whisper-medium

1
00:00:00,000 --> 00:00:10,000
(音樂)

2
00:00:10,000 --> 00:00:14,000
我想開始的話,我們會先從幾個簡單的定義

3
00:00:14,000 --> 00:00:18,000
就是這一張的目的主要是希望大家先有個概念

4
00:00:18,000 --> 00:00:21,000
有個印象,有個圖像的印象

5
00:00:21,000 --> 00:00:24,000
首先的話是PUBG RT

6
00:00:24,000 --> 00:00:27,000
PUBG RT當然是,它是SAMMA的其中一個IP的產品

7
00:00:27,000 --> 00:00:30,000
但以目前來講的話,我們就先把它當作是

8
00:00:30,000 --> 00:00:33,000
有一把保管好的KEY這樣

9
00:00:33,000 --> 00:00:35,000
所以這個KEY外面有一個框框

10
00:00:35,000 --> 00:00:38,000
再來的話,第二個是叫AES

11
00:00:38,000 --> 00:00:41,000
AES的話,圖像上的話大家可以看到

12
00:00:41,000 --> 00:00:43,000
它是有一個藍色的大寫A

13
00:00:43,000 --> 00:00:47,000
然後經過了藍色的箭頭到AES的block裡面

14
00:00:47,000 --> 00:00:51,000
並且有一把鑰匙從上面加入

15
00:00:51,000 --> 00:00:54,000
最後得到的output是大寫的A'

16
00:00:54,000 --> 00:00:59,000
這個的話,我們用這樣的意象想要講的是

17
00:00:59,000 --> 00:01:01,000
它是一個加密的過程

18
00:01:01,000 --> 00:01:05,000
就是從原本的型態A然後轉成A'

