{"id":55146,"date":"2020-01-13T00:00:00","date_gmt":"2020-01-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov"},"modified":"2020-02-18T14:03:13","modified_gmt":"2020-02-18T11:03:13","slug":"mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","title":{"rendered":"Mozilla implementira CRLite za provjeru problemati\u010dnih TLS certifikata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tvrtka Mozilla najavila<\/a><\/noindex> o po\u010detku testiranja u no\u0107nim izdanjima Firefoxa novog mehanizma za definiranje povu\u010denih certifikata \u2014 CRLite<\/a><\/noindex>. CRLite omogu\u0107uje u\u010dinkovitu provjeru povla\u010denja certifikata iz baze podataka koja se pohranjuje na korisnikovom sustavu. Realizacija CRLite koju razvija Mozilla je objavljen<\/a><\/noindex> pod slobodnom licencom MPL 2.0. Kod za generiranje Baze podataka i poslu\u017eiteljske komponente napisane su na Python<\/a><\/noindex> i Go. Klijentski dijelovi dodani u Firefox za \u010ditanje podataka iz Baze podataka pripremljeni<\/a><\/noindex> napisani su na jeziku Rust.<\/p>\n

Dosada\u0161nja provjera certifikata uz pomo\u0107 vanjskih usluga temeljenih na protokolu OCSP<\/a><\/noindex> (Online Certificate Status Protocol) zahtijeva garanciju mre\u017enog pristupa, dovodi do zna\u010dajnog ka\u0161njenja prilikom obrade zahtjeva (u prosjeku 350ms) i ima problema s osiguranjem privatnosti (poslu\u017eitelji koji odgovaraju na zahtjeve OCSP-a dobivaju informacije o konkretnim certifikatima iz kojih se mo\u017ee suditi o tome koje web stranice korisnik otvara). Tako\u0111er postoji mogu\u0107nost lokalne provjere koriste\u0107i liste CRL<\/a><\/noindex> (Lista povu\u010denih certifikata), ali nedostatak ove metode je vrlo velika veli\u010dina preuzetih podataka \u2014 trenutno baza podataka povu\u010denih certifikata zauzima oko 300 MB, a njezin rast se nastavlja.<\/p>\n

Za blokiranje kompromitiranih i povu\u010denih certifikata od strane izdava\u010da certifikata, Firefox od 2015. godine koristi centraliziranu crnu listu OneCRL<\/a><\/noindex> u kombinaciji s pristupom usluzi Google Safe Browsing<\/a><\/noindex> za prepoznavanje mogu\u0107e zlonamjerne aktivnosti. OneCRL, poput CRLSets<\/a><\/noindex> u Chromeu, djeluje kao posredni\u010dki sloj koji agregira CRL-liste od izdava\u010da certifikata i pru\u017ea jedinstvenu centraliziranu OCSP-uslugu za provjeru povu\u010denih certifikata, omogu\u0107uju\u0107i izbjegavanje izravnog slanja zahtjeva izdava\u010dima certifikata. Unato\u010d velikom naporu na pove\u0107anju pouzdanosti usluge online provjere certifikata, telemetrijski podaci pokazuju da vi\u0161e od 7% OCSP zahtjeva zavr\u0161ava vremenskim istekom (prije nekoliko godina ta je brojka iznosila 15%). <\/p>\n

Prema zadanim postavkama, u slu\u010daju nemogu\u0107nosti provjere putem OCSP-a, preglednik smatra certifikat ispravnim. Usluga mo\u017ee biti nedostupna zbog mre\u017enih problema i ograni\u010denja unutar mre\u017ee, ali i blokirana napada\u010dima \u2014 zaobi\u0107i provjeru OCSP-a tijekom MITM napada dovoljno je jednostavno blokirati pristup provjernoj usluzi. Djelomi\u010dno za spre\u010davanje takvih napada implementirana je tehnika Must-Staple<\/a><\/noindex>, koja omogu\u0107uje da se gre\u0161ka pri pristupu OCSP-u ili nedostupnost OCSP-a tuma\u010di kao problem s certifikatom, ali ova mogu\u0107nost je opcionalna i zahtijeva posebno izdavanje certifikata. <\/p>\n

CRLite omogu\u0107uje kompilaciju potpune informacije o svim opozvanim certifikatima u lako a\u017euriranu strukturu, veli\u010dine samo 1 MB, \u0161to omogu\u0107uje pohranu cijele CRL baze na strani klijenta.
\nPreglednik \u0107e svakodnevno mo\u0107i sinkronizirati svoju kopiju podataka o opozvanim certifikatima, a ova baza podataka bit \u0107e dostupna pod svim uvjetima. <\/p>\n

