{"id":55146,"date":"2020-01-13T00:00:00","date_gmt":"2020-01-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov"},"modified":"2020-02-18T14:03:13","modified_gmt":"2020-02-18T11:03:13","slug":"mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","title":{"rendered":"Mozilla implementeaz\u0103 CRLite pentru a verifica certificatele TLS problematice","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Mozilla a anun\u021bat<\/a><\/noindex> despre \u00eenceputul test\u0103rii \u00een versiunile nocturne ale Firefox pentru noul mecanism de identificare a certificatelor revocate - CRLite<\/a><\/noindex>. CRLite permite organizarea unei verific\u0103ri eficiente a revoc\u0103rii certificatelor pe baza unei baze de date ce este stocat\u0103 pe sistemul utilizatorului. Implementarea dezvoltat\u0103 \u00een Mozilla a CRLite publicat\u0103<\/a><\/noindex> este sub licen\u021ba liber\u0103 MPL 2.0. Codul pentru generarea bazei de date \u0219i componentele serverului sunt scrise \u00een Python<\/a><\/noindex> \u0219i Go. P\u0103r\u021bile client ad\u0103ugate \u00een Firefox pentru a citi date din baza de date sunt preg\u0103tite<\/a><\/noindex> sunt scrise \u00een limbajul Rust.<\/p>\n

Verificarea certificatelor aplicat\u0103 p\u00e2n\u0103 acum, utiliz\u00e2nd servicii externe bazate pe protocolul OCSP<\/a><\/noindex> (Protocolul de Status al Certificatului Online) necesit\u0103 acces garantat la re\u021bea, provoc\u00e2nd o \u00eent\u00e2rziere notabil\u0103 \u00een procesarea cererii (\u00een medie 350ms) \u0219i are probleme legate de confiden\u021bialitate (serverele care r\u0103spund la cereri OCSP primesc informa\u021bii despre certificate specifice, din care se poate deduce ce site-uri sunt vizitate de utilizator). Exist\u0103 de asemenea posibilitatea unei verific\u0103ri locale prin liste CRL<\/a><\/noindex> (Certificate Revocation List), dar un dezavantaj al acestei metode este dimensiunea foarte mare a datelor desc\u0103rcate - \u00een prezent, baza de date a certificatelor revocate ocup\u0103 aproximativ 300 MB \u0219i continu\u0103 s\u0103 creasc\u0103.<\/p>\n

Pentru a bloca certificatele compromise \u0219i cele revocate de autorit\u0103\u021bile de certificare, Firefox utilizeaz\u0103 din 2015 o list\u0103 neagr\u0103 centralizat\u0103 OneCRL<\/a><\/noindex> \u00een combina\u021bie cu accesul la serviciul Google Safe Browsing<\/a><\/noindex> pentru a identifica posibila activitate d\u0103un\u0103toare. OneCRL, la fel ca \u0219i CRLSets<\/a><\/noindex> \u00een Chrome, func\u021bioneaz\u0103 ca un element intermediar care agreg\u0103 listele CRL de la autorit\u0103\u021bile de certificare \u0219i ofer\u0103 un serviciu OCSP centralizat pentru verificarea certificatelor revocate, permi\u021b\u00e2nd evitarea trimiterii cererilor direct la autorit\u0103\u021bile de certificare. \u00cen ciuda eforturilor considerabile de a \u00eembun\u0103t\u0103\u021bi fiabilitatea serviciului de verificare online a certificatelor, datele de telemetrie arat\u0103 c\u0103 peste 7% din cererile OCSP se \u00eencheie cu timeout (cu c\u00e2\u021biva ani \u00een urm\u0103, acest procent era de 15%). <\/p>\n

\u00cen mod implicit, \u00een cazul \u00een care verificarea prin OCSP nu este posibil\u0103, browserul consider\u0103 certificatul corect. Serviciul poate fi indisponibil din cauza problemelor de re\u021bea \u0219i a restric\u021biilor din re\u021belele interne, sau poate fi blocat de atacatori - pentru a ocoli verificarea OCSP \u00een timpul unui atac MITM, este suficient s\u0103 blochezi accesul la serviciul de verificare. Par\u021bial pentru prevenirea unor astfel de atacuri, este implementat\u0103 tehnica Must-Staple<\/a><\/noindex>, care permite interpretarea erorii de accesare a OCSP sau a inaccesibilit\u0103\u021bii OCSP ca o problem\u0103 cu certificatul, dar aceast\u0103 op\u021biune este op\u021bional\u0103 \u0219i necesit\u0103 un certificat special. <\/p>\n

CRLite reduce informa\u021biile complete despre toate certificatele revocate \u00eentr-o structur\u0103 u\u0219or actualizabil\u0103, cu o dimensiune de doar 1 MB, ceea ce permite stocarea \u00eentregii baze CRL pe partea clientului.
\nBrowserul va putea s\u0103-\u0219i sincronizeze zilnic copia de date despre certificatele revocate, iar aceast\u0103 baz\u0103 de date va fi disponibil\u0103 \u00een orice condi\u021bii. <\/p>\n