19
00:01:05,000 --> 00:01:09,000
同樣的AES的block也能夠支援的是說

20
00:01:09,000 --> 00:01:11,000
它能夠返回來做

21
00:01:11,000 --> 00:01:15,000
就是把原本的A' block一樣是進到AES

22
00:01:15,000 --> 00:01:17,000
走綠色的箭頭

23
00:01:17,000 --> 00:01:20,000
並且也加入了同樣的一把黃色的KEY

24
00:01:20,000 --> 00:01:24,000
然後它會得到的output是能夠還原回來原本的大寫A

25
00:01:24,000 --> 00:01:28,000
這個就是相當於算解密的過程

26
00:01:28,000 --> 00:01:31,000
下一個的話,我們這邊列的是ECC

27
00:01:31,000 --> 00:01:35,000
這邊的話,ECC講的是橢圓曲線的密碼學

28
00:01:35,000 --> 00:01:39,000
簡單的來說的話,它這邊比較不一樣的是說

29
00:01:39,000 --> 00:01:40,000
它的KEY上面是有寫字的

30
00:01:40,000 --> 00:01:42,000
它是有一個S跟一個P

31
00:01:42,000 --> 00:01:45,000
我們這邊講叫secret或是public key

32
00:01:45,000 --> 00:01:47,000
它是有一個私要跟公要的

33
00:01:47,000 --> 00:01:51,000
它這邊在做的事情是說你把其中一把綠色的

34
00:01:51,000 --> 00:01:55,000
比方說叫私要寫S的這一把

35
00:01:55,000 --> 00:01:57,000
進到ECC的block之後

36
00:01:57,000 --> 00:02:02,000
它能夠出來的是一個黃色的public key公要

37
00:02:02,000 --> 00:02:06,000
並且這個動作它是無法還原的

38
00:02:06,000 --> 00:02:10,000
你從公要是沒有辦法還原回私要的

39
00:02:10,000 --> 00:02:13,000
所以它的黃色箭頭回來的這個箭頭這邊打了查

40
00:02:13,000 --> 00:02:15,000
這個是還蠻重要的

41
00:02:15,000 --> 00:02:18,000
所以它基本上可以想成是

42
00:02:18,000 --> 00:02:22,000
由從一把私要產生另外一把公要的過程

43
00:02:22,000 --> 00:02:24,000
再來是最下面的這個叫Hash

44
00:02:24,000 --> 00:02:27,000
這個Hash相信其實它不只在密碼學裡面會出現

45
00:02:27,000 --> 00:02:30,000
在其他很多資訊科學裡面也會用得到

46
00:02:30,000 --> 00:02:32,000
這個的話我們給它的意象是說

47
00:02:32,000 --> 00:02:34,000
它是有一個大寫A

48
00:02:34,000 --> 00:02:37,000
然後進到這個像果汁機的雜碩函數

49
00:02:37,000 --> 00:02:38,000
就是這個東西

50
00:02:38,000 --> 00:02:41,000
然後它得到的output是一個小寫A

51
00:02:41,000 --> 00:02:43,000
在這邊我們用小寫主要是想要描述說

52
00:02:43,000 --> 00:02:46,000
它是類似一個壓縮成一個摘要的這樣的過程

53
00:02:46,000 --> 00:02:50,000
同時這個Hash這個果汁機

54
00:02:50,000 --> 00:02:53,000
我們都知道打成果汁之後也是沒有辦法還原回水果的

55
00:02:53,000 --> 00:02:57,000
所以它在這邊是一個單向的一個函數

56
00:02:57,000 --> 00:03:00,000
並且無法從output倒回input這樣

57
00:03:00,000 --> 00:03:04,000
所以這邊這一些簡單的定義

58
00:03:04,000 --> 00:03:07,000
就是希望大家能夠先有一個印象就好

59
00:03:07,000 --> 00:03:10,000
接下來的內容也會跟這些

60
00:03:10,000 --> 00:03:13,000
慢慢會知道說這些定義

61
00:03:13,000 --> 00:03:16,000
跟接下來的內容有什麼樣的相關

62
00:03:16,000 --> 00:03:21,000
在這邊的話最主要我們談的

63
00:03:21,000 --> 00:03:23,000
今天要談的是密碼學這件事情

64
00:03:23,000 --> 00:03:27,000
密碼學這件事情的話簡單的來分類的話

65
00:03:27,000 --> 00:03:30,000
它大概其實是幾種不同的目標

66
00:03:30,000 --> 00:03:33,000
這邊的話其實總共列了有五個黃色的格子

67
00:03:33,000 --> 00:03:35,000
可是它其實只有四種

68
00:03:35,000 --> 00:03:37,000
一種一種開始講的話

69
00:03:37,000 --> 00:03:39,000
第一個我們會看到是左邊A這邊

70
00:03:39,000 --> 00:03:43,000
它這邊有叫confidentiality叫保密性

71
00:03:43,000 --> 00:03:46,000
並且它這邊是畫了一個圖是說

72
00:03:46,000 --> 00:03:48,000
它有資料存在身上

73
00:03:48,000 --> 00:03:51,000
當然我們希望資料保密

74
00:03:51,000 --> 00:03:54,000
但是這個保密它其實會分兩種情境

75
00:03:54,000 --> 00:03:57,000
一種是說資料在靜態儲存的時候

76
00:03:57,000 --> 00:03:59,000
我們希望它不會被偷走

77
00:03:59,000 --> 00:04:01,000
希望不會有別人知道這個內容

78
00:04:01,000 --> 00:04:04,000
另外一種是說在傳輸的過程中

79
00:04:04,000 --> 00:04:07,000
我們希望它也能夠保持隱密

80
00:04:07,000 --> 00:04:11,000
不會有我們不想要的接收方去收到

81
00:04:11,000 --> 00:04:15,000
所以它大概是說

82
00:04:15,000 --> 00:04:18,000
如果你今天在傳輸訊息的過程中

83
00:04:18,000 --> 00:04:20,000
你傳的是一個叫做plain text

84
00:04:20,000 --> 00:04:22,000
名文這樣的形式的話

85
00:04:22,000 --> 00:04:26,000
當然很容易這個communication的通道

86
00:04:26,000 --> 00:04:28,000
就會被竊停或是被竊取

87
00:04:28,000 --> 00:04:32,000
所以這個是保密性的這件事情這個目標

88
00:04:32,000 --> 00:04:34,000
第二個我們看到的是

89
00:04:34,000 --> 00:04:36,000
這邊寫的叫做data integrity

90
00:04:36,000 --> 00:04:38,000
叫做資料完整性

91
00:04:38,000 --> 00:04:40,000
這個資料完整性的話簡單的講是說

92
00:04:40,000 --> 00:04:46,000
我要如何確定我的訊息或是資料沒有被篡改

93
00:04:46,000 --> 00:04:50,000
沒有被篡改就表示它保持完整原樣

94
00:04:50,000 --> 00:04:54,000
這個的話一個很簡單的例子是說

95
00:04:54,000 --> 00:04:58,000
假設我們現在把我們自己電腦裡面的資料

96
00:04:58,000 --> 00:05:00,000
去上傳到雲端硬碟

97
00:05:00,000 --> 00:05:03,000
我們上傳了一段時間之後

98
00:05:03,000 --> 00:05:05,000
過一陣子我們要再把它拿下來

99
00:05:05,000 --> 00:05:07,000
那我們如何能夠知道說

100
00:05:07,000 --> 00:05:11,000
我們拿下來的資料是正確的沒有被改過的

101
00:05:11,000 --> 00:05:13,000
這個是資料完整性的意思

102
00:05:13,000 --> 00:05:16,000
它所面臨的威脅就是說

103
00:05:16,000 --> 00:05:18,000
有可能在傳輸的過程中

104
00:05:18,000 --> 00:05:22,000
然後有惡意的第三方會去偽造

105
00:05:22,000 --> 00:05:24,000
或者是篡改這樣的訊息

106
00:05:24,000 --> 00:05:27,000
第三個講到這邊是叫做authenticity

107
00:05:27,000 --> 00:05:29,000
叫做認證性

108
00:05:29,000 --> 00:05:33,000
這個的話比較單純就是說

109
00:05:33,000 --> 00:05:35,000
我們想要知道說這個溝通裡面

110
00:05:35,000 --> 00:05:38,000
會有訊息的傳送方跟接收方

111
00:05:38,000 --> 00:05:42,000
傳送方要能夠知道收到訊息的是正確的接收方

112
00:05:42,000 --> 00:05:47,000
那反之亦然就是說這個認證往往是一個雙向的過程

113
00:05:47,000 --> 00:05:50,000
我傳訊息的人要知道收訊息的人是對的

114
00:05:50,000 --> 00:05:53,000
收訊息的人也要知道傳訊息的人是對的

115
00:05:53,000 --> 00:05:57,000
那第四個講的叫做不可否認性

116
00:05:57,000 --> 00:06:02,000
它指向的一種問題是所謂像delay或者是否認

117
00:06:02,000 --> 00:06:04,000
具體來說的話是說

118
00:06:04,000 --> 00:06:10,000
簡單來說比方說可能A跟B說要借錢

119
00:06:10,000 --> 00:06:14,000
那過一陣子然後A跟B說我沒有說過

120
00:06:14,000 --> 00:06:15,000
我沒有說過要跟你借錢

121
00:06:15,000 --> 00:06:18,000
那這種情況下以借錢這個例子的話

122
00:06:18,000 --> 00:06:21,000
很容易聯想到說我們要怎麼樣解決這個問題

123
00:06:21,000 --> 00:06:23,000
其實就是要人家去押簽名

124
00:06:23,000 --> 00:06:28,000
在密碼學裡面這樣也是類似這樣的做法

125
00:06:28,000 --> 00:06:30,000
那就是會用一種叫數位簽章的方式

126
00:06:30,000 --> 00:06:34,000
基本上就是能夠確保來源之外

127
00:06:34,000 --> 00:06:38,000
也要能夠確保曾經說過什麼或做過什麼

128
00:06:38,000 --> 00:06:40,000
所以其實在這邊不可否認性的話

129
00:06:40,000 --> 00:06:43,000
可以把它想成類似既符合認證性

130
00:06:43,000 --> 00:06:45,000
也符合資料完整性

131
00:06:45,000 --> 00:06:47,000
這兩個都必須要具備

132
00:06:47,000 --> 00:06:52,000
所以簡單的情境來講大概是這樣子

133
00:06:52,000 --> 00:06:57,000
接下來的話我們會再從各個裡面去細節

134
00:06:57,000 --> 00:07:01,000
去看說大概有什麼樣的做法

135
00:07:01,000 --> 00:07:09,000
所以到目前到這邊有任何疑問嗎

136
00:07:09,000 --> 00:07:11,000
那首先我們要

137
00:07:11,000 --> 00:07:14,000
接下來我們就要看的是各個安全目標

138
00:07:14,000 --> 00:07:16,000
首先我們要看到的是保密性

139
00:07:16,000 --> 00:07:18,000
那保密性來講剛剛提過說

140
00:07:18,000 --> 00:07:22,000
我們不想要讓資料洩漏出去

141
00:07:22,000 --> 00:07:26,000
所以最直覺的做法就是我們要去做加密

142
00:07:26,000 --> 00:07:33,000
所以以一個簡單的情境來講的話

143
00:07:33,000 --> 00:07:37,000
這個溝通往往是A傳送訊息

144
00:07:37,000 --> 00:07:39,000
經過一個通訊網路到B這邊

145
00:07:39,000 --> 00:07:44,000
我們首先要介紹的是對稱式的加密

146
00:07:44,000 --> 00:07:48,000
跟我們在一開始提過的定義裡面

147
00:07:48,000 --> 00:07:50,000
它跟AES的block還蠻像

148
00:07:50,000 --> 00:07:54,000
就是說它的重點是它是用同一把key來做加密

149
00:07:54,000 --> 00:07:56,000
同一把key所以叫對稱

150
00:07:56,000 --> 00:07:58,000
那這邊簡單的看一下它的流程

151
00:07:58,000 --> 00:08:00,000
它的流程大概會是說

152
00:08:00,000 --> 00:08:03,000
A把本來要傳的我們叫明文的plain text

153
00:08:03,000 --> 00:08:04,000
然後經過一個鑰匙

154
00:08:04,000 --> 00:08:08,000
然後加密變成這一個帶有鎖跟問號的方塊

155
00:08:08,000 --> 00:08:10,000
我們叫它密文

156
00:08:10,000 --> 00:08:12,000
這個密文會傳過來到

157
00:08:12,000 --> 00:08:14,000
就經過通訊網路

158
00:08:14,000 --> 00:08:16,000
然後傳到B手上

159
00:08:16,000 --> 00:08:20,000
B因為它擁有這把同樣的黃色鑰匙

160
00:08:20,000 --> 00:08:24,000
所以它可以把它還原回原本的這個明文

161
00:08:24,000 --> 00:08:26,000
至於惡意的第三方X

162
00:08:26,000 --> 00:08:28,000
它手上沒有這把鑰匙的時候

163
00:08:28,000 --> 00:08:32,000
它就沒有辦法去解開這個密文

164
00:08:32,000 --> 00:08:34,000
它的基本的概念是這樣

165
00:08:34,000 --> 00:08:38,000
所以光從剛剛的敘述應該已經可以知道說

166
00:08:38,000 --> 00:08:40,000
這整件事情的安全性

167
00:08:40,000 --> 00:08:42,000
最主要是建立在說

168
00:08:42,000 --> 00:08:44,000
你只要沒有這把黃色的鑰匙

169
00:08:44,000 --> 00:08:46,000
你就沒有辦法解讀這個訊息

170
00:08:46,000 --> 00:08:50,000
它的安全性是建立在這個機制上面

171
00:08:50,000 --> 00:08:52,000
所以對稱式的這種加密的方法

172
00:08:52,000 --> 00:08:54,000
它一般來講有幾項特性

173
00:08:54,000 --> 00:08:56,000
我們講的比較模糊一點的話

174
00:08:56,000 --> 00:09:00,000
就是它算它速度很快

175
00:09:00,000 --> 00:09:02,000
然後安全性也很高

176
00:09:02,000 --> 00:09:04,000
但是它有一個致命的缺陷

177
00:09:04,000 --> 00:09:06,000
是它需要這個經要傳遞

178
00:09:06,000 --> 00:09:10,000
經要傳遞的問題我們稍後會再提

179
00:09:10,000 --> 00:09:16,000
這邊我們用一個很簡單的例子來看

180
00:09:16,000 --> 00:09:18,000
對稱式加密這件事情

181
00:09:18,000 --> 00:09:22,000
首先我們看到左邊在做加密的時候

182
00:09:22,000 --> 00:09:24,000
我們有訊息鑰匙跟密文

183
00:09:24,000 --> 00:09:26,000
這邊我們把它都用4個bit

184
00:09:26,000 --> 00:09:28,000
然後用exclusive word

185
00:09:28,000 --> 00:09:30,000
exclusive word來講

186
00:09:30,000 --> 00:09:32,000
在這邊就是我們的加密的函數

187
00:09:32,000 --> 00:09:34,000
我想這大家應該蠻熟悉的

188
00:09:34,000 --> 00:09:36,000
這邊有它的真值表

189
