{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Kina har b\u00f6rjat blockera HTTPS-anslutningar som anv\u00e4ndes med TLS 1.3 och ESNI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kina implementerade<\/a><\/noindex> blockering<\/a><\/noindex> av alla HTTPS-anslutningar som anv\u00e4nder TLS 1.3-protokollet och TLS-till\u00e4gget ESNI (Encrypted Server Name Indication), vilket s\u00e4kerst\u00e4ller kryptering av data om beg\u00e4rd v\u00e4rd. Blockeringen utf\u00f6rs p\u00e5 transitroutrar b\u00e5de f\u00f6r anslutningar som uppr\u00e4ttas fr\u00e5n Kina till omv\u00e4rlden och fr\u00e5n omv\u00e4rlden till Kina.<\/p>\n

F\u00f6r blockeringen utf\u00f6rs paketavvisning fr\u00e5n klienten till servern, snarare \u00e4n att s\u00e4tta in paket med RST-flagga, vilket tidigare gjordes vid selektiv blockering baserat p\u00e5 SNI-inneh\u00e5ll. Efter att blockeringen av paket med ESNI tr\u00e4der i kraft blockeras \u00e4ven alla n\u00e4tverkspaket motsvarande sambandet av ursprunglig IP, destination IP och destinationsport i 120 till 180 sekunder. HTTPS-anslutningar baserade p\u00e5 \u00e4ldre versioner av TLS och TLS 1.3 utan ESNI till\u00e5ts som vanligt. <\/p>\n

Vi p\u00e5minner om att f\u00f6r att m\u00f6jligg\u00f6ra drift av flera HTTPS-webbplatser p\u00e5 en och samma IP-adress utvecklades SNI-till\u00e4gget, vilket m\u00f6jligg\u00f6r \u00f6verf\u00f6ring av v\u00e4rdnamnet i klartext i ClientHello-meddelandet som skickas innan en krypterad kommunikationskanal uppr\u00e4ttas. Denna funktion g\u00f6r det m\u00f6jligt f\u00f6r internetleverant\u00f6ren att selektivt filtrera HTTPS-trafik och analysera vilka webbplatser anv\u00e4ndaren bes\u00f6ker, vilket hindrar fullst\u00e4ndig sekretess vid anv\u00e4ndning av HTTPS.<\/p>\n

Det nya TLS-till\u00e4gget ECH (tidigare ESNI), som kan anv\u00e4ndas i samband med TLS 1.3, \u00e5tg\u00e4rdar denna brist och eliminerar fullst\u00e4ndigt l\u00e4ckage av information om den beg\u00e4rda webbplatsen vid analys av HTTPS-anslutningar. Tillsammans med anv\u00e4ndning av ett inneh\u00e5llsleveransn\u00e4t (CDN) m\u00f6jligg\u00f6r anv\u00e4ndningen av ECH\/ESNI \u00e4ven att d\u00f6lja den beg\u00e4rda resursens IP-adress fr\u00e5n leverant\u00f6ren. Trafikinspektionssystem kommer endast att se f\u00f6rfr\u00e5gningar till CDN och kommer inte att kunna till\u00e4mpa blockering utan att ers\u00e4tta TLS-sessionen, vid vilket tillf\u00e4lle anv\u00e4ndarens webbl\u00e4sare kommer att visa ett meddelande om att certifikatet har \u00e4ndrats. En m\u00f6jlig l\u00e4ckkanal f\u00f6rblir DNS, men f\u00f6r att d\u00f6lja DNS-f\u00f6rfr\u00e5gan kan klienten anv\u00e4nda DNS-over-HTTPS eller DNS-over-TLS.<\/p>\n

Forskare har redan har uppt\u00e4ckt<\/a><\/noindex> Flera alternativa metoder f\u00f6r att kringg\u00e5 den kinesiska blockeringen p\u00e5 klient- och serversidan, men de kan f\u00f6rlora sin relevans och b\u00f6r betraktas som en tempor\u00e4r l\u00f6sning. Till exempel, f\u00f6r n\u00e4rvarande blockeras endast paket med identifieraren f\u00f6r ESNI 0xffce (encrypted_server_name), som har anv\u00e4nts i den femte versionen av utkastet till standarden<\/a><\/noindex>, men f\u00f6r n\u00e4rvarande sl\u00e4pps paket med den aktuella identifieraren 0xff02 (encrypted_client_hello), f\u00f6reslagen i det sjunde utkastet till specifikationen ECH<\/a><\/noindex>. <\/p>\n

Ett annat alternativ f\u00f6r att kringg\u00e5 \u00e4r att anv\u00e4nda en icke-standardiserad f\u00f6rhandlingsprocess f\u00f6r anslutningen, till exempel fungerar blockeringen inte n\u00e4r ett extra SYN-paket med ett felaktigt sekvensnummer skickas i f\u00f6rv\u00e4g, manipulation av paketfragmenteringsflaggor, att skicka ett paket med b\u00e5de FIN och SYN-flaggor satta, infogning av ett RST-paket med en felaktig kontrollsumma eller att skicka ett paket med SYN och ACK-flaggor innan f\u00f6rhandlingen av anslutningen inleds. De beskrivna metoderna har redan implementerats i form av ett plugin till verktyget Geneva<\/a><\/noindex>, utvecklat<\/a><\/noindex> f\u00f6r att kringg\u00e5 censurmetoder.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kina b\u00f6rjade blockera HTTPS-anslutningar som uppr\u00e4ttas med TLS 1.3 och ESNI | ProHoster","description":"Kina har inf\u00f6rt","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}