CRLite combin\u0103 informa\u021biile din Certificate Transparency<\/a><\/noindex>, jurnalul public al tuturor certificatelor emise \u0219i revocate, \u0219i rezultatele scan\u0103rii certificatelor pe internet (sunt colectate diverse liste CRL de c\u0103tre autorit\u0103\u021bile de certificare \u0219i este agregat\u0103 informa\u021bia despre toate certificatele cunoscute). Datele sunt ambalate folosind filtre Bloom , o structur\u0103 probabilistic\u0103 care permite o corectare fals\u0103 pentru un element lips\u0103, dar exclude omisiunea unui element existent (adic\u0103, cu o anumit\u0103 probabilitate, este posibil s\u0103 existe un fals pozitiv pentru un certificat valid, dar certificatele revocate vor fi garantat identificate).<\/a><\/noindex>, o structur\u0103 probabilistic\u0103 care permite determinarea gre\u0219it\u0103 a unui element lips\u0103, dar exclude omisiunea unui element existent (adic\u0103, cu o anumit\u0103 probabilitate, este posibil s\u0103 existe un fals pozitiv pentru un certificat corect, dar certificatele retrase vor fi identificate garantat). <\/p>\n

Pentru a exclude alertele false \u00een CRLite, au fost introduse niveluri suplimentare de corectare a filtrelor. Dup\u0103 generarea structurii, se efectueaz\u0103 o verificare a tuturor \u00eenregistr\u0103rilor originale \u0219i se determin\u0103 alertele false ap\u0103rute. Ca urmare a acestei verific\u0103ri, se creeaz\u0103 o structur\u0103 suplimentar\u0103, care se suprapune \u00een cascad\u0103 peste prima \u0219i corecteaz\u0103 alertele false ap\u0103rute. Opera\u021bia se repet\u0103 p\u00e2n\u0103 c\u00e2nd alertele false la verificarea de control sunt complet excluse. De obicei, pentru o acoperire complet\u0103 a tuturor datelor, este suficient s\u0103 se creeze \u00eentre 7 \u0219i 10 straturi. Deoarece starea bazei de date din cauza sincroniz\u0103rilor periodice r\u0103m\u00e2ne pu\u021bin \u00een urma st\u0103rii actuale a CRL, verificarea certificatelor noi, emise dup\u0103 ultima actualizare a bazei de date CRLite, se realizeaz\u0103 folosind protocolul OCSP, inclusiv utiliz\u00e2nd tehnica OCSP Stapling<\/a><\/noindex> (r\u0103spunsul OCSP validat de c\u0103tre autoritatea de certificare este transmis de serverul care serve\u0219te site-ul \u00een timpul negocierii conexiunii TLS).<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Cu ajutorul filtrilor Bloom, sec\u021biunea din decembrie a informa\u021biilor din WebPKI, care acoper\u0103 100 de milioane de certificate active \u0219i 750 de mii de certificate revocate, a fost compactat\u0103 \u00eentr-o structur\u0103 de dimensiune de 1.3 MB. Procesul de generare a structurii este destul de consumator de resurse, dar acesta se realizeaz\u0103 pe serverul Mozilla \u0219i utilizatorului i se ofer\u0103 deja o actualizare gata. De exemplu, sub form\u0103 binar\u0103, datele utilizate \u00een timpul gener\u0103rii necesit\u0103 aproximativ 16 GB de memorie c\u00e2nd sunt stocate \u00een baza de date Redis, iar sub form\u0103 hexazecimal\u0103, dump-ul tuturor numerelor de serie ale certificatelor ocup\u0103 aproximativ 6.7 GB. Procesul de agregare a tuturor certificatelor revocate \u0219i active dureaz\u0103 aproximativ 40 de minute, iar procesul de generare a structurii comprimate pe baza filtrului Bloom necesit\u0103 \u00eenc\u0103 20 de minute.<\/p>\n

\u00cen prezent, Mozilla asigur\u0103 actualizarea bazei de date CRLite de patru ori pe zi (nu toate actualiz\u0103rile sunt livrate clien\u021bilor). Generarea actualiz\u0103rilor delta nu este \u00eenc\u0103 implementat\u0103 - utilizarea bsdiff4, utilizat pentru a crea actualiz\u0103ri delta ale versiunilor, nu ofer\u0103 eficien\u021ba dorit\u0103 pentru CRLite \u0219i actualiz\u0103rile devin nejustificat de mari. Pentru a elimina aceast\u0103 problem\u0103, se preconizeaz\u0103 reproiectarea formatului structurii de stocare pentru a exclude reconstruirea \u0219i eliminarea straturilor inutile.<\/p>\n

CRLite func\u021bioneaz\u0103 momentan \u00een Firefox \u00een modul pasiv \u0219i este utilizat \u00eempreun\u0103 cu OCSP pentru a acumula statistici despre corectitudinea func\u021bion\u0103rii. CRLite poate fi comutat \u00een modul de verificare principal\u0103, pentru aceasta \u00een about:config trebuie s\u0103 se seteze parametrul security.pki.crlite_mode = 2.<\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox \u043d\u043e\u0432\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043e\u0442\u043e\u0437\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 — CRLite. CRLite \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043e\u0442\u0437\u044b\u0432\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043f\u043e \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u0432 Mozilla \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f CRLite \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u043f\u043e\u0434 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MPL 2.0. \u041a\u043e\u0434 \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0411\u0414 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 Python \u0438 Go. \u0414\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55146","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla implementeaz\u0103 CRLite pentru a verifica certificatele TLS problematice | ProHoster","description":"Compania Mozilla a anun\u021bat \u00eenceperea test\u0103rii \u00een versiunile nocturne ale Firefox.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 CRLite \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u043e\u0447\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 Firefox.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/mozilla-vnedryaet-crlite-dlya-proverki-problemnyh-tls-sertifikatov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-12T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55146","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:50:02","updated":"2022-10-10 06:24:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=55146"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55146\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=55146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=55146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=55146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}