00:09:36,000 --> 00:09:38,000
然後跟我們要怎麼樣用exclusive word

190
00:09:38,000 --> 00:09:40,000
來做加密跟解密

191
00:09:40,000 --> 00:09:42,000
它的原理主要是說

192
00:09:42,000 --> 00:09:46,000
它有交換率跟結合率的關係

193
00:09:46,000 --> 00:09:50,000
所以我今天把一個名文

194
00:09:50,000 --> 00:09:54,000
然後經過這把鑰匙去operate之後

195
00:09:54,000 --> 00:09:56,000
得到了這個密文1001

196
00:09:56,000 --> 00:09:58,000
在解密的時候

197
00:09:58,000 --> 00:10:00,000
我一樣把這個1001

198
00:10:00,000 --> 00:10:03,000
再次對這個經要做exclusive word的運算之後

199
00:10:03,000 --> 00:10:05,000
得回來的會是原本的名文

200
00:10:05,000 --> 00:10:07,000
它是一個簡單的概念

201
00:10:07,000 --> 00:10:09,000
所以在這裡面的重點是說

202
00:10:09,000 --> 00:10:12,000
第一個它用的加密的方法是exclusive word

203
00:10:12,000 --> 00:10:16,000
另外就是它是依靠同一把經要

204
00:10:16,000 --> 00:10:17,000
所以你沒有這把經要

205
00:10:17,000 --> 00:10:19,000
你是沒有辦法解回訊息的

206
00:10:19,000 --> 00:10:22,000
這是一個簡單的範例

207
00:10:22,000 --> 00:10:25,000
就是對稱式演算法大概是這麼做的

208
00:10:25,000 --> 00:10:32,000
再來會補充一點

209
00:10:32,000 --> 00:10:34,000
就是對稱式演算法

210
00:10:34,000 --> 00:10:37,000
對稱式加密它的一些性質

211
00:10:37,000 --> 00:10:40,000
像剛剛我們看到的exclusive word來講的話

212
00:10:40,000 --> 00:10:42,000
大家應該可以想像

213
00:10:42,000 --> 00:10:44,000
它的安全強度相對算是蠻低的

214
00:10:44,000 --> 00:10:46,000
因為還蠻容易破解的

215
00:10:46,000 --> 00:10:48,000
它之所以容易破解的

216
00:10:48,000 --> 00:10:50,000
其中一個主要的理由是在於說

217
00:10:50,000 --> 00:10:52,000
它的運算來講是比較線性的

218
00:10:52,000 --> 00:10:55,000
所以一般而言

219
00:10:55,000 --> 00:10:59,000
這種現在常用合規定

220
00:10:59,000 --> 00:11:01,000
夠安全的這種對稱式演算法來講

221
00:11:01,000 --> 00:11:03,000
它通常會帶有幾種運算

222
00:11:03,000 --> 00:11:07,000
像它會帶的是這種

223
00:11:07,000 --> 00:11:09,000
置換 substitution

224
00:11:09,000 --> 00:11:11,000
跟排列的這種運算

225
00:11:11,000 --> 00:11:15,000
排列置換我想應該蠻容易理解

226
00:11:15,000 --> 00:11:17,000
它其實完全就是一個非線性的

227
00:11:17,000 --> 00:11:19,000
排列的話不管你是怎麼樣排

228
00:11:19,000 --> 00:11:21,000
你是重新排列

229
00:11:21,000 --> 00:11:23,000
或是你是transpose

230
00:11:23,000 --> 00:11:25,000
或是做怎麼樣的這種transposition

231
00:11:25,000 --> 00:11:27,000
或是去做mapping來講

232
00:11:27,000 --> 00:11:29,000
它其實某種程度上都

233
00:11:29,000 --> 00:11:31,000
只要是它是屬於排列的這種行為

234
00:11:31,000 --> 00:11:33,000
它都算是線性的

235
00:11:33,000 --> 00:11:35,000
線性的以運算來講

236
00:11:35,000 --> 00:11:37,000
就等於說容易推倒

237
00:11:37,000 --> 00:11:41,000
所以現在普遍會在使用的

238
00:11:41,000 --> 00:11:43,000
對稱式加密演算法來講

239
00:11:43,000 --> 00:11:45,000
它的演算法的結構

240
00:11:45,000 --> 00:11:47,000
通常都一定會帶有

241
00:11:47,000 --> 00:11:49,000
至少一個非線性的運算

242
00:11:49,000 --> 00:11:51,000
比方說以現在來講

243
00:11:51,000 --> 00:11:53,000
最常用的是下面列的AES

244
00:11:53,000 --> 00:11:57,000
AES的話熟的可能會知道說

245
00:11:57,000 --> 00:11:59,000
它大概大致上算是

246
00:11:59,000 --> 00:12:01,000
有四個transformation在做

247
00:12:01,000 --> 00:12:05,000
其中只有一個叫subbite的這個步驟

248
00:12:05,000 --> 00:12:07,000
是在做substitution

249
00:12:07,000 --> 00:12:09,000
它是用類似查表的方式

250
00:12:09,000 --> 00:12:11,000
然後去把值換掉

251
00:12:11,000 --> 00:12:13,000
其餘的都算是線性的運算

252
00:12:13,000 --> 00:12:15,000
都是shift

253
00:12:15,000 --> 00:12:17,000
或是去做矩陣的懲罰

254
00:12:17,000 --> 00:12:19,000
這種類似是比較是線性的運算

255
00:12:19,000 --> 00:12:21,000
而且一般來講

256
00:12:21,000 --> 00:12:25,000
為了就是也同樣要符合效率

257
00:12:25,000 --> 00:12:28,000
所以其實只要有一個非線性的運算

258
00:12:28,000 --> 00:12:30,000
它就算是足夠安全

259
00:12:30,000 --> 00:12:32,000
也因為非線性運算

260
00:12:32,000 --> 00:12:34,000
它需要資源的關係

261
00:12:34,000 --> 00:12:36,000
所以其實通常

262
00:12:36,000 --> 00:12:38,000
在對稱式的加密演算法裡面

263
00:12:38,000 --> 00:12:40,000
非對稱式的運算

264
00:12:40,000 --> 00:12:42,000
也就只有那麼一個

265
00:12:42,000 --> 00:12:44,000
其他都會是線性的排列

266
00:12:44,000 --> 00:12:47,000
下面這張表的話是列出說

267
00:12:47,000 --> 00:12:49,000
目前最主要有在使用的哪一些

268
00:12:49,000 --> 00:12:51,000
你這邊可以看到的話

269
00:12:51,000 --> 00:12:56,000
以前的大概在1997年以前

270
00:12:56,000 --> 00:12:59,000
在用的都是一種叫做DES

271
00:12:59,000 --> 00:13:01,000
叫做Data Encryption Standard

272
00:13:01,000 --> 00:13:03,000
一種舊型的加密演算法

273
00:13:03,000 --> 00:13:06,000
到接近1997年的時候

274
00:13:06,000 --> 00:13:08,000
因為它的安全性已經開始下降

275
00:13:08,000 --> 00:13:10,000
所以那個時候有去做

276
00:13:10,000 --> 00:13:13,000
比方說把它變成triple dash

277
00:13:13,000 --> 00:13:15,000
就是說把它疊三次

278
00:13:15,000 --> 00:13:17,000
然後可能中間用兩把不同的key

279
00:13:17,000 --> 00:13:19,000
或是用三把不同的key這樣

280
00:13:19,000 --> 00:13:22,000
這些來講到現在都已經非常勉強

281
00:13:22,000 --> 00:13:24,000
所以才會有開始

282
00:13:24,000 --> 00:13:27,000
從1997年開始有現在的叫做AES

283
00:13:27,000 --> 00:13:30,000
DES叫做Data Encryption Standard

284
00:13:30,000 --> 00:13:32,000
AES的A叫Advanced

285
00:13:32,000 --> 00:13:33,000
就是進階加密標準

286
00:13:33,000 --> 00:13:35,000
如果去查AES的話

287
00:13:35,000 --> 00:13:37,000
通常會查到這樣的翻譯

288
00:13:37,000 --> 00:13:39,000
所以這邊列的主要的

289
00:13:39,000 --> 00:13:41,000
另外一個可以補充的是說

290
00:13:41,000 --> 00:13:43,000
這邊可以看到是在

291
00:13:43,000 --> 00:13:46,000
2-key的triple dash的使用情境裡面

292
00:13:46,000 --> 00:13:48,000
它已經不被允許做加密

293
00:13:48,000 --> 00:13:52,000
但是可以在Legacy Use的場合下去做解密

294
00:13:52,000 --> 00:13:56,000
這個就跟我們一般很常會遇到的狀況一樣

295
00:13:56,000 --> 00:13:58,000
就是說你可能以前出的產品

296
00:13:58,000 --> 00:14:00,000
已經deploy到Field裡面

297
00:14:00,000 --> 00:14:02,000
你後面再出的時候

298
00:14:02,000 --> 00:14:04,000
它必須至少要能夠解讀

299
00:14:04,000 --> 00:14:06,000
當初前一代產品

300
00:14:06,000 --> 00:14:09,000
用2-key triple dash所加密的訊息

301
00:14:09,000 --> 00:14:11,000
它至少要能夠解讀

302
00:14:11,000 --> 00:14:12,000
但是因為安全性的問題

303
00:14:12,000 --> 00:14:14,000
它已經不再容許

304
00:14:14,000 --> 00:14:16,000
用同樣舊的方法去做加密

305
00:14:16,000 --> 00:14:21,000
這個大概的概念是這樣

306
00:14:21,000 --> 00:14:24,000
所以現在來講最流行

307
00:14:24,000 --> 00:14:26,000
然後最常被使用的是

308
00:14:26,000 --> 00:14:28,000
這邊列的最下面這一列

309
00:14:28,000 --> 00:14:32,000
AES的128或是192或是256

310
00:14:32,000 --> 00:14:34,000
這個數字的話

311
00:14:34,000 --> 00:14:36,000
大家大概有個印象就好

312
00:14:36,000 --> 00:14:38,000
就是說它是以一個區塊

313
00:14:38,000 --> 00:14:40,000
一個區塊來做加密的

314
00:14:40,000 --> 00:14:42,000
所以不管你的輸入多長

315
00:14:42,000 --> 00:14:44,000
它都是照這樣的數字去切分它

316
00:14:44,000 --> 00:14:46,000
一個區塊來做加密這樣

317
00:14:46,000 --> 00:14:50,000
到這邊有任何問題嗎

318
00:14:50,000 --> 00:15:02,000
再來繼續講到的是

319
00:15:02,000 --> 00:15:04,000
在我們講到加密的時候

320
00:15:04,000 --> 00:15:06,000
它是有另外一種做法

321
00:15:06,000 --> 00:15:08,000
叫做有對稱就有非對稱

322
00:15:08,000 --> 00:15:10,000
這邊講的是非對稱式的加密的做法

323
00:15:12,000 --> 00:15:14,000
它的流程大概跟我們前面有看過

324
00:15:14,000 --> 00:15:16,000
有兩種不同的鑰匙的情境

325
00:15:16,000 --> 00:15:18,000
有私鑰跟公鑰的情境

326
00:15:18,000 --> 00:15:22,000
我們先簡單的提一下它的流程

327
00:15:22,000 --> 00:15:24,000
它的流程大概會是這樣

328
00:15:24,000 --> 00:15:28,000
就是說今天A要傳送訊息給B的時候

329
00:15:28,000 --> 00:15:30,000
特別要注意

330
00:15:30,000 --> 00:15:32,000
有這兩把鑰匙這邊列的P跟S

331
00:15:32,000 --> 00:15:36,000
一樣是一把是私鑰一把是公鑰

332
00:15:36,000 --> 00:15:40,000
這兩把鑰匙都是訊息接收方B的

333
00:15:40,000 --> 00:15:42,000
這個很重要

334
00:15:42,000 --> 00:15:46,000
所以有了這兩把鑰匙

335
00:15:46,000 --> 00:15:48,000
然後怎麼做加密的溝通

336
00:15:48,000 --> 00:15:52,000
訊息傳送方A

337
00:15:52,000 --> 00:15:54,000
它會把這個Planetax

338
00:15:54,000 --> 00:15:56,000
它要傳送的訊息明文

339
00:15:56,000 --> 00:15:58,000
然後用訊息接收方B

340
00:15:58,000 --> 00:16:00,000
這個人的公鑰做加密

341
00:16:00,000 --> 00:16:04,000
然後傳送這個密文過來

342
00:16:04,000 --> 00:16:08,000
收到這個訊息

343
00:16:08,000 --> 00:16:10,000
收到這個密文的接收方B

344
00:16:10,000 --> 00:16:12,000
它會去用它自己

345
00:16:12,000 --> 00:16:14,000
同樣是B這個人的私鑰

346
00:16:14,000 --> 00:16:16,000
去做解密把它還原回原本的訊息

347
00:16:16,000 --> 00:16:22,000
所以這個蠻重要就是說

348
00:16:22,000 --> 00:16:24,000
在這樣的情境裡面

349
00:16:24,000 --> 00:16:26,000
在這樣溝通的情境裡面

350
00:16:26,000 --> 00:16:28,000
這兩把鑰匙都是屬於

351
00:16:28,000 --> 00:16:30,000
訊息接收方B的

352
00:16:30,000 --> 00:16:32,000
那為什麼A有這把鑰匙可以用

353
00:16:32,000 --> 00:16:34,000
因為顧名思義了

354
00:16:34,000 --> 00:16:36,000
它叫公鑰

355
00:16:36,000 --> 00:16:38,000
我們是希望它是能夠公開的

356
00:16:38,000 --> 00:16:40,000
但是反過來講的話

357
00:16:40,000 --> 00:16:42,000
這把私鑰是絕對不會出去

358
00:16:42,000 --> 00:16:44,000
是只有B才有的

359
00:16:44,000 --> 00:16:46,000
非對稱式的這個

360
00:16:46,000 --> 00:16:48,000
或是說公開禁鑰密碼學的

361
00:16:48,000 --> 00:16:50,000
這兩個是一樣東西

362
00:16:50,000 --> 00:16:52,000
公開禁鑰密碼學的基礎是建立在此

363
00:16:52,000 --> 00:16:54,000
公鑰可以釋善在外

364
00:16:54,000 --> 00:16:56,000
可是私鑰絕對只有自己有

365
00:16:56,000 --> 00:17:00,000
所以可以看到的是

366
00:17:00,000 --> 00:17:02,000
