ื“ื™ ืขืจืฉื˜ืข ืื•ื™ืกื’ืื‘ืข ืคื•ืŸ โ€‹โ€‹ื“ื™ TLS 1.3 ืคืจืื˜ืืงืืœ ืื™ืžืคืœืขืžืขื ื˜ืืฆื™ืข ืื™ืŸ ื“ื–ืฉืื•ื•ื ืžื™ื˜ GOST ืืœื’ืืจื™ื˜ืžืขืŸ ืœื•ื™ื˜ RFC 9367

ืžืึธื“ื•ืœืข ืงืจื™ืคึผื˜ืึธ-ื’ืึธืกื˜-ื˜ืœืก13 ืื ื˜ื”ืืœื˜ ื“ื™ ืื™ืžืคืœืขืžืขื ื˜ืืฆื™ืข TLS 1.3 (RFC 8446 + RFC 9367) ืžื™ื˜ GOST ืงืจื™ืคึผื˜ืึธื’ืจืึทืคึฟื™ืข. ื“ื™ ื“ืึธื–ื™ืงืข ื•ื•ืขืจืกื™ืข ืื™ื– ื“ื™ ืขืจืฉื˜ืข ื•ื•ืขืจืกื™ืข ืคึฟื•ืŸ ื“ืขืจ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืื•ืŸ ืื™ื– ื’ืจื™ื™ื˜ ืคึฟืึทืจ ืื™ื ืขืจืœืขื›ืŸ ื‘ืึทื ื•ืฅ.

ื ื‘ืื–ื•ื ื“ืขืจืข ืื™ื™ื’ื ืฉืืคื˜ ืคื•ืŸ ื“ืขืจ ื‘ื™ื‘ืœื™ืื˜ืขืง ืื™ื– ืื™ืจ ืจื™ื™ื ืข ื“ื–ืฉืื•ื•ื ืื™ืžืคืœืขืžืขื ื˜ืืฆื™ืข. ืืœืข ืงืจื™ืคื˜ืื’ืจืืคื™ืฉืข ืืคืขืจืืฆื™ืขืก ื•ื•ืขืจืŸ ื“ื•ืจื›ื’ืขืคื™ืจื˜ ืžื™ื˜ ื“ื™ ื‘ื™ื‘ืœื™ืื˜ืขืง'ืก ืื™ื™ื ื’ืขื‘ื•ื™ื˜ืข ืžื›ืฉื™ืจื™ื, ืืŸ ืงื™ื™ืŸ ืขืงืกื˜ืขืจื ืข ืืคื”ืขื ื’ื™ืงื™ื™ื˜ืŸ.

ื“ืึธืก ืื™ื– ืื™ื™ื ืข ืคึฟื•ืŸ ื“ื™ ืขืจืฉื˜ืข ืึธืคึฟืŸ-ืงื•ื•ืึทืœ ืื™ืžืคึผืœืขืžืขื ื˜ืึทืฆื™ืขืก ืคึฟื•ืŸ TLS 1.3 ืžื™ื˜ GOST ืื™ืŸ ื“ื–ืฉืึทื•ื•ืึท, ืึทื–ื•ื™ ืื™ื ื˜ืขืจืึธืคึผ ื˜ืขืกื˜ื™ื ื’ ืื™ื– ื’ืขื˜ืึธืŸ ื’ืขื•ื•ืึธืจืŸ ืฆื•ื ืžื™ื ื™ืžืึทืœืŸ ืžืขื’ืœืขื›ืŸ ืžืึธืก.

ืื•ื ื˜ืŸ ื–ืขื ืขืŸ ื“ื™ ืžืขื’ืœืขื›ืงื™ื™ื˜ืŸ ืคื•ืŸ ื“ืขืจ ื‘ื™ื‘ืœื™ืึธื˜ืขืง.

