-al\u00e9atoires pour v\u00e9rifier la fiabilit\u00e9 de leur g\u00e9n\u00e9rateur, et identifier des probl\u00e8mes inconnus dans une grande collection d'artefacts, r\u00e9sultant d'erreurs de programmation ou d'utilisation de g\u00e9n\u00e9rateurs de nombres pseudo-al\u00e9atoires non fiables. <\/p>\n

Lors de la v\u00e9rification \u00e0 l'aide de la biblioth\u00e8que propos\u00e9e du contenu des journaux publics CT (Certificate Transparency), incluant des informations sur plus de 7 milliards de certificats, aucun probl\u00e8me de cl\u00e9s publiques bas\u00e9es sur des courbes elliptiques (EC) et de signatures num\u00e9riques bas\u00e9es sur l'algorithme ECDSA n'a \u00e9t\u00e9 identifi\u00e9, mais des cl\u00e9s publiques probl\u00e9matiques bas\u00e9es sur l'algorithme RSA ont \u00e9t\u00e9 trouv\u00e9es. En particulier, 3586 cl\u00e9s non fiables, g\u00e9n\u00e9r\u00e9es par un code avec une vuln\u00e9rabilit\u00e9 non corrig\u00e9e CVE-2008-0166 dans le paquet OpenSSL pour Debian, 2533 cl\u00e9s li\u00e9es \u00e0 la vuln\u00e9rabilit\u00e9 CVE-2017-15361 dans la biblioth\u00e8que Infineon, et 1860 cl\u00e9s avec une vuln\u00e9rabilit\u00e9 li\u00e9e \u00e0 la recherche du plus grand commun diviseur (GCD). Les informations sur les certificats probl\u00e9matiques encore en circulation ont \u00e9t\u00e9 envoy\u00e9es aux autorit\u00e9s de certification pour leur r\u00e9vocation.

\"Google<\/center>
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 Google Security Team \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Paranoid, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u044b\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 (HSM) \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041a\u043e\u0434 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. \u041f\u0440\u043e\u0435\u043a\u0442 \u043c\u043e\u0436\u0435\u0442 \u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0434\u043b\u044f \u043a\u043e\u0441\u0432\u0435\u043d\u043d\u043e\u0439 \u043e\u0446\u0435\u043d\u043a\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 \u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u043c\u0435\u044e\u0442\u0441\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":104942,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104941","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google a publi\u00e9 une biblioth\u00e8que pour identifier les cl\u00e9s cryptographiques probl\u00e9matiques | ProHoster","description":"Les membres de l'\u00e9quipe de s\u00e9curit\u00e9 de Google ont publi\u00e9 une biblioth\u00e8que open source appel\u00e9e Paranoid, destin\u00e9e \u00e0 identifier les artefacts cryptographiques non fiables, tels que les cl\u00e9s publiques et les signatures num\u00e9riques, cr\u00e9\u00e9s dans des syst\u00e8mes vuln\u00e9rables.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/google-opublikoval-biblioteku-dlya-vyyavleniya-problemnyh-kriptograficheskih-klyuchej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 | ProHoster","og:description":"\u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 Google Security Team \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 Paranoid, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u044b\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/google-opublikoval-biblioteku-dlya-vyyavleniya-problemnyh-kriptograficheskih-klyuchej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-26T07:36:42+00:00","article:modified_time":"2022-08-26T07:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104941","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-26 07:37:42","updated":"2022-09-27 14:56:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=104941"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104941\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/104942"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=104941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=104941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=104941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}