因為公鑰可以釋善在外

367
00:17:02,000 --> 00:17:04,000
所以這樣的

368
00:17:04,000 --> 00:17:06,000
做法來講的話

369
00:17:06,000 --> 00:17:08,000
它的特性是說

370
00:17:08,000 --> 00:17:10,000
它不需要有一把

371
00:17:10,000 --> 00:17:12,000
事先就有一把註冊好的

372
00:17:12,000 --> 00:17:14,000
兩個人都一樣的對稱的禁鑰

373
00:17:14,000 --> 00:17:16,000
你只要需要溝通的時候

374
00:17:16,000 --> 00:17:18,000
然後比方說我要傳訊息

375
00:17:18,000 --> 00:17:20,000
給別人的時候

376
00:17:20,000 --> 00:17:22,000
我只要能夠隨意的取得它的公鑰

377
00:17:22,000 --> 00:17:24,000
這個是合法的

378
00:17:24,000 --> 00:17:26,000
那我就能傳送訊息給人家

379
00:17:26,000 --> 00:17:28,000
但是只有它

380
00:17:28,000 --> 00:17:30,000
因為它擁有它自己的私鑰

381
00:17:30,000 --> 00:17:32,000
所以它可以用它自己的私鑰去解讀

382
00:17:32,000 --> 00:17:34,000
我傳給它的這個加密過的訊息

383
00:17:34,000 --> 00:17:38,000
所以它的特性是說它不需要有一把

384
00:17:38,000 --> 00:17:40,000
事先註冊好的鑰匙

385
00:17:40,000 --> 00:17:42,000
它安全性

386
00:17:42,000 --> 00:17:44,000
也相對高

387
00:17:44,000 --> 00:17:46,000
但是它因為

388
00:17:46,000 --> 00:17:48,000
它用到的數學比較難

389
00:17:48,000 --> 00:17:50,000
所以一般來講耗費的資源會比較多

390
00:17:50,000 --> 00:17:52,000
運算速度會比較慢

391
00:17:52,000 --> 00:17:56,000
這邊的話就在

392
00:17:56,000 --> 00:17:58,000
比較具體的補充剛剛講到的例子

393
00:18:00,000 --> 00:18:02,000
所以在開始做這個溝通之前

394
00:18:02,000 --> 00:18:04,000
會像我們前面的

395
00:18:04,000 --> 00:18:06,000
定義的那一頁裡面有提到的

396
00:18:06,000 --> 00:18:08,000
會先經過這個由

397
00:18:08,000 --> 00:18:10,000
私鑰去產生公鑰的過程

398
00:18:10,000 --> 00:18:12,000
並且這個私鑰

399
00:18:12,000 --> 00:18:14,000
一旦產生了這個公鑰之後

400
00:18:14,000 --> 00:18:16,000
它們兩個就是成對的

401
00:18:16,000 --> 00:18:18,000
就是每個人會有一對

402
00:18:18,000 --> 00:18:20,000
自己的私鑰跟公鑰

403
00:18:20,000 --> 00:18:22,000
所以一樣

404
00:18:22,000 --> 00:18:24,000
這個圖畫的是說

405
00:18:24,000 --> 00:18:26,000
不同的人要傳訊息給同一個接收方

406
00:18:26,000 --> 00:18:28,000
他們所用來加密

407
00:18:28,000 --> 00:18:30,000
訊息的這一把

408
00:18:30,000 --> 00:18:32,000
key通通都是同一把

409
00:18:32,000 --> 00:18:34,000
因為他們用的是訊息接收方的公鑰

410
00:18:34,000 --> 00:18:38,000
所以每個人要傳訊息給這個接收方的時候

411
00:18:38,000 --> 00:18:40,000
他們都用訊息接收方的

412
00:18:40,000 --> 00:18:42,000
公鑰來做加密

413
00:18:42,000 --> 00:18:44,000
但是只有

414
00:18:44,000 --> 00:18:46,000
接收方他自己擁有這個Secret Key的時候

415
00:18:46,000 --> 00:18:48,000
才可以去做解密

416
00:18:48,000 --> 00:18:50,000
這個是它的運作

417
00:18:50,000 --> 00:18:52,000
是這樣子運作

418
00:18:52,000 --> 00:18:54,000
比較好理解的一種方式

419
00:18:54,000 --> 00:18:56,000
是可以把

420
00:18:56,000 --> 00:18:58,000
公鑰這個事情

421
00:18:58,000 --> 00:19:00,000
想成是地址或是信箱

422
00:19:00,000 --> 00:19:02,000
或是可能會在家裡前面

423
00:19:02,000 --> 00:19:04,000
投信的那種郵箱

424
00:19:04,000 --> 00:19:06,000
任何人

425
00:19:06,000 --> 00:19:08,000
都可以知道

426
00:19:08,000 --> 00:19:10,000
要怎麼樣傳訊息給這個郵箱的主人

427
00:19:10,000 --> 00:19:12,000
但是

428
00:19:12,000 --> 00:19:14,000
郵箱你投進去但是你打不開

429
00:19:14,000 --> 00:19:16,000
除非你有鑰匙

430
00:19:16,000 --> 00:19:18,000
只有這個郵箱的主人

431
00:19:18,000 --> 00:19:20,000
他有辦法打開這個郵箱去看裡面的信

432
00:19:20,000 --> 00:19:22,000
看裡面的訊息

433
00:19:22,000 --> 00:19:24,000
私鑰跟公鑰的概念

434
00:19:24,000 --> 00:19:26,000
大概就是這樣

435
00:19:26,000 --> 00:19:28,000
公鑰就像是一個地址

436
00:19:28,000 --> 00:19:30,000
或是一個郵箱

437
00:19:30,000 --> 00:19:32,000
更具體來說的話

438
00:19:32,000 --> 00:19:34,000
現在常常在用的

439
00:19:34,000 --> 00:19:36,000
像是比特幣這種東西

440
00:19:36,000 --> 00:19:38,000
比特幣它的帳號

441
00:19:38,000 --> 00:19:40,000
它其實就是公鑰

442
00:19:40,000 --> 00:19:42,000
所以也蠻符合

443
00:19:42,000 --> 00:19:44,000
公鑰就像是地址

444
00:19:44,000 --> 00:19:46,000
任何人都可以傳過去

445
00:19:46,000 --> 00:19:48,000
但是以比特幣來講

446
00:19:48,000 --> 00:19:50,000
任何人都可以傳錢到你的地址

447
00:19:50,000 --> 00:19:52,000
可是你要動裡面的錢

448
00:19:52,000 --> 00:19:54,000
才能拿到鑰匙才能去動

449
00:19:54,000 --> 00:19:56,000
它的概念大概是這樣

450
00:19:56,000 --> 00:20:00,000
所以再來是談

451
00:20:00,000 --> 00:20:02,000
非對稱式

452
00:20:02,000 --> 00:20:04,000
密碼學

453
00:20:04,000 --> 00:20:06,000
的一些性質

454
00:20:06,000 --> 00:20:08,000
首先要

455
00:20:08,000 --> 00:20:10,000
再釐清的是說非對稱式

456
00:20:10,000 --> 00:20:12,000
的這種就是有私鑰

457
00:20:12,000 --> 00:20:14,000
也有公鑰的這種數學來講

458
00:20:14,000 --> 00:20:16,000
它能夠做到的事情

459
00:20:16,000 --> 00:20:18,000
其實非常多種

460
00:20:18,000 --> 00:20:20,000
絕對不只有做加密

461
00:20:20,000 --> 00:20:22,000
這件事情

462
00:20:22,000 --> 00:20:24,000
所以這邊大概列了

463
00:20:24,000 --> 00:20:26,000
它能夠去做加密解密

464
00:20:26,000 --> 00:20:28,000
我們剛剛提的

465
00:20:28,000 --> 00:20:30,000
它能夠去做數位簽章

466
00:20:30,000 --> 00:20:32,000
也能夠去做精要交換

467
00:20:32,000 --> 00:20:34,000
下面兩個後面會提

468
00:20:34,000 --> 00:20:36,000
這邊來講主要是

469
00:20:36,000 --> 00:20:38,000
要先跟大家補充說

470
00:20:38,000 --> 00:20:40,000
這種非對稱式的數學

471
00:20:40,000 --> 00:20:42,000
它都是用一種叫做

472
00:20:42,000 --> 00:20:44,000
trapdoor

473
00:20:44,000 --> 00:20:46,000
one way function

474
00:20:46,000 --> 00:20:48,000
這個算是陷阱門的

475
00:20:48,000 --> 00:20:50,000
一個單數

476
00:20:50,000 --> 00:20:52,000
陷阱門什麼意思就是說

477
00:20:52,000 --> 00:20:54,000
我們今天要做陷阱的時候

478
00:20:54,000 --> 00:20:56,000
我們會希望人家容易掉入這個陷阱

479
00:20:56,000 --> 00:20:58,000
但是掉進去之後是沒有辦法反著出來的

480
00:20:58,000 --> 00:21:00,000
這樣的概念

481
00:21:00,000 --> 00:21:02,000
精神希望大家可以理解

482
00:21:02,000 --> 00:21:04,000
它的具體來說

483
00:21:04,000 --> 00:21:06,000
就是說

484
00:21:06,000 --> 00:21:08,000
今天我們有

485
00:21:08,000 --> 00:21:10,000
要用非對稱式的密碼學

486
00:21:10,000 --> 00:21:12,000
的時候我們都會有

487
00:21:12,000 --> 00:21:14,000
先從私鑰去產生公鑰

488
00:21:14,000 --> 00:21:16,000
同時

489
00:21:16,000 --> 00:21:18,000
我們剛剛也講過公鑰是可以

490
00:21:18,000 --> 00:21:20,000
釋散在外的

491
00:21:20,000 --> 00:21:22,000
為什麼它可以釋散在外

492
00:21:22,000 --> 00:21:24,000
是因為我們有信心

493
00:21:24,000 --> 00:21:26,000
依照它數學的原理

494
00:21:26,000 --> 00:21:28,000
你今天有公鑰是沒有辦法

495
00:21:28,000 --> 00:21:30,000
推回去施鑰的

496
00:21:30,000 --> 00:21:32,000
它的安全性完全就建立在這個基礎之上

497
00:21:32,000 --> 00:21:38,000
所以這邊介紹的是

498
00:21:38,000 --> 00:21:40,000
它幾種不同功能的用法

499
00:21:40,000 --> 00:21:42,000
以加解密而言的話

500
00:21:42,000 --> 00:21:44,000
我們剛剛提過了

501
00:21:44,000 --> 00:21:46,000
收訊息的人用施鑰去做解密

502
00:21:46,000 --> 00:21:48,000
這方向會不太一樣

503
00:21:48,000 --> 00:21:50,000
如果是以數位

504
00:21:50,000 --> 00:21:52,000
簽章來講的話

505
00:21:52,000 --> 00:21:54,000
它會用施鑰去

506
00:21:54,000 --> 00:21:56,000
簽

507
00:21:56,000 --> 00:21:58,000
大家可以用公鑰去確認

508
00:21:58,000 --> 00:22:00,000
這個簽章

509
00:22:00,000 --> 00:22:02,000
另外還有

510
00:22:02,000 --> 00:22:04,000
精鑰交換的功能

511
00:22:04,000 --> 00:22:06,000
我們透過交換

512
00:22:06,000 --> 00:22:08,000
公鑰

513
00:22:08,000 --> 00:22:10,000
去想辦法產生

514
00:22:10,000 --> 00:22:12,000
一樣的對稱

515
00:22:12,000 --> 00:22:14,000
精鑰

516
00:22:14,000 --> 00:22:16,000
這邊還沒有要

517
00:22:16,000 --> 00:22:18,000
不希望這邊先搞亂大家

518
00:22:18,000 --> 00:22:20,000
主要的重點是在於說

519
00:22:20,000 --> 00:22:22,000
非對稱式的密碼學

520
00:22:22,000 --> 00:22:24,000
密碼系統它是有非常多的用途

521
00:22:24,000 --> 00:22:26,000
我們剛剛提的是

522
00:22:26,000 --> 00:22:28,000
先提了加解密的這一種

523
00:22:28,000 --> 00:22:30,000
後續我們會提到其他的功能

524
00:22:30,000 --> 00:22:32,000
也很多都會跟非對稱式

525
00:22:32,000 --> 00:22:34,000
密碼學有關

526
00:22:34,000 --> 00:22:36,000
一樣這邊有一張表

527
00:22:36,000 --> 00:22:38,000
整理現在會在用的東西

528
00:22:38,000 --> 00:22:40,000
整個非對稱式密碼學

529
00:22:40,000 --> 00:22:42,000
的數學原理都是從

530
00:22:42,000 --> 00:22:44,000
Diffie-Hellman演算法來的

531
00:22:44,000 --> 00:22:46,000
這是兩個姓氏

532
00:22:46,000 --> 00:22:48,000
它最剛開始被發明

533
00:22:48,000 --> 00:22:50,000
這是1975年的事情

534
00:22:50,000 --> 00:22:52,000
純粹目的就是去

535
00:22:52,000 --> 00:22:54,000
做精鑰交換

536
00:22:54,000 --> 00:22:56,000
精鑰交換是一切非對稱式密碼學

537
00:22:56,000 --> 00:22:58,000
的基礎

538
00:22:58,000 --> 00:23:00,000
大部分我們看到的只要是

539
00:23:00,000 --> 00:23:02,000
非對稱式的演算法

540
00:23:02,000 --> 00:23:04,000
通常都一定

541
00:23:04,000 --> 00:23:06,000
能夠做精鑰交換的功能

542
00:23:06,000 --> 00:23:08,000
我們現在比較

543
00:23:08,000 --> 00:23:10,000
常在用的

544
00:23:10,000 --> 00:23:12,000
像是這邊列的這個橢圓曲線

545
00:23:12,000 --> 00:23:14,000
跟我們前面定義裡面看到的

546
00:23:14,000 --> 00:23:16,000
跟另外一種叫做RSA

547
00:23:16,000 --> 00:23:18,000
RSA來講

548
00:23:18,000 --> 00:23:20,000
它是比較古老

549
00:23:20,000 --> 00:23:22,000
但比較龐大一點的東西

550
00:23:22,000 --> 00:23:24,000
現在還會用但比較少

551
00:23:24,000 --> 00:23:26,000
最主要是因為它的精鑰的長度非常長

552
00:23:26,000 --> 00:23:28,000
比較厚重

553
00:23:28,000 --> 00:23:30,000
像這種東西可能會在哪裡看到

554
00:23:30,000 --> 00:23:32,000
比方說信用卡裡面的那一顆

