利用OpenSSL实现PKI中数字签名及数字验证的研究

主要介绍如何利用OpenSSL实现数字签名及数字验证,重点关注数字签名及数字验证的处理流程。通过对比实验,得到数字签名方案中的几个特点,并着重分析算法和公钥算法对数字签名方案效率的影响,为完善数字签名在实际通信安全领域中的应用提供建议。     

基于OpenSSL嵌入式椭圆曲线加密系统

针对嵌入式系统中信息安全的特点,选择椭圆曲线公钥密码体制ECC(Elliptic Curves Cryptosystem)作为加解密系统体制,应用开源安全软件开发包OpenSSL作为密码库开发了加解密系统。详细介绍了椭圆曲线密码体制的两种常用算法:EC-ELGamal与Menezes-Vanstone,在arm-linux平台上开发了完整的上述两种算法的加解密系统,在实际应用中对比、分析了两种算法的优缺点。分析表明:EC-ELGamal与Menezes-Vanstone两种椭圆曲线密码体制算法分别有其适合应用的领域。实践证明:OpenSSL在arm-linux和其他类型的嵌入式平台加密系统的设计方面有很大的易用性、通用性。     

异步消息驱动安全通信模块的设计与实现

为了保障多参数监护数据汇总系统的数据传输安全,设计并实现了一个高性能的安全通信模块.通过WSAAsyncSelect I/O模型构建了异步套接字事件多路分解及调度框架,运用安全套接字层协议保证数据传输的安全可靠,并通过多态技术提高了模块的可扩展性.最后在Win32平台上实现了一个数据汇总通信系统作为示例,测试验证了安全...     

A unified and flexible solution for integrating CRL and OCSP into PKI applications

Public key certificates (PKCs) are used nowadays in several security protocols and applications, so as to secure data exchange via transport layer security channels, or to protect data at the application level by means of digital signatures. However, many security applications often fail to manage properly the PKCs, in particular when checking their validity status. These failures are partly due to the lack of experience (or training) of the users who configure these applications or protocols, and partly due to the scarce support offered by some common cryptographic libraries to the application developers. This paper describes the design and implementation of a light middleware dealing with certificate validation in a unified way. Our middleware exploits on one side the libraries that have already been defined or implemented for certificate validation, and it constructs a thin layer, which provides flexibility and security features to the upper layer applications. In our current approach, this layer boasts an integrated approach to support various certificate revocation mechanisms, it protects the applications from some common security attacks, and offers several configuration and performance options to the programmers and to the end users. We describe the architecture of this approach as well as its practical implementation in the form of a library based on the famous OpenSSL security library, and that can be easily integrated with other certificate‐aware security applications. Copyright © 2009 John Wiley & Sons, Ltd.     

OpenSSL Heartbleed漏洞研究及启示

2014年4月8日,OpenSSL爆出其加密代码中一种名为Heartbleed的严重安全漏洞。利用该漏洞,攻击者在对客户端OpenSSL代码进行修改后,就能从内存中读取请求存储位置之外的多达64 KB的数据,这段内存数据可能包含证书私钥、用户名与密码、聊天信息、电子邮件、重要的商业文档、通信等数据。目前,绝大多数的电商以及网络支付的登录服务都是使用OpenSSL协议进行搭建的,所以该漏洞有着极为深远的影响。因此第一时间对该漏洞进行研究,分析,修复,是整个安全领域的首要任务。     

数字证书的研究与实现

在PKI系统中,都会涉及到数字证书的知识,本文从非数字证书格式出发,与数字证书格式进行了详细的比对。在深刻分析了X．509数字证书格式的基础上,介绍了制作数字证书的具体方法,并对基于OpenSSL的制作方法进行了详细的阐述和具体的实现,弥补了以往证书创建过程的不明确性。对未来证书系统的推进和实施有较强的现实意义。     

A technique to circumvent SSL/TLS validations on iOS devices

SSL/TLS validations such as certificate and public key pinning can reinforce the security of encrypted communications between Internet-of-Things devices and remote servers, and ensure the privacy of users. However, such implementations complicate forensic analysis and detection of information disclosure; say, when a mobile app breaches user’s privacy by sending sensitive information to third parties. Therefore, it is crucial to develop the capacity to vet mobile apps augmenting the security of SSL/TLS traffic. In this paper, we propose a technique to bypass the system’s default certificate validation as well as built-in SSL/TLS validations performed in iOS apps. We then demonstrate its utility by analysing 40 popular iOS social networking, electronic payment, banking, and cloud computing apps.     

OpenSSL HeartBleed漏洞分析及检测技术研究

HeartBleed漏洞是一个严重的安全漏洞。分析了OpenSSL中心跳机制的源代码,在代码层次总结了HeartBleed漏洞产生的原因。采用Python语言实现了漏洞检测脚本工具,通过发送心跳信息长度与长度字段不一致的心跳数据包,并根据响应数据包的类型和响应数据的长度,判断目标是否存在HeartBleed漏洞。针对应用OpenSSL的Web网站以及网络服务的服务器进行了检测实验。与已有检测工具的比较实验表明,实现的检测脚本工具检测范围广,检测时间快,正确率高,可以有效完成HeartBleed漏洞的检测工作。     

AES访问驱动Cache计时攻击

首先给出了访问驱动Cache计时攻击的模型,提出了该模型下直接分析、排除分析两种通用的AES加密泄漏Cache信息分析方法;然后建立了AES加密Cache信息泄露模型,并在此基础上对排除分析攻击所需样本量进行了定量分析,给出了攻击中可能遇到问题的解决方案;最后结合OpenSSL v.0.9.8a,v.0.9.8j中两种...     

SSL VPN的设计与实现

虚拟专用网络(VPN,Virtual Private Network)正迅速成为远程存取应用中最为普及的一种方法;安全套接层协议SSL是用来保障数据安全传输的协议,目前已经成为事实上的工业标准;两者的结合——SSL VPN(Secure Socket Layer Virtual Private Network)正成为远程安全接入市场上的一个热点。通过对SSL VPN三种不同实现方案的分析比较,结合OpenSSL和Zebra设计实现了SSL VPN服务器,该方案使用隧道连接方式,能够在不更改应用程序的条件下,为企业提供全网接入的能力。