CRLite kombinira informacije iz Certificate Transparency<\/a><\/noindex>, javnog loga svih izdanih i opozvanih certifikata, i rezultata skeniranja certifikata na internetu (prikupljaju se razne CRL liste od certifikacijskih tijela i agregira se informacija o svim poznatim certifikatima). Podaci se pakiraju kori\u0161tenjem kaskadnih Bloom filtera<\/a><\/noindex>, vjerojatne strukture, koja dopu\u0161ta la\u017eno odre\u0111ivanje nepostoje\u0107eg elementa, ali isklju\u010duje propu\u0161tanje postoje\u0107eg elementa (tj. s odre\u0111enom vjerojatno\u0161\u0107u mogu\u0107e je la\u017eno alarmiranje na ispravni certifikat, ali opozvani certifikati \u0107e biti zajam\u010deno identificirani). <\/p>\n

Kako bi se isklju\u010dile la\u017ene identifikacije u CRLite-u, uvedeni su dodatni korektivni nivoi filtriranja. Nakon generiranja strukture, vr\u0161i se prolazak kroz sve izvorne zapise i utvr\u0111ivanje nastalih la\u017enih identifikacija. Na temelju ovog pregleda stvara se dodatna struktura koja se kaskadno primenjuje na prvu i ispravlja nastale la\u017ene identifikacije. Ova operacija se ponavlja sve dok la\u017ene identifikacije tokom kontrolne provere ne budu potpuno isklju\u010dene. Obi\u010dno je dovoljno stvoriti 7-10 slojeva za potpuno pokrivanje svih podataka. Budu\u0107i da stanje Baze podataka zbog periodi\u010dne sinhronizacije malo kasni za aktuelnim stanjem CRL-a, provera novih sertifikata koji su izdati nakon poslednje a\u017euriranja Baze podataka CRLite vr\u0161i se putem OCSP protokola, uklju\u010duju\u0107i kori\u0161\u0107enje tehnike OCSP Stapling<\/a><\/noindex> (ovjereni odgovor OCSP od strane certifikacijskog tijela \u0161alje se serverom koji opslu\u017euje web stranicu prilikom uspostavljanja TLS veze).<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Koriste\u0107i Bloomove filtre, decembarska rezerva informacija iz WebPKI, koja obuhvata 100 miliona aktivnih sertifikata i 750 tisu\u0107a opozvanih sertifikata, uspela je da se spakuje u strukturu veli\u010dine 1.3 MB. Proces generiranja strukture je dovoljno resursno zahtevan, ali se izvodi na serveru Mozilla i korisniku se ve\u0107 dostavlja a\u017euriranje. Na primer, u binarnom obliku kori\u0161\u0107eni izvorni podaci prilikom generiranja zahtevaju oko 16 GB memorije kada se \u010duvaju u Redis bazi podataka, dok u heksadecimalnom obliku dump svih serijskih brojeva sertifikata zauzima oko 6.7 GB. Proces agregacije svih opozvanih i aktivnih sertifikata traje oko 40 minuta, a proces generiranja pakovane strukture na osnovu Bloomovog filtriranja zahteva jo\u0161 20 minuta.<\/p>\n

Trenutno je u Mozilli osigurano a\u017euriranje baze podataka CRLite \u010detiri puta dnevno (ne svih a\u017euriranja isporu\u010duje klijentima). Generiranje delta a\u017euriranja trenutno nije implementirano \u2014 primjena bsdiff4, koja se koristi za izradu delta a\u017euriranja izdanja, ne osigurava dovoljnu u\u010dinkovitost za CRLite i a\u017euriranja postaju neopravdano velika. Kako bi se rije\u0161io ovaj nedostatak, planira se preurediti format strukture pohrane kako bi se izbjeglo nepotrebno rekonstrukciju i uklanjanje slojeva.<\/p>\n

CRLite trenutno radi u Firefoxu u pasivnom modu i koristi se paralelno s OCSP-om za prikupljanje statistike o to\u010dnosti rada. CRLite se mo\u017ee prebaciti u glavni na\u010din provjere, za \u0161to je potrebno u about:config postaviti parametar security.pki.crlite_mode = 2.<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox \u043d\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 — CRLite. CRLite \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043f\u043e \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u0432 Mozilla \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f CRLite \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u043f\u043e\u0434 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MPL 2.0. \u041a\u043e\u0434 \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0411\u0414 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 Python \u0438 Go. \u0414\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55146","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla implementira CRLite za provjeru problemati\u010dnih TLS certifikata | ProHoster","description":"Tvrtka Mozilla najavila je po\u010detak testiranja u no\u0107nim verzijama Firefoxa.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 CRLite \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55146","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:50:02","updated":"2022-10-10 06:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/55146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=55146"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/55146\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=55146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=55146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=55146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}