555
00:23:32,000 --> 00:23:34,000
IC

556
00:23:34,000 --> 00:23:36,000
它裡面就會有用RSA去做

557
00:23:36,000 --> 00:23:38,000
不管是做千張

558
00:23:38,000 --> 00:23:40,000
通常是做千張的這種做法

559
00:23:40,000 --> 00:23:42,000
是現在還有在用的

560
00:23:42,000 --> 00:23:44,000
所以

561
00:23:44,000 --> 00:23:46,000
剛剛也有提到過

562
00:23:46,000 --> 00:23:48,000
我們提過比較模糊說

563
00:23:48,000 --> 00:23:50,000
對稱式的加密算是安全

564
00:23:50,000 --> 00:23:52,000
非對稱式的加密也算安全

565
00:23:52,000 --> 00:23:54,000
具體來講有多安全的話

566
00:23:54,000 --> 00:23:56,000
這邊就有一張對照表

567
00:23:56,000 --> 00:23:58,000
可以給大家參考

568
00:23:58,000 --> 00:24:00,000
這個對照表是純粹是用

569
00:24:00,000 --> 00:24:02,000
精鑰的長度

570
00:24:02,000 --> 00:24:04,000
然後去

571
00:24:04,000 --> 00:24:06,000
用來做破解的難度

572
00:24:06,000 --> 00:24:08,000
所以怎麼看

573
00:24:08,000 --> 00:24:10,000
比方說以我們前面講說

574
00:24:10,000 --> 00:24:12,000
隨便一個對測式的

575
00:24:12,000 --> 00:24:14,000
演算法比方說AES

576
00:24:14,000 --> 00:24:16,000
我們可能在128bit的時候

577
00:24:16,000 --> 00:24:18,000
它的key長度128bit的時候

578
00:24:18,000 --> 00:24:20,000
它相當於RSA的

579
00:24:20,000 --> 00:24:22,000
3kbit的key長度

580
00:24:22,000 --> 00:24:24,000
然後也相當於

581
00:24:24,000 --> 00:24:26,000
這個橢圓曲線

582
00:24:26,000 --> 00:24:28,000
密碼學差不多

583
00:24:28,000 --> 00:24:30,000
key長度為256bit左右

584
00:24:30,000 --> 00:24:32,000
的強度

585
00:24:32,000 --> 00:24:34,000
所以

586
00:24:34,000 --> 00:24:36,000
這樣大家可以比較有

587
00:24:36,000 --> 00:24:38,000
概念說為什麼RSA現在已經

588
00:24:38,000 --> 00:24:40,000
慢慢的在退流行主要是因為

589
00:24:40,000 --> 00:24:42,000
它要能夠達到同樣的強度

590
00:24:42,000 --> 00:24:44,000
它所需要的精鑰的

591
00:24:44,000 --> 00:24:46,000
長度很長

592
00:24:46,000 --> 00:24:48,000
會卡在storage的問題

593
00:24:48,000 --> 00:24:50,000
就是你反而你

594
00:24:50,000 --> 00:24:52,000
裝置或是晶片裡面沒有那麼多的空間

595
00:24:52,000 --> 00:24:54,000
可以用來儲存

596
00:24:54,000 --> 00:24:56,000
用途比較單薄的

597
00:24:56,000 --> 00:24:58,000
這種演算法的

598
00:24:58,000 --> 00:25:00,000
參數

599
00:25:00,000 --> 00:25:02,000
這中間的話是

600
00:25:02,000 --> 00:25:04,000
原始的

601
00:25:04,000 --> 00:25:06,000
Diffie-Hellman跟

602
00:25:06,000 --> 00:25:08,000
由NIST

603
00:25:08,000 --> 00:25:10,000
國家技術標準局他們所發布的一種

604
00:25:10,000 --> 00:25:12,000
比較基礎的數位簽章的算法

605
00:25:12,000 --> 00:25:14,000
這個當然是因為

606
00:25:14,000 --> 00:25:16,000
比較早期的東西所以它所需要的

607
00:25:16,000 --> 00:25:18,000
分量又更大

608
00:25:18,000 --> 00:25:20,000
所以

609
00:25:20,000 --> 00:25:22,000
再回過頭來說就是說

610
00:25:22,000 --> 00:25:24,000
雖然我們說

611
00:25:24,000 --> 00:25:26,000
在這邊可以看到的是說

612
00:25:26,000 --> 00:25:28,000
對測式的演算法它好像是數字最小的

613
00:25:28,000 --> 00:25:30,000
是沒有錯

614
00:25:30,000 --> 00:25:32,000
但是重點還是在於說

615
00:25:32,000 --> 00:25:34,000
它有先天的缺陷

616
00:25:34,000 --> 00:25:36,000
它會有精鑰傳遞的問題

617
00:25:36,000 --> 00:25:38,000
接下來我們就要看

618
00:25:38,000 --> 00:25:40,000
到底什麼樣叫

619
00:25:40,000 --> 00:25:42,000
我剛剛講的精鑰傳遞的問題

620
00:25:42,000 --> 00:25:44,000
我們都知道說

621
00:25:44,000 --> 00:25:46,000
你要用對測式的加密演算法的時候

622
00:25:46,000 --> 00:25:48,000
你這個

623
00:25:48,000 --> 00:25:50,000
訊息的傳送方跟接收方

624
00:25:50,000 --> 00:25:52,000
兩邊必須要持有

625
00:25:52,000 --> 00:25:54,000
同樣的一把鑰匙

626
00:25:54,000 --> 00:25:56,000
其中一方用這一把

627
00:25:56,000 --> 00:25:58,000
鑰匙做加密

628
00:25:58,000 --> 00:26:00,000
另外一方有同樣的鑰匙它就可以用這一把鑰匙做解密

629
00:26:00,000 --> 00:26:02,000
所以我們要

630
00:26:02,000 --> 00:26:04,000
initiate一個對話

631
00:26:04,000 --> 00:26:06,000
它大概會發生什麼事

632
00:26:06,000 --> 00:26:08,000
我們首先我們要做加密通訊

633
00:26:08,000 --> 00:26:10,000
我們當然就要能夠去加密

634
00:26:10,000 --> 00:26:12,000
訊息或是資料

635
00:26:12,000 --> 00:26:14,000
為了要加密這個資料

636
00:26:14,000 --> 00:26:16,000
我們會需要一把key

637
00:26:16,000 --> 00:26:18,000
為了要

638
00:26:18,000 --> 00:26:20,000
但是我們要

639
00:26:20,000 --> 00:26:22,000
如何由一方產生這一把key之後

640
00:26:22,000 --> 00:26:24,000
傳送到另外一方

641
00:26:24,000 --> 00:26:26,000
所以我們最直覺的方法就是

642
00:26:26,000 --> 00:26:28,000
把這一把key去做加密

643
00:26:28,000 --> 00:26:30,000
要把這一把key做加密的時候

644
00:26:30,000 --> 00:26:32,000
我們會需要另外一把key

645
00:26:32,000 --> 00:26:34,000
所以從這邊開始下面就是

646
00:26:34,000 --> 00:26:36,000
不斷的在循環

647
00:26:36,000 --> 00:26:38,000
所以精鑰傳遞的問題的意思是在這裡

648
00:26:38,000 --> 00:26:40,000
就是說

649
00:26:40,000 --> 00:26:42,000
除非你很確定一開始就已經有

650
00:26:42,000 --> 00:26:44,000
兩把中好的key在裡面

651
00:26:44,000 --> 00:26:46,000
同樣的一把key

652
00:26:46,000 --> 00:26:48,000
然後在訊息的傳送跟接收方

653
00:26:48,000 --> 00:26:50,000
中好在裡面的話

654
00:26:50,000 --> 00:26:52,000
不然在一開始

655
00:26:52,000 --> 00:26:54,000
沒有共同的這一把精鑰狀況下

656
00:26:54,000 --> 00:26:56,000
一定會遇到這樣的問題

657
00:26:56,000 --> 00:26:58,000
就是說到底怎麼樣能夠安全的傳遞精鑰

658
00:26:58,000 --> 00:27:00,000
那

659
00:27:00,000 --> 00:27:02,000
以密碼學而言的話

660
00:27:02,000 --> 00:27:04,000
解決這個問題是有幾種方法

661
00:27:04,000 --> 00:27:06,000
那

662
00:27:06,000 --> 00:27:08,000
首先我們看的是第一種

663
00:27:08,000 --> 00:27:10,000
第一種當然是像我們剛剛講的

664
00:27:10,000 --> 00:27:12,000
如果你在加密的時候

665
00:27:12,000 --> 00:27:14,000
使用非對稱式的密碼學

666
00:27:14,000 --> 00:27:16,000
也就是說我們剛剛提過那種

667
00:27:16,000 --> 00:27:18,000
用訊息接收方的

668
00:27:18,000 --> 00:27:20,000
A要傳訊息給B

669
00:27:20,000 --> 00:27:22,000
那A把訊息用B的公要

670
00:27:22,000 --> 00:27:24,000
做加密

671
00:27:24,000 --> 00:27:26,000
並且讓B用他自己的

672
00:27:26,000 --> 00:27:28,000
私要做解密

673
00:27:28,000 --> 00:27:30,000
這個是絕對可以行得通

674
00:27:30,000 --> 00:27:32,000
但是比較沒有效率

675
00:27:32,000 --> 00:27:34,000
為什麼 因為最主要的問題

676
00:27:34,000 --> 00:27:36,000
是前面有提過他

677
00:27:36,000 --> 00:27:38,000
數學比較難 運算比較慢

678
00:27:38,000 --> 00:27:40,000
所以我們會盡可能的

679
00:27:40,000 --> 00:27:42,000
希望能夠減少

680
00:27:42,000 --> 00:27:44,000
減少這個

681
00:27:44,000 --> 00:27:46,000
非對稱式加密

682
00:27:46,000 --> 00:27:48,000
的使用

683
00:27:48,000 --> 00:27:50,000
就加密而言 我們絕對是

684
00:27:50,000 --> 00:27:52,000
希望能夠使用對稱式加密

685
00:27:52,000 --> 00:27:54,000
又快又安全

686
00:27:54,000 --> 00:27:56,000
是最好的 所以只要能夠

687
00:27:56,000 --> 00:27:58,000
解決那個傳遞精鑰的難題

688
00:27:58,000 --> 00:28:00,000
之後 接下來

689
00:28:00,000 --> 00:28:02,000
我們在做

690
00:28:02,000 --> 00:28:04,000
加密溝通的時候都希望

691
00:28:04,000 --> 00:28:06,000
能夠用對稱式的

692
00:28:06,000 --> 00:28:08,000
對稱式的算法來做

693
00:28:08,000 --> 00:28:10,000
所以第一種

694
00:28:10,000 --> 00:28:12,000
解決方案顯然

695
00:28:12,000 --> 00:28:14,000
是不太理想就是說

696
00:28:14,000 --> 00:28:16,000
他因為他要用到比較

697
00:28:16,000 --> 00:28:18,000
多費資源的非對稱式的

698
00:28:18,000 --> 00:28:20,000
加密的做法 所以不推薦

699
00:28:20,000 --> 00:28:22,000
再來還有第二種

700
00:28:22,000 --> 00:28:24,000
跟第三種

701
00:28:24,000 --> 00:28:32,000
接下來的話

702
00:28:32,000 --> 00:28:34,000
接下來的話

703
00:28:34,000 --> 00:28:36,000
我們希望能夠把

704
00:28:36,000 --> 00:28:38,000
大家分成四組

705
00:28:38,000 --> 00:28:40,000
讓大家去討論

706
00:28:40,000 --> 00:28:42,000
推導看看第二種解法

707
00:28:42,000 --> 00:28:44,000
當然我會給一定程度的提示

708
00:28:44,000 --> 00:28:46,000
主要是

709
00:28:46,000 --> 00:28:48,000
有奉命要

710
00:28:48,000 --> 00:28:50,000
做exercise 所以大家多包涵

711
00:28:50,000 --> 00:28:52,000
所以

712
00:28:52,000 --> 00:28:54,000
分四組的話

713
00:28:54,000 --> 00:28:56,000
白色椅子前後

714
00:28:56,000 --> 00:28:58,000
是

715
00:28:58,000 --> 00:29:00,000
兩邊

716
00:29:00,000 --> 00:29:02,000
現在如果大家都已經知道自己屬於哪一組的話

717
00:29:02,000 --> 00:29:04,000
我這邊再把問題

718
00:29:04,000 --> 00:29:06,000
描述得清楚一點

719
00:29:06,000 --> 00:29:08,000
為了要解決

720
00:29:08,000 --> 00:29:10,000
精鑰傳遞的問題

721
00:29:10,000 --> 00:29:12,000
我們剛剛提過可能可以用

722
00:29:12,000 --> 00:29:14,000
現在上面所列的

723
00:29:14,000 --> 00:29:16,000
你單純的用

724
00:29:16,000 --> 00:29:18,000
非對稱式的加密來做

725
00:29:18,000 --> 00:29:20,000
但是不推薦 因為他比較厚重

726
00:29:20,000 --> 00:29:22,000
那有沒有

727
00:29:22,000 --> 00:29:24,000
其他種方法可以混合

728
00:29:24,000 --> 00:29:26,000
非對稱式跟

729
00:29:26,000 --> 00:29:28,000
對稱式的使用

730
00:29:28,000 --> 00:29:30,000
可以達到我們的目的

731
00:29:30,000 --> 00:29:32,000
我再試著

732
00:29:32,000 --> 00:29:34,000
把題目說明得清楚一點

733
00:29:34,000 --> 00:29:36,000
就是說為了

734
00:29:36,000 --> 00:29:38,000
要解決精鑰傳遞的問題

735
00:29:38,000 --> 00:29:40,000
我們的目標是希望

736
00:29:40,000 --> 00:29:42,000
溝通能夠使用

737
00:29:42,000 --> 00:29:44,000
對稱式的密碼學演算法來做溝通

738
00:29:44,000 --> 00:29:46,000
可是那一把key

739
00:29:46,000 --> 00:29:48,000
要怎麼辦

740
00:29:48,000 --> 00:29:50,000
因為一開始沒有兩邊都有同樣的

741
00:29:50,000 --> 00:29:52,000
這把key

742
00:29:52,000 --> 00:29:56,000
希望大家可以

743
00:29:56,000 --> 00:29:58,000