  1. ืคึผืจืึธื˜ืึธืงืึธืœืก:
  • ื”ืึทื ื“ืฉืขื™ืง: ืคื•ืœ (ืงืœื™ืขื ื˜/ืกืขืจื•ื•ืขืจ), ืงื•ืจืฅ (PSK), ืงืขื’ื ืฆื™ื™ึทื˜ื™ืง (mTLS).
  • ALPN (RFC 7301) - ืึทืคึผืœื™ืงืึทืฆื™ืข ืฉื™ื›ื˜ืข ืคึผืจืึธื˜ืึธืงืึธืœ ืื•ื ื˜ืขืจื”ืึทื ื“ืœื•ื ื’ (HTTP/2, HTTP/1.1).
  • SNI (RFC 6066) - ื ืืžืขืŸ ืื ื•ื•ื™ื™ื–ื•ื ื’ ืกืขืจื•ื•ื™ืจืขืจ ืคึฟืึทืจ ืžื•ืœื˜ื™-ื˜ืขื ืึทื ื˜ ื“ื™ืคึผืœื•ื™ืžืึทื ืฅ.
  • ืงื™-ืืคื“ืขื™ื˜ (RFC 8446 ยง4.6.3) โ€“ ืืคื“ืขื™ื˜ืŸ ื˜ืจืืคื™ืง ืขื ืงืจื™ืคืฉืืŸ ืฉืœื™ืกืœืขืŸ.
  • ืกื™ืคืขืจ ืกื•ื•ื™ืฅ: TLS_KUZNYECHIK_MGM_STREEBOG_256_L/S.
  • ECDHE: ืงืจื™ืคึผื˜ืึธืคึผืจืึธ-ืึท (256-ื‘ื™ื˜), ืงืจื™ืคึผื˜ืึธืคึผืจืึธ-ื‘ (512-ื‘ื™ื˜)
  • ืคึผืขืจ-ืจืขืงืึธืจื“ TLSTREE ืจื™-ืงื™ืœื™ื ื’ โ€” ื˜ื•ื™ืฉืŸ ื“ืขื ืขื ืงืจื™ืคึผืฉืึทืŸ ืฉืœื™ืกืœ ืคึฟืึทืจ ื™ืขื“ืŸ TLS ืจืขืงืึธืจื“.
  • ืคืจืึทื’ืžืขื ื˜ืึทืฆื™ืข ืื•ืŸ ื•ื•ื™ื“ืขืจ-ืฆื•ื–ืึทืžืขื ืฉื˜ืขืœืŸ ืคื•ืŸ ื”ืึทื ื˜ืฉืขื™ืงืขืก ืื•ืŸ ืจืขืงืึธืจื“ืก (RFC 8446 ยง5.1).
  • ืกืขืกื™ืข ื•ื•ื™ื“ืขืจื”ืึธืœื•ื ื’: PSK ื“ื•ืจืš NewSessionTicket (PskStore ืื™ืŸ-ืžืขืžืึธืจื™, ืื™ื™ืŸ ืžืึธืœ-ื ื•ืฅ).
  • OCSP ื”ืขืคื˜ืŸ: ืกืขืจื•ื•ืขืจ ืœื™ื™ื’ื˜ ืฆื• ื“ื™ OCSP ืขื ื˜ืคืขืจ ืฆื•ื ืกืขืจื˜ื™ืคื™ืงืื˜.
  • ื ืืš-ื”ืื ื˜-ืฉืืงืœ ืžืขืกืขื“ื–ืฉืขืก: NewSessionTicket (ืืคื”ื™ื˜ืŸ ืคืืจ PSK).
  1. ืงืจื™ืคึผื˜ืึธื’ืจืึทืคึฟื™ืข:
  • ืฉืœื™ืกืœ ืคึผืœืึทืŸ: HKDF-ืกื˜ืจื™ื‘ืึธื’ (RFC 5869) ืื™ื‘ืขืจ TLS 1.3 (RFC 8446 ยง7.1).
  • ืจืขืงืึธืจื“ ืฉื•ืฅ: MGM-AEAD (ืงื•ื–ื ื™ืขื˜ืฉื™ืง) ืžื™ื˜ ื ืึธื ืก ืœื•ื™ื˜ RFC 8446 ยง5.3.
  • ืงื•ืจืฅ-ื˜ืขืจืžื™ืŸ ืฉืœื™ืกืœืขืŸ ื•ื•ืขืจืŸ ืื•ื™ืกื’ืขืžืขืงื˜ ื ืืš ื‘ืื ื™ืฅ.
  1. ืกืขืจื˜ื™ืคื™ืงืึทืฅ:
  • X.509v3 ืคึผืึทืจืกื™ื ื’ (GOST R 34.10-2012) โ€” ืื™ื™ื ื’ืขื‘ื•ื™ื˜ืขืจ DER ืคึผืึทืจืกืขืจ.
  • ื•ื•ืึทืœื™ื“ืึทืฆื™ืข ืงื™ื™ื˜: ื—ืชื™ืžื•ืช, DN (ืื•ื™ืกื’ืขื‘ืขืจ โ†’ ืกื•ื‘ื™ืขืงื˜), ื‘ืึทื–ื™ืฉืข ื‘ืึทื’ืจืขื ืขืฆื•ื ื’ืขืŸ, ืฉืœื™ืกืœ ื‘ืึทื ื™ืฅ, ืคืืจื‘ืจื™ื™ื˜ืขืจื˜ืข ืฉืœื™ืกืœ * ื‘ืึทื ื™ืฅ (serverAuth / clientAuth), pathLen.
  • ื”ืึธืกื˜ื ืึทืžืข ืงืึธื ื˜ืจืึธืœ: dNSName + iPAddress (RFC 6125).
  • ื•ื•ืขืจื™ืคื™ืงืืฆื™ืข ืคื•ืŸ โ€‹โ€‹OCSP ืขื ื˜ืคึฟืขืจืก (RFC 6960).