稍微看看那個中間的那一行

744
00:29:58,000 --> 00:30:00,000
就是灰色的那個字

745
00:30:00,000 --> 00:30:02,000
有哪一組還需要時間討論嗎

746
00:30:02,000 --> 00:30:06,000
沒有

747
00:30:08,000 --> 00:30:10,000
那

748
00:30:10,000 --> 00:30:12,000
有哪一組有人要自願嗎

749
00:30:12,000 --> 00:30:22,000
那我們這一組的朋友

750
00:30:22,000 --> 00:30:24,000
可以派一個代表回答嗎

751
00:30:24,000 --> 00:30:34,000
用非對稱式加密去加密

752
00:30:34,000 --> 00:30:36,000
你要傳輸的那一把鑰匙

753
00:30:36,000 --> 00:30:38,000
這樣至少

754
00:30:38,000 --> 00:30:40,000
因為鑰匙的長度基本上遠小於

755
00:30:40,000 --> 00:30:42,000
你data要傳輸的長度

756
00:30:42,000 --> 00:30:44,000
所以這樣的做法應該會

757
00:30:44,000 --> 00:30:46,000
有效的節省你的運算資源

758
00:30:46,000 --> 00:30:48,000
然後本身資料的部分

759
00:30:48,000 --> 00:30:50,000
還是用對稱式加密加密就好

760
00:30:50,000 --> 00:31:00,000
非常非常的正確且詳細

761
00:31:00,000 --> 00:31:02,000
謝謝

762
00:31:02,000 --> 00:31:06,000
本來應該要點第二組的

763
00:31:06,000 --> 00:31:08,000
可是被你講完

764
00:31:08,000 --> 00:31:18,000
得到了大家的尊重

765
00:31:18,000 --> 00:31:26,000
所以確實

766
00:31:26,000 --> 00:31:28,000
就是剛剛提的情境裡面

767
00:31:28,000 --> 00:31:30,000
重點是在於說

768
00:31:30,000 --> 00:31:32,000
最後在做加密傳輸

769
00:31:32,000 --> 00:31:34,000
主要的溝通的

770
00:31:34,000 --> 00:31:36,000
要加密的訊息的時候

771
00:31:36,000 --> 00:31:38,000
我們絕對是希望使用對稱式的

772
00:31:38,000 --> 00:31:40,000
演算法是比較有效率的

773
00:31:40,000 --> 00:31:42,000
但是我們為了要解決前面的

774
00:31:42,000 --> 00:31:44,000
鑰匙傳遞的問題

775
00:31:44,000 --> 00:31:46,000
我們可以容許我們稍微的

776
00:31:46,000 --> 00:31:48,000
使用非對稱式的

777
00:31:48,000 --> 00:31:50,000
加密的方法

778
00:31:50,000 --> 00:31:52,000
來去加密那一把鑰匙

779
00:31:52,000 --> 00:31:54,000
因為鑰匙的長度絕對會是

780
00:31:54,000 --> 00:31:56,000
比這個訊息還要短上很多

781
00:31:56,000 --> 00:31:58,000
所以這邊有列幾個圖示

782
00:31:58,000 --> 00:32:02,000
首先我們希望最後

783
00:32:02,000 --> 00:32:04,000
能夠使用這一把

784
00:32:04,000 --> 00:32:06,000
紅色的key來當作對稱式的

785
00:32:06,000 --> 00:32:08,000
機要來做加密

786
00:32:08,000 --> 00:32:10,000
所以一開始我們會要怎麼樣做

787
00:32:10,000 --> 00:32:12,000
我們會把它

788
00:32:12,000 --> 00:32:14,000
就像剛剛這位同仁講

789
00:32:14,000 --> 00:32:16,000
我們會把鑰匙當作是

790
00:32:16,000 --> 00:32:18,000
訊息

791
00:32:18,000 --> 00:32:20,000
然後A

792
00:32:20,000 --> 00:32:22,000
用接收方B的

793
00:32:22,000 --> 00:32:24,000
公鑰做加密之後

794
00:32:24,000 --> 00:32:26,000
然後傳送B用他的

795
00:32:26,000 --> 00:32:28,000
鑰匙去做解密

796
00:32:28,000 --> 00:32:30,000
然後得到這把紅色的鑰匙

797
00:32:30,000 --> 00:32:32,000
接下來的溝通的話

798
00:32:32,000 --> 00:32:34,000
就會是AV雙方是用這一把

799
00:32:34,000 --> 00:32:36,000
已經傳過來並且

800
00:32:36,000 --> 00:32:38,000
解回去的這把紅色的鑰匙

801
00:32:38,000 --> 00:32:40,000
來做訊息的加密

802
00:32:40,000 --> 00:32:42,000
所以這是簡化的圖示

803
00:32:42,000 --> 00:32:46,000
所以幾個重點就是說

804
00:32:46,000 --> 00:32:50,000
非對稱式的加密不是不能用

805
00:32:50,000 --> 00:32:52,000
而是要小心使用

806
00:32:52,000 --> 00:32:54,000
大量的用它

807
00:32:54,000 --> 00:32:56,000
然後它會運算的時間比較久

808
00:32:56,000 --> 00:32:58,000
或是耗比較多資源

809
00:32:58,000 --> 00:33:02,000
接下來的話我們下一個

810
00:33:02,000 --> 00:33:04,000
要提的是資料完整性

811
00:33:04,000 --> 00:33:06,000
資料完整性的話像我們

812
00:33:06,000 --> 00:33:08,000
前面定義裡面有看到的一個

813
00:33:08,000 --> 00:33:10,000
果汁機我們通常會使用

814
00:33:10,000 --> 00:33:12,000
雜湊函數

815
00:33:12,000 --> 00:33:14,000
來做資料完整性

816
00:33:14,000 --> 00:33:16,000
首先雜湊函數的話

817
00:33:16,000 --> 00:33:18,000
大家可能也熟悉

818
00:33:18,000 --> 00:33:20,000
它的重點跟我們剛剛提過一樣是說

819
00:33:20,000 --> 00:33:22,000
它是有

820
00:33:22,000 --> 00:33:24,000
它會有任意長度的輸入

821
00:33:24,000 --> 00:33:26,000
把它進到這個

822
00:33:26,000 --> 00:33:28,000
Hash function之後

823
00:33:28,000 --> 00:33:30,000
它會轉成固定長度的輸出

824
00:33:30,000 --> 00:33:34,000
任意長度的輸入

825
00:33:34,000 --> 00:33:36,000
進果汁機出來變成固定長度的輸出

826
00:33:36,000 --> 00:33:38,000
所以我們一般

827
00:33:38,000 --> 00:33:40,000
習慣叫它出來的

828
00:33:40,000 --> 00:33:42,000
output叫做digest

829
00:33:42,000 --> 00:33:44,000
像載要一樣就是訊息載要

830
00:33:44,000 --> 00:33:46,000
但這個載要並不包含它任何

831
00:33:46,000 --> 00:33:48,000
字面的就是並不包含

832
00:33:48,000 --> 00:33:50,000
訊息任何字面的意思

833
00:33:50,000 --> 00:33:52,000
而是就是一串

834
00:33:52,000 --> 00:33:54,000
一串Hax通常都是Hax

835
00:33:54,000 --> 00:33:58,000
這樣的

836
00:33:58,000 --> 00:34:00,000
雜湊函數

837
00:34:00,000 --> 00:34:02,000
它就有幾個性質

838
00:34:02,000 --> 00:34:04,000
我們一個一個看

839
00:34:04,000 --> 00:34:06,000
首先來講就是剛剛這個

840
00:34:06,000 --> 00:34:08,000
很重要的任意長度這件事情

841
00:34:08,000 --> 00:34:10,000
依據

842
00:34:10,000 --> 00:34:12,000
你所使用的雜湊函數

843
00:34:12,000 --> 00:34:14,000
而不同

844
00:34:14,000 --> 00:34:16,000
它的輸出的長度也會不同

845
00:34:16,000 --> 00:34:18,000
短的可能128或64

846
00:34:18,000 --> 00:34:20,000
或是到一般比較常

847
00:34:20,000 --> 00:34:22,000
使用的256

848
00:34:22,000 --> 00:34:24,000
或是更長的512這種

849
00:34:24,000 --> 00:34:26,000
但是不管怎麼樣

850
00:34:26,000 --> 00:34:28,000
它都一定要能夠吃任意

851
00:34:28,000 --> 00:34:30,000
任意長度的輸入

852
00:34:30,000 --> 00:34:32,000
注意是任意而且沒有上限

853
00:34:32,000 --> 00:34:36,000
所以這邊的圖示大概就是這樣

854
00:34:36,000 --> 00:34:38,000
你不管輸入的是

855
00:34:38,000 --> 00:34:40,000
很長的或是很短的

856
00:34:40,000 --> 00:34:42,000
只有一個字母

857
00:34:42,000 --> 00:34:44,000
甚至是空集合

858
00:34:44,000 --> 00:34:46,000
甚至你的input是空的

859
00:34:46,000 --> 00:34:48,000
它都要有辦法凸東西給你

860
00:34:48,000 --> 00:34:50,000
它都要有辦法凸出固定長度的摘要給你

861
00:34:50,000 --> 00:34:52,000
那當然是比較極端的例子

862
00:34:52,000 --> 00:34:54,000
但是它必須要能夠

863
00:34:54,000 --> 00:34:56,000
做到這件事情

864
00:34:56,000 --> 00:34:58,000
這是第一個性質

865
00:34:58,000 --> 00:35:00,000
就是它任意長度

866
00:35:00,000 --> 00:35:02,000
第二個性質這邊講的是說

867
00:35:02,000 --> 00:35:04,000
只要你的

868
00:35:04,000 --> 00:35:06,000
輸入是

869
00:35:06,000 --> 00:35:08,000
一樣的

870
00:35:08,000 --> 00:35:10,000
你的輸出就會要一模一樣

871
00:35:10,000 --> 00:35:12,000
任意長度

872
00:35:12,000 --> 00:35:14,000
所以搭配前面這個你會得到說

873
00:35:14,000 --> 00:35:16,000
任意長度的輸入只要一樣

874
00:35:16,000 --> 00:35:18,000
你都可以得到短短的

875
00:35:18,000 --> 00:35:20,000
輸出而且這個短短的

876
00:35:20,000 --> 00:35:22,000
輸出也一模一樣

877
00:35:22,000 --> 00:35:24,000
大家可以再回想一下前面

878
00:35:24,000 --> 00:35:26,000
我在解釋資料完整性的時候

879
00:35:26,000 --> 00:35:28,000
舉的例子就是說

880
00:35:28,000 --> 00:35:30,000
假設我們上傳了我們

881
00:35:30,000 --> 00:35:32,000
之前存的資料到雲端

882
00:35:32,000 --> 00:35:34,000
硬碟裡面

883
00:35:34,000 --> 00:35:36,000
假設我寫了一本書

884
00:35:36,000 --> 00:35:38,000
非常非常多字

885
00:35:38,000 --> 00:35:40,000
到這個雲端連結裡面

886
00:35:40,000 --> 00:35:42,000
雲端的硬碟裡面

887
00:35:42,000 --> 00:35:44,000
過一陣子我再把它download回來

888
00:35:44,000 --> 00:35:46,000
但是我怎麼知道

889
00:35:46,000 --> 00:35:48,000
有沒有人動過它我不可能逐字的去比對

890
00:35:48,000 --> 00:35:50,000
所以

891
00:35:50,000 --> 00:35:52,000
套用到這兩個性質我們可以做到什麼事情

892
00:35:52,000 --> 00:35:54,000
我們可以在上傳的時候

893
00:35:54,000 --> 00:35:56,000
先把這樣子的一個資料

894
00:35:56,000 --> 00:35:58,000
過這個hash得到一個摘要

895
00:35:58,000 --> 00:36:00,000
到時候

896
00:36:00,000 --> 00:36:02,000
過了一段時間我們在要把它download

897
00:36:02,000 --> 00:36:04,000
回來的時候我們同樣的把我們

898
00:36:04,000 --> 00:36:06,000
下載的這個file

899
00:36:06,000 --> 00:36:08,000
也一樣過這個hash function得到一個短短

900
00:36:08,000 --> 00:36:10,000
的摘要這個時候就會發現

901
00:36:10,000 --> 00:36:12,000
我們只要比摘要

902
00:36:12,000 --> 00:36:14,000
就好我們不需要去比裡面

903
00:36:14,000 --> 00:36:16,000
完整的訊息的內容

904
00:36:16,000 --> 00:36:20,000
再來是第三個性質

905
00:36:20,000 --> 00:36:22,000
這個也跟剛剛提到的一樣就是說

906
00:36:22,000 --> 00:36:24,000
只要你有

907
00:36:24,000 --> 00:36:26,000
任何一點變化

908
00:36:26,000 --> 00:36:28,000
這邊的例子說

909
00:36:28,000 --> 00:36:30,000
從ABC改成ABD

910
00:36:30,000 --> 00:36:32,000
你經過hash所出來的

911
00:36:32,000 --> 00:36:34,000
output

912
00:36:34,000 --> 00:36:36,000
會劇烈的

913
00:36:36,000 --> 00:36:38,000
變化會大大的不相同

914
00:36:38,000 --> 00:36:40,000
到這邊

915
00:36:40,000 --> 00:36:42,000
來講就有一個問題就是說

916
00:36:42,000 --> 00:36:44,000
它的重點是在說

917
00:36:44,000 --> 00:36:46,000
你就算是只改一個bit

918
00:36:46,000 --> 00:36:48,000
你出來的結果也要很不一樣

919
00:36:48,000 --> 00:36:50,000
所以下一個問題

920
00:36:50,000 --> 00:36:52,000
來了就是說到底

921
00:36:52,000 --> 00:36:54,000
應該要多不一樣

922
00:36:54,000 --> 00:36:56,000
這一題的話我們用

923
00:36:56,000 --> 00:37:00,000
我們用投票好了

924
00:37:00,000 --> 00:37:02,000
有幾個選項

925
00:37:02,000 --> 00:37:04,000
假設我們就看

926
00:37:04,000 --> 00:37:06,000
現在的情境是在問說

927
00:37:06,000 --> 00:37:08,000
我們把上面的input改了

928
00:37:08,000 --> 00:37:10,000
一個bit

929
00:37:10,000 --> 00:37:12,000
下面的這兩個output有多不一樣

930
00:37:12,000 --> 00:37:16,000
當然我們指的是

931
00:37:16,000 --> 00:37:18,000
in general的情況不是要你去數說

932
00:37:18,000 --> 00:37:20,000
這兩個到底有多少個不一樣

933
00:37:20,000 --> 00:37:22,000
我們就用

934
00:37:22,000 --> 00:37:24,000
這個兩個output

935
00:37:24,000 --> 00:37:26,000
它有比方說完全不一樣

936
00:37:26,000 --> 00:37:28,000
我們就是100%不一樣

937
00:37:28,000 --> 00:37:30,000
或完全一樣就是

938
00:37:30,000 --> 00:37:32,000
0%不一樣

939
00:37:32,000 --> 00:37:34,000
我們就用這個%數來做判斷好了

940
00:37:34,000 --> 00:37:36,000
我們就開放30%

941
00:37:36,000 --> 00:37:38,000
50%70%的選項

942
00:37:38,000 --> 00:37:40,000
大家認為

943
00:37:40,000 --> 00:37:42,000
怎麼樣才是符合

944
00:37:42,000 --> 00:37:44,000
它這樣的特性呢

945
00:37:44,000 --> 00:37:46,000
覺得會有30%不一樣的舉手

946
00:37:46,000 --> 00:37:50,000
就是說改動

947
00:37:50,000 --> 00:37:52,000
平均而言

948
00:37:52,000 --> 00:37:54,000
我的input改動一個bit

949
00:37:54,000 --> 00:37:56,000
出來的output這兩種

950
00:37:56,000 --> 00:37:58,000
會有30%的位元數不一樣

951
00:37:58,000 --> 00:38:00,000
沒有人

952
00:38:00,000 --> 00:38:02,000
那50%的

953
00:38:02,000 --> 00:38:12,000
那70%的

954
00:38:12,000 --> 00:38:22,000
好

955
00:38:22,000 --> 00:38:24,000
那這邊容我解釋

956
00:38:24,000 --> 00:38:26,000
就是說實際上正確的答案

957
00:38:26,000 --> 00:38:28,000
應該要是50%

958
00:38:28,000 --> 00:38:30,000
我們期待平均而言

959
00:38:30,000 --> 00:38:32,000
平均而言你改動了一個bit

960
00:38:32,000 --> 00:38:34,000
它的output會有50%不一樣

961
00:38:34,000 --> 00:38:36,000
為什麼是50%

962
00:38:36,000 --> 00:38:40,000
這樣講好

963
00:38:40,000 --> 00:38:42,000
就是說

964
00:38:42,000 --> 00:38:44,000
今天假設我們就玩

965
00:38:44,000 --> 00:38:46,000
拆數字的遊戲

966
00:38:46,000 --> 00:38:48,000
然後我說我有10個數字要拆

967
00:38:48,000 --> 00:38:50,000
那我從一組

968
00:38:50,000 --> 00:38:52,000
10個數字我要拆

969
00:38:52,000 --> 00:38:54,000
下一組10個數字

970
00:38:56,000 --> 00:38:58,000
我希望它怎麼樣設計

971
00:38:58,000 --> 00:39:00,000
這個題目的難度才最高

972
00:39:00,000 --> 00:39:02,000
其實它在問的是這件事情

973
00:39:02,000 --> 00:39:04,000
我們希望它安全

974
00:39:04,000 --> 00:39:06,000
所以這邊來講

975
00:39:06,000 --> 00:39:08,000
我們要講的意思是說

976
00:39:08,000 --> 00:39:10,000
它有50%不一樣的時候是最安全

977
00:39:10,000 --> 00:39:14,000
70%不一樣的時候

978
00:39:14,000 --> 00:39:16,000
剛剛的題目

979
00:39:16,000 --> 00:39:18,000
剛剛我們10個拆10個的題目

980
00:39:18,000 --> 00:39:20,000
我們再把它簡化

981
00:39:20,000 --> 00:39:22,000
我們是講說10個

982
00:39:22,000 --> 00:39:24,000
binary bit

983
00:39:24,000 --> 00:39:26,000
我想大家可能比較容易可以理解

984
00:39:26,000 --> 00:39:28,000
假設這10個bit

985
00:39:28,000 --> 00:39:30,000
只有1跟0

986
00:39:30,000 --> 00:39:32,000
那我從這1跟0去拆下一組

987
00:39:32,000 --> 00:39:34,000
1跟0的時候

988
00:39:34,000 --> 00:39:36,000
並且如果它大部分都不一樣

989
00:39:36,000 --> 00:39:38,000
那我就知道我要反著拆

990
00:39:38,000 --> 00:39:40,000
如果它大部分都一樣

991
00:39:40,000 --> 00:39:42,000
我就知道我不用什麼改

992
00:39:42,000 --> 00:39:44,000
拆的會比較接近

993
00:39:44,000 --> 00:39:46,000
但是只有在它

994
00:39:46,000 --> 00:39:48,000
一半一半不一樣的時候

995
00:39:48,000 --> 00:39:50,000
是最難拆的

996
00:39:50,000 --> 00:39:52,000
大家可以理解嗎

997
00:39:52,000 --> 00:39:54,000
這個其實跟我們

998
00:39:54,000 --> 00:39:56,000
講的這個比方說Puff

999
00:39:56,000 --> 00:39:58,000
它有很好的叫

1000
00:39:58,000 --> 00:40:00,000
unique的一樣的事情

1001
00:40:00,000 --> 00:40:02,000
我們常常會用的是

1002
00:40:02,000 --> 00:40:04,000
叫做Hemming Distance

1003
00:40:04,000 --> 00:40:06,000
Inter-Hemming Distance

1004
00:40:06,000 --> 00:40:08,000
就是說你今天一組128 bit的Puff

1005
00:40:08,000 --> 00:40:10,000
跟另外一組128 bit的Puff

1006
00:40:10,000 --> 00:40:12,000
它裡面的值

1007
00:40:12,000 --> 00:40:14,000
大概會有多少不一樣

1008
00:40:14,000 --> 00:40:16,000
其實它的大概

1009
00:40:16,000 --> 00:40:18,000
你bit by bit去比的話大概會是50%

1010
00:40:18,000 --> 00:40:20,000
這個是NeoPuff的特性

1011
00:40:20,000 --> 00:40:22,000
但是這個在密碼學裡面

1012
00:40:22,000 --> 00:40:24,000
是非常常見

1013
00:40:24,000 --> 00:40:26,000
也非常重要的一個性質

1014
00:40:26,000 --> 00:40:28,000
就是所謂改一個bit

1015
00:40:28,000 --> 00:40:30,000
就有50%不一樣的

1016
00:40:30,000 --> 00:40:32,000
這個是一個理想的密碼學上會用到的性質

1017
00:40:32,000 --> 00:40:34,000
然後這在密碼學裡面叫做雪崩效應

1018
00:40:34,000 --> 00:40:36,000
就是說你只要動了一點

1019
00:40:36,000 --> 00:40:38,000
牽一髮動全身

1020
00:40:38,000 --> 00:40:40,000
你的輸入有一點變化的時候

1021
00:40:40,000 --> 00:40:42,000
你的輸出會劇烈的改變

1022
00:40:42,000 --> 00:40:44,000
但是也不希望太劇烈劇烈到完全變反

1023
00:40:44,000 --> 00:40:46,000
也就好拆

1024
00:40:46,000 --> 00:40:48,000
所以它其實變不一樣是差不多50%不一樣

1025
00:40:48,000 --> 00:40:50,000
所以前面我們剛剛看到的各種

1026
00:40:50,000 --> 00:40:52,000
不管是ECC

1027
00:40:52,000 --> 00:40:54,000
不管是RSA

1028
00:40:54,000 --> 00:40:56,000
也都會具備有這種的性質

1029
00:40:56,000 --> 00:40:58,000
因為這樣才會難破解

1030
00:40:58,000 --> 00:41:00,000
所以這邊

1031
00:41:00,000 --> 00:41:02,000
這邊是針對這樣的特性在做補充

1032
00:41:02,000 --> 00:41:04,000
就是說同樣的

1033
00:41:04,000 --> 00:41:06,000
一個好的雜臭函數

1034
00:41:06,000 --> 00:41:08,000
它勢必也會帶有這樣的雪崩效應的性質

1035
00:41:08,000 --> 00:41:14,000
好再來是第四個特性

1036
00:41:14,000 --> 00:41:16,000
第四個特性我們講的叫說

1037
00:41:16,000 --> 00:41:18,000
即便問題來了

1038
00:41:18,000 --> 00:41:20,000
即便你的這個輸入

1039
00:41:20,000 --> 00:41:22,000
完全不一樣

1040
00:41:22,000 --> 00:41:24,000
但是你

1041
00:41:24,000 --> 00:41:26,000
還是有可能得到

1042
00:41:26,000 --> 00:41:28,000
同樣的兩個輸出

1043
00:41:28,000 --> 00:41:30,000
兩個一樣的摘要

1044
00:41:30,000 --> 00:41:32,000
這個跟前面

1045
00:41:32,000 --> 00:41:34,000
講的

1046
00:41:34,000 --> 00:41:36,000
跟整個雜臭函數的目的

1047
00:41:36,000 --> 00:41:38,000
似乎有點衝突

1048
00:41:38,000 --> 00:41:42,000
有沒有

1049
00:41:42,000 --> 00:41:44,000
厲害的

1050
00:41:44,000 --> 00:41:46,000
同仁可以發表一下

1051
00:41:46,000 --> 00:41:48,000
覺得為什麼會是這樣

1052
00:41:48,000 --> 00:41:54,000
這邊我在描述的

1053
00:41:54,000 --> 00:41:56,000
再仔細一點

1054
00:41:56,000 --> 00:41:58,000
就是說

1055
00:41:58,000 --> 00:42:00,000
我們就假設

1056
00:42:00,000 --> 00:42:02,000
我們所使用的這一板果汁機

1057
00:42:02,000 --> 00:42:04,000
它能夠出來的

1058
00:42:04,000 --> 00:42:06,000
摘要

1059
00:42:06,000 --> 00:42:08,000
我們就說是32bit好了

1060
00:42:08,000 --> 00:42:12,000
那為什麼

1061
00:42:12,000 --> 00:42:14,000
會發生

1062
00:42:14,000 --> 00:42:16,000
為什麼有可能會發生這個不同的

1063
00:42:16,000 --> 00:42:18,000
輸入得到一樣的

1064
00:42:18,000 --> 00:42:20,000
輸出的結果

1065
00:42:20,000 --> 00:42:22,000
請說

1066
00:42:22,000 --> 00:42:30,000
因為那個這個世界

1067
00:42:30,000 --> 00:42:32,000
的東西

1068
00:42:32,000 --> 00:42:34,000
遠比那些摘要還要多

1069
00:42:34,000 --> 00:42:36,000
所以有可能不一樣的

1070
00:42:36,000 --> 00:42:38,000
東西進入這個

1071
00:42:38,000 --> 00:42:40,000
雜臭函數以後會得到

1072
00:42:40,000 --> 00:42:42,000
相同的數字

1073
00:42:42,000 --> 00:42:44,000
是的

1074
00:42:44,000 --> 00:42:46,000
意思是

1075
00:42:46,000 --> 00:42:48,000
注意我們前面講到任意長度的輸入

1076
00:42:48,000 --> 00:42:50,000
所以在你

1077
00:42:50,000 --> 00:42:52,000
基本上是在你輸出的長度

1078
00:42:52,000 --> 00:42:54,000
是固定的狀況下

1079
00:42:54,000 --> 00:42:56,000
一定一定會有機會

1080
00:42:56,000 --> 00:42:58,000
你的輸入的

1081
00:42:58,000 --> 00:43:00,000
會超過輸出的質率

1082
00:43:00,000 --> 00:43:02,000
所以

1083
00:43:02,000 --> 00:43:04,000
當然這個是

1084
00:43:04,000 --> 00:43:06,000
必須會要發生的

1085
00:43:06,000 --> 00:43:08,000
因為你的設計就是讓

1086
00:43:08,000 --> 00:43:10,000
雜臭函數可以吃任意長度的輸入

1087
00:43:10,000 --> 00:43:12,000
所以這個是勢必會發生的

1088
00:43:12,000 --> 00:43:14,000
但是

1089
00:43:14,000 --> 00:43:16,000
我們一般在密碼學上面會用到的

1090
00:43:16,000 --> 00:43:18,000
雜臭函數我們希望

1091
00:43:18,000 --> 00:43:20,000
這樣的發生機率我們把這叫做碰撞

1092
00:43:20,000 --> 00:43:22,000
要碰撞

1093
00:43:22,000 --> 00:43:24,000
我們希望這個發生機率極低

1094
00:43:24,000 --> 00:43:26,000
而且不能被操控

1095
00:43:26,000 --> 00:43:28,000
不能我想要它碰撞它就碰撞

1096
00:43:28,000 --> 00:43:30,000
不能說

1097
00:43:30,000 --> 00:43:32,000
我看到一個摘要我就知道

1098
00:43:32,000 --> 00:43:34,000
什麼樣的輸入可以得到

1099
00:43:34,000 --> 00:43:36,000
這樣的摘要

1100
00:43:36,000 --> 00:43:38,000
不能輕易的被操作

1101
00:43:38,000 --> 00:43:40,000
所以碰撞是一定會發生

1102
00:43:40,000 --> 00:43:42,000
但是密碼學上面機率

1103
00:43:42,000 --> 00:43:44,000
極低

1104
00:43:44,000 --> 00:43:46,000
並且也不容易被實現

1105
00:43:46,000 --> 00:43:50,000
再來第五項特性的話

1106
00:43:50,000 --> 00:43:52,000
前面

1107
00:43:52,000 --> 00:43:54,000
有講到就是說它是

1108
00:43:54,000 --> 00:43:56,000
不可逆的

1109
00:43:56,000 --> 00:43:58,000
它是單項的函數

1110
00:43:58,000 --> 00:44:00,000
具體

1111
00:44:00,000 --> 00:44:02,000
為什麼它是單項的

1112
00:44:02,000 --> 00:44:04,000
多半你就算是用哪一種的

1113
00:44:04,000 --> 00:44:06,000
不管是用哪一種的雜臭函數

1114
00:44:06,000 --> 00:44:08,000
它的流程裡面一定會包含到

1115
00:44:08,000 --> 00:44:10,000
多對一的mapping