4.ื˜ืจืึทื ืกืคึผืึธืจื˜ืึทื˜ื™ืึธืŸ:

  • TlsTransport - ืฆื•ื‘ื™ื ื“.
  • InMemoryTlsTransport - ืคึฟืึทืจ ื˜ืขืกืฅ ืื•ืŸ ืื™ื™ืŸ-ืคึผืจืึธืฆืขืก ืกืฆืขื ืึทืจืŸ (ืื™ืŸ-ืžืขืžืึธืจื™ ืงื™ื•).
  • SocketTlsTransport โ€” ื‘ืœืึธืงื™ืจืŸ I/O ืื™ื‘ืขืจ java.net.Socket.
  • ื˜ืฉืึทื ืขืœ ื˜ื™ืœืก ื˜ืจืึทื ืกืคึผืึธืจื˜ - ื ื™ื™ืึธ ืกืึธืงืขื˜ ื˜ืฉืึทื ืขืœ-ื‘ืึทื–ื™ืจื˜ ื˜ืจืึทื ืกืคึผืึธืจื˜ (ื‘ืœืึธืงื™ืจื ื“ื™ืง ืžืึธื“ืข, ื™ื ื˜ืขืจืึทืคึผื˜ืึทื‘ืึทืœ).
  1. ืฉืจื™ื˜-ื‘ื™ื™-ืฉืจื™ื˜ ื”ืึทื ื˜-ืฉืึธืงืœืขืŸ:
  • TlsHandshakeEngine ืื™ื– ืึท ืฉื˜ืึทื˜ ืžืึทืฉื™ืŸ ืคึฟืึทืจ ื”ืขื ื“ืฉื™ื™ืง (ืึธืคึผื’ืขื˜ื™ื™ืœื˜ ืคึฟื•ืŸ I/O). ืขืก ื ื™ืฆื˜ TlsSession ื•ื•ื™ ืึทืŸ ืึธืจืงืขืกื˜ืจืึทื˜ืึธืจ ืื•ืŸ ืื™ื– ืคึผืึทืกื™ืง ืคึฟืึทืจ ืื™ื ื˜ืขื’ืจืึทืฆื™ืข ืžื™ื˜ JSSE (SSLEngine).
  1. ื‘ื™ื™ื˜ื‘ืึทืคืขืจ API:
  • TlsRecord.protect/unprotect โ€” ื‘ื™ื™ื˜ื‘ื•ืคืขืจ ืื™ื‘ืขืจืœืืกื˜ ืคืืจ ื ื•ืœ-ืงืืคื™ืข ืื™ื ื˜ืขื’ืจืืฆื™ืข ืžื™ื˜ NIO. ืœืึธื•ื“ื™ื ื’ ืฉืœื™ืกืœืขืŸ:
  • Pkcs12Loader โ€” ืœื™ื™ืขื ื˜ PFX (PKCS#12) ืžื™ื˜ PBKDF2-HMAC-SHA256 + AES-256-CBC.
  1. ืกื•ืฃ ืคื•ืŸ ืกืขืกื™ืข:
  • ืงืœืึธื•ื–_ื ืึธื˜ื™ืคึฟื™ - ืจื™ื›ื˜ื™ืงืข ืฉืœื™ืกื•ื ื’ ืœื•ื™ื˜ืŸ ืคึผืจืึธื˜ืึธืงืึธืœ.
  • ืื•ื™ืกื•ื•ื™ืฉืŸ ืคื•ืŸ ืฉืœื™ืกืœ ืžืึทื˜ืขืจื™ืึทืœ ื‘ื™ื™ื ืคืืจืžืื›ืŸ ืื“ืขืจ ืžืื›ืŸ ื ื˜ืขื•ืช.
  • ื”ืึทื ื“ืœื™ื ื’ ืึทืœืขืจื˜: ืคืึทื˜ืึทืœ - ื‘ืึทืœื“ื™ืงืข ืฉืœื™ืกืŸ + ืื•ื™ืกืžืขืงืŸ.
  1. ืื™ืžืคืœืขืžืขื ื˜ืืฆื™ืข ื–ื™ื›ืขืจื”ื™ื™ื˜:
  • ืงืื ืกื˜ืื ื˜-ืฆื™ื™ื˜ ืคืืจื’ืœื™ื™ื›ืŸ ืคืืจ verify_data ืื•ืŸ PSK ื‘ื™ื ื“ืขืจืก (ืฉื•ืฅ ืงืขื’ืŸ ืฆื™ื™ื˜ ืื˜ืืงืขืก)
  • ืื•ื™ืกืžืขืงืŸ ืฉืœื™ืกืœ ืžืึทื˜ืขืจื™ืึทืœ: destroy() ืื•ื™ืฃ ืึทืœืข ืึธื‘ื™ืขืงื˜ืŸ ืžื™ื˜ ืฉืœื™ืกืœืขืŸ (TlsKeySchedule, TlsTrafficKeys, TlsRecord, HandshakeContext), ื‘ื™ื™ ื ืึธืขื ื˜, ืคืึทื˜ืึทืœ ืึทืœืขืจื˜, ืื•ื™ืกื ืึทื ืื™ืŸ ื”ืึทื ื˜ืฉืขื™ืง
  • DoS ืฉื•ืฅ: ืœื™ืžื™ื˜ืŸ ืื•ื™ืฃ ืกืขืจื˜ื™ืคื™ืงืื˜ ืงื™ื™ื˜ ืœืขื ื’ (10), ืคึผืึธืกื˜-ื”ืขื ื“ืฉื™ื™ืง ืžืขืกืขื“ื–ืฉืขืก, ืจืขืงืึธืจื“ ื’ืจื™ื™ืก.
  • MGM ื ืึธื ืก: ื“ื™ MSB ืคื•ืŸ ื“ืขืจ ืขืจืฉื˜ืขืจ ื‘ื™ื™ื˜ ื•ื•ืขืจื˜ ืื•ื™ืกื’ืขืžืขืงื˜ ืคึฟืึทืจ ICN (RFC 9058 ยง3, RFC 9367 ยง3.3).
  • ื“ืขืจ ECDHE ืคึผืจื™ื•ื•ืึทื˜ืขืจ ืฉืœื™ืกืœ ืื•ืŸ ื”ืึทื ื“ืฉืขื™ืง ื˜ืจืึทื ืกืงืจื™ืคึผื˜ ื•ื•ืขืจืŸ ื—ืจื•ื‘ึฟ ื ืึธื›ื“ืขื ื•ื•ืึธืก ื“ืขืจ ื”ืึทื ื“ืฉืขื™ืง ืขื ื“ื™ื’ื˜ ื–ื™ืš.
  • HMAC ืฉืœื™ืกืœ ืžืึทื˜ืขืจื™ืึทืœ ื•ื•ืขืจื˜ ืื•ื™ืกื’ืขืžืขืงื˜ ื ืึธืš ื‘ืึทื ื™ืฅ (HkdfStreebog, KdfGostR3411_2012_256).
  1. ืœื™ืžื™ื˜ื™ื™ืฉืึทื ื–:
  • ื ืึธืจ ื•ื•ื™ื“ืขืจ-ืื•ื™ืคึฟื ืึทื PSK (0-RTT ืื•ืŸ ืขืงืกื˜ืขืจื ืข PSK ื•ื•ืขืจืŸ ื ื™ืฉื˜ ื’ืขืฉื˜ื™ืฆื˜).
  • ื ืึธืจ psk_dhe_ke (ืจื™ื™ืŸ PSK ืึธืŸ ECDHE ื•ื•ืขืจื˜ ื ื™ืฉื˜ ื’ืขืฉื˜ื™ืฆื˜).
  • HelloRetryRequest (RFC 8446 ยง4.1.4) ื•ื•ืขืจื˜ ื ื™ืฉื˜ ื’ืขืฉื˜ื™ืฆื˜ - ื ืืจ ืื™ื™ืŸ ื’ืจื•ืคืข ืžื™ื˜ืŸ ื ืืžืขืŸ ื•ื•ืขืจื˜ ื’ืขื ื•ืฆื˜ (GC256A ื“ื•ืจืš ื“ื™ืคืืœื˜).
  • ื ืึธืจ GOST (ื ื™ืฉื˜-GOST ืฆื™ืคึฟืขืจ ืกื•ื•ื™ืฅ ื•ื•ืขืจืŸ ื ื™ืฉื˜ ื’ืขืฉื˜ื™ืฆื˜).
  1. ื˜ืขืกื˜:
  • ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืื ื˜ื”ืืœื˜ ื‘ืึทืงืึทื ื˜ืข ืขื ื˜ืคึฟืขืจ ื˜ืขืกื˜ืŸ ืคึฟื•ืŸ RFC 9367 ืึทืคึผืขื ื“ื™ืงืก A.1 (L ืื•ืŸ S ื•ื•ืึทืจื™ืึทื ื˜ืŸ) โ€” ื“ืขืจ ื’ืึทื ืฆืขืจ ืฉืœื™ืกืœ ืคึผืœืึทืŸ, TLSTREE, AEAD, ืื•ืŸ ECDHE. ืขืก ื’ื™ื™ื˜ ืื•ื™ืš ื“ื•ืจืš ื“ืขื ื’ืึทื ืฆืŸ ืงื™ื™ื˜ ืคึฟื•ืŸ KAT ื˜ืขืกื˜ืŸ.
  • 4 ืื™ื ื˜ืขื’ืจืึทืฆื™ืข ื˜ืขืกื˜ืŸ (ื–ืขืœื‘ืกื˜-ืื™ื ื˜ืขืจืึธืคึผ) ื“ื•ืจืš ืขื›ื˜ืข TCP ืกืึธืงืขื˜ืก.
  • ืคืึทื– ื˜ืขืกื˜ืŸ ืคึฟืึทืจ ืคึผืึทืจืกืขืจืก: TlsMessageParser (8 ืžืขื˜ืึธื“ืŸ), TlsDerParser (3 ืžืขื˜ืึธื“ืŸ), TlsOcspVerifier (1 ืžืขื˜ืึธื“), ืฆื• ืขื ืฉื•ืจ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืื•ืŸ ืจืขื“ื•ืฆื™ืจืŸ ื“ืขื ืึทื˜ืึทืง ื•ื•ืขืงื˜ืึธืจ ืื•ื™ืฃ ืคึผืึทืจืกืขืจืก.
  1. ืึทืจื›ื™ื˜ืขืงื˜ื•ืจื™ืฉืข ืœื™ื™ื–ื•ื ื’ืขืŸ:
  • TlsHandshakeEngine - ืฉื˜ืึทื˜ ืžืึทืฉื™ืŸ ืืคื’ืขื˜ื™ื™ืœื˜ ืคื•ืŸ I/O (ืคึฟืึทืจ ืฆื•ืงื•ื ืคึฟื˜ื™ืงืŸ JSSE ืžืึธื“ื•ืœ).
  • ื‘ื™ื™ื˜ื‘ืึทืคืขืจ ืื™ื‘ืขืจืœืึธื•ื“ื– ืคื•ืŸ TlsRecord.protect/unprotect ืคึฟืึทืจ NIO/JSSE.
  • TLSTREE ืงืขืฉ (TlsTreeCache) - ืื™ื‘ืขืจืจืขื›ืขื ื•ื ื’ ื ืืจ ืคื•ืŸ ื’ืขืขื ื“ืขืจื˜ืข ืœืขื•ื•ืขืœืก (RFC 9367).
  • InMemoryTlsTransport.Pair ืื™ื– ืึท ื‘ื™ื™ื“ื™ืจืขืงืฉืึทื ืึทืœ ืคึผืึธืจ ืคึฟืึทืจ ื˜ืขืกืฅ ืื•ืŸ ืื™ื™ืŸ-ืคึผืจืึธืฆืขืก ืงืึธืžื•ื ื™ืงืึทืฆื™ืข.

ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ื•ื•ืขืจื˜ ืคืึทืจืฉืคึผืจื™ื™ื˜ ืื•ื ื˜ืขืจ ืึท ืคืจื™ื™ืขืจ ืœื™ืฆืขื ืฅ.

ืžืงื•ืจ: linux.org.ru

ืงื•ื™ืคืŸ ืคืึทืจืœืึธื–ืœืขืš ื”ืึธืกื˜ื™ื ื’ ืคึฟืึทืจ ื–ื™ื™ื˜ืœืขืš ืžื™ื˜ DDoS ืฉื•ืฅ, VPS VDS ืกืขืจื•ื•ืขืจืก ๐Ÿ”ฅ ืงื•ื™ืคื˜ ืคืึทืจืœืขืกืœืขื›ืข ื•ื•ืขื‘ื–ื™ื™ื˜ืœ ื”ืึธืกื˜ื™ื ื’ ืžื™ื˜ DDoS ืฉื•ืฅ, VPS VDS ืกืขืจื•ื•ืขืจืก | ProHoster