1116
00:44:10,000 --> 00:44:12,000
本來你再有

1117
00:44:12,000 --> 00:44:14,000
多個輸入都可能會得到

1118
00:44:14,000 --> 00:44:16,000
同一個輸出的結果下

1119
00:44:16,000 --> 00:44:18,000
你當然不可能知道那個輸出

1120
00:44:18,000 --> 00:44:20,000
就返回去推回去輸入

1121
00:44:20,000 --> 00:44:22,000
你根本就不知道你要走哪一條路回去

1122
00:44:22,000 --> 00:44:26,000
再來是第六個性質

1123
00:44:26,000 --> 00:44:28,000
這邊第六個性質指的是說

1124
00:44:28,000 --> 00:44:30,000
當然這樣的雜臭函數會經過世代更迭

1125
00:44:30,000 --> 00:44:32,000
所以以前在用的這種叫

1126
00:44:32,000 --> 00:44:34,000
Message Digest

1127
00:44:34,000 --> 00:44:36,000
第四代第五代這種都已經

1128
00:44:36,000 --> 00:44:38,000
除役

1129
00:44:38,000 --> 00:44:40,000
現在最常使用的是這個紅色框框

1130
00:44:40,000 --> 00:44:42,000
框起來的叫做Share2

1131
00:44:42,000 --> 00:44:44,000
Share2來講它當然是

1132
00:44:44,000 --> 00:44:46,000
前面幾個的後代

1133
00:44:46,000 --> 00:44:48,000
就是從Share0開始

1134
00:44:48,000 --> 00:44:50,000
跟Share1然後到現在來講

1135
00:44:50,000 --> 00:44:52,000
在使用的是Share2

1136
00:44:52,000 --> 00:44:54,000
Share0跟Share1來講的話

1137
00:44:54,000 --> 00:44:56,000
Share0是本身

1138
00:44:56,000 --> 00:44:58,000
它的演算法就有缺陷

1139
00:44:58,000 --> 00:45:00,000
Share1的話是它的運算

1140
00:45:00,000 --> 00:45:02,000
可以開始被操弄

1141
00:45:02,000 --> 00:45:04,000
所以已經被除役

1142
00:45:04,000 --> 00:45:06,000
現在所使用的

1143
00:45:06,000 --> 00:45:08,000
Share2呢

1144
00:45:08,000 --> 00:45:10,000
大概是這樣就是說Share2是

1145
00:45:10,000 --> 00:45:12,000
一整個組它這個組裡面

1146
00:45:12,000 --> 00:45:14,000
它有不同的版本

1147
00:45:14,000 --> 00:45:16,000
可以讓你得到不同

1148
00:45:16,000 --> 00:45:18,000
長度的摘要的輸出

1149
00:45:18,000 --> 00:45:20,000
所以比方說這邊是224的256的

1150
00:45:20,000 --> 00:45:22,000
384 512

1151
00:45:22,000 --> 00:45:24,000
跟它這邊寫有512/224

1152
00:45:24,000 --> 00:45:26,000
跟512/256

1153
00:45:26,000 --> 00:45:28,000
這個是什麼意思

1154
00:45:28,000 --> 00:45:30,000
大概補充一下就是說

1155
00:45:30,000 --> 00:45:32,000
當然這幾個224/256

1156
00:45:32,000 --> 00:45:34,000
這些函數的構造是不同的

1157
00:45:34,000 --> 00:45:36,000
但是只要是512開頭的

1158
00:45:36,000 --> 00:45:38,000
它都是相同的

1159
00:45:38,000 --> 00:45:40,000
但是它是用

1160
00:45:40,000 --> 00:45:42,000
類似這樣子512的

1161
00:45:42,000 --> 00:45:44,000
這樣的函數的架構

1162
00:45:44,000 --> 00:45:46,000
它能夠去幫你轉出

1163
00:45:46,000 --> 00:45:48,000
224或是256bit

1164
00:45:48,000 --> 00:45:50,000
的摘要的長度

1165
00:45:50,000 --> 00:45:52,000
這邊的/224/256是這個意思

1166
00:45:52,000 --> 00:45:54,000
那目前來講

1167
00:45:54,000 --> 00:45:56,000
針對Share2還並沒有

1168
00:45:56,000 --> 00:45:58,000
有效的攻擊

1169
00:45:58,000 --> 00:46:00,000
在這邊講這個

1170
00:46:00,000 --> 00:46:02,000
所謂沒有有效的攻擊

1171
00:46:02,000 --> 00:46:04,000
跟我們講說為什麼我們講說

1172
00:46:04,000 --> 00:46:06,000
下零跟下萬被破解

1173
00:46:06,000 --> 00:46:08,000
這邊給大家一個觀念就是說

1174
00:46:08,000 --> 00:46:10,000
所謂被破解來講的話

1175
00:46:10,000 --> 00:46:12,000
絕對不是說你馬上一秒就能

1176
00:46:12,000 --> 00:46:14,000
短短的時間內就能變出

1177
00:46:14,000 --> 00:46:16,000
答案

1178
00:46:16,000 --> 00:46:18,000
不是這個意思

1179
00:46:18,000 --> 00:46:20,000
而是說先從這邊講的被破解

1180
00:46:20,000 --> 00:46:22,000
來說的話

1181
00:46:22,000 --> 00:46:24,000
一般來講說被破解或是說有有效的攻擊

1182
00:46:24,000 --> 00:46:26,000
指的是說有比暴力破解

1183
00:46:26,000 --> 00:46:28,000
更有效率的方法

1184
00:46:28,000 --> 00:46:30,000
可以降低它的

1185
00:46:30,000 --> 00:46:32,000
運算的複雜度

1186
00:46:32,000 --> 00:46:34,000
這樣應該比較精確

1187
00:46:34,000 --> 00:46:36,000
只要能夠做到這樣的話

1188
00:46:36,000 --> 00:46:38,000
那大致上我們就等於說

1189
00:46:38,000 --> 00:46:40,000
這樣的演算法它的安全性已經打折了

1190
00:46:40,000 --> 00:46:42,000
那打多少折其實不用管

1191
00:46:42,000 --> 00:46:44,000
很多很多時候當然

1192
00:46:44,000 --> 00:46:46,000
所謂宣稱被破解而言

1193
00:46:46,000 --> 00:46:48,000
它不過是運算的複雜度降低了

1194
00:46:48,000 --> 00:46:50,000
一點而已

1195
00:46:50,000 --> 00:46:52,000
降低了二的幾次方而已

1196
00:46:52,000 --> 00:46:54,000
不見得

1197
00:46:54,000 --> 00:46:56,000
所以說真的雖然說不建議使用

1198
00:46:56,000 --> 00:46:58,000
但是很多時候那些被處理的

1199
00:46:58,000 --> 00:47:00,000
被處理的做法來講

1200
00:47:00,000 --> 00:47:02,000
它其實也沒有馬上就能夠

1201
00:47:02,000 --> 00:47:04,000
破解

1202
00:47:04,000 --> 00:47:06,000
破滅

1203
00:47:06,000 --> 00:47:08,000
這回事並沒有

1204
00:47:08,000 --> 00:47:10,000
那

1205
00:47:10,000 --> 00:47:12,000
這邊就帶來另外一個問題

1206
00:47:12,000 --> 00:47:14,000
就是說剛剛已經講過說

1207
00:47:14,000 --> 00:47:16,000
所謂的被破解

1208
00:47:16,000 --> 00:47:18,000
或是說

1209
00:47:18,000 --> 00:47:20,000
已經被處理的這種指的是說

1210
00:47:20,000 --> 00:47:22,000
存在比暴力破解

1211
00:47:22,000 --> 00:47:24,000
更有效的更有效率的做法

1212
00:47:24,000 --> 00:47:26,000
那也有另外一種是

1213
00:47:26,000 --> 00:47:28,000
它的本身的

1214
00:47:28,000 --> 00:47:30,000
這個演算法

1215
00:47:30,000 --> 00:47:32,000
的設計是有問題的它是有數學上的

1216
00:47:32,000 --> 00:47:34,000
缺陷的但是

1217
00:47:34,000 --> 00:47:36,000
特別是像數學有缺陷這件事情

1218
00:47:36,000 --> 00:47:38,000
以現在的審查制度

1219
00:47:38,000 --> 00:47:40,000
來講現在這種都是類似

1220
00:47:40,000 --> 00:47:42,000
去投標去做競賽

1221
00:47:42,000 --> 00:47:44,000
以這種狀況來講

1222
00:47:44,000 --> 00:47:46,000
現在有數學缺陷還能夠

1223
00:47:46,000 --> 00:47:48,000
通過成為正式標準的會

1224
00:47:48,000 --> 00:47:50,000
比較難一般比較不大會有這種狀況

1225
00:47:50,000 --> 00:47:52,000
以前可能會有現在很少

1226
00:47:52,000 --> 00:47:54,000
那這邊來講

1227
00:47:54,000 --> 00:47:56,000
有另外一個另外一個事情要提的就是說

1228
00:47:56,000 --> 00:47:58,000
那

1229
00:47:58,000 --> 00:48:00,000
所謂被破解還有什麼樣的可能

1230
00:48:00,000 --> 00:48:02,000
其實一種是說

1231
00:48:02,000 --> 00:48:04,000
有一種簡單的情境就是說

1232
00:48:04,000 --> 00:48:06,000
我們希望我們希望

1233
00:48:06,000 --> 00:48:08,000
這個系統安全

1234
00:48:08,000 --> 00:48:10,000
除了它的演算法要健康之外

1235
00:48:10,000 --> 00:48:12,000
就是它不是它不是被

1236
00:48:12,000 --> 00:48:14,000
這個破解的演算法

1237
00:48:14,000 --> 00:48:16,000
另外一種另外一種

1238
00:48:16,000 --> 00:48:18,000
我們常常會用來保護

1239
00:48:18,000 --> 00:48:20,000
安全的一種東西我們

1240
00:48:20,000 --> 00:48:22,000
把它叫做協定

1241
00:48:22,000 --> 00:48:24,000
最簡單的說法就是說

1242
00:48:24,000 --> 00:48:26,000
假設

1243
00:48:26,000 --> 00:48:28,000
我今天我所使用的加密

1244
00:48:28,000 --> 00:48:30,000
演算法

1245
00:48:30,000 --> 00:48:32,000
它在100個

1246
00:48:32,000 --> 00:48:34,000
microsecond內會被破解

1247
00:48:34,000 --> 00:48:36,000
那很簡單

1248
00:48:36,000 --> 00:48:38,000
如果要

1249
00:48:38,000 --> 00:48:40,000
如果還是只能使用這個的話

1250
00:48:40,000 --> 00:48:42,000
也很簡單我只要跟對方約定好說

1251
00:48:42,000 --> 00:48:44,000
我們10 microsecond就換一次key

1252
00:48:44,000 --> 00:48:46,000
這樣會讓你沒有

1253
00:48:46,000 --> 00:48:48,000
那個100 microsecond去破解

1254
00:48:48,000 --> 00:48:50,000
這個就是所謂協定的意思

1255
00:48:50,000 --> 00:48:52,000
所以一般來講

1256
00:48:52,000 --> 00:48:54,000
協定跟演算法那這邊我們

1257
00:48:54,000 --> 00:48:56,000
比較不會去討論協定因為協定

1258
00:48:56,000 --> 00:48:58,000
通常來講更

1259
00:48:58,000 --> 00:49:00,000
更比較

1260
00:49:00,000 --> 00:49:02,000
大家會都比較用

1261
00:49:02,000 --> 00:49:04,000
這種公開的標準比方說HTTPS

1262
00:49:04,000 --> 00:49:06,000
這種東西我們常常看到的

1263
00:49:06,000 --> 00:49:08,000
那所以協定這邊的話我們就

1264
00:49:08,000 --> 00:49:10,000
不會再去多談這邊的話比較會

1265
00:49:10,000 --> 00:49:12,000
多講一點點的是演算法

1266
00:49:14,000 --> 00:49:16,000
好那接下來

1267
00:49:16,000 --> 00:49:18,000
記得我們有四個

1268
00:49:18,000 --> 00:49:20,000
大單權目標有保密性

1269
00:49:20,000 --> 00:49:22,000
有資料完整性

1270
00:49:22,000 --> 00:49:24,000
然後有認證性

1271
00:49:24,000 --> 00:49:26,000
跟不可否認性這四個

1272
00:49:26,000 --> 00:49:28,000
對應的有四種

1273
00:49:28,000 --> 00:49:30,000
比較常用的做法就是加密

1274
00:49:30,000 --> 00:49:32,000
或是雜誌函數

1275
00:49:32,000 --> 00:49:34,000
或是認證

1276
00:49:34,000 --> 00:49:36,000
的機制或者是現在要談的叫

1277
00:49:36,000 --> 00:49:38,000
不可否認性我們會用數位前章

1278
00:49:38,000 --> 00:49:40,000
注意這邊我們是先跳到

1279
00:49:40,000 --> 00:49:42,000
第四項

1280
00:49:42,000 --> 00:49:44,000
先跳到不可否認性的簽章

1281
00:49:44,000 --> 00:49:46,000
因為主要的原因是因為

1282
00:49:46,000 --> 00:49:48,000
認證它稍微複雜一些所以我們會

1283
00:49:48,000 --> 00:49:50,000
比較後面才提

1284
00:49:50,000 --> 00:49:54,000
好那

1285
00:49:54,000 --> 00:49:56,000
不可否認性

1286
00:49:56,000 --> 00:49:58,000
就是說簽章這件事情我們前面

1287
00:49:58,000 --> 00:50:00,000
大概有提過就好比

1288
00:50:00,000 --> 00:50:02,000
好比藉錢之所以要簽借據

1289
00:50:02,000 --> 00:50:04,000
就是因為怕口說無憑

1290
00:50:04,000 --> 00:50:06,000
那所以這種情況就是說

1291
00:50:06,000 --> 00:50:08,000
的確有可能

1292
00:50:08,000 --> 00:50:10,000
惡意的A傳送了一個訊息

1293
00:50:10,000 --> 00:50:12,000
然後過了一陣子之後他說

1294
00:50:12,000 --> 00:50:14,000
否認說delay或否認說

1295
00:50:14,000 --> 00:50:16,000
我從來沒有送過

1296
00:50:16,000 --> 00:50:18,000
那所以

1297
00:50:18,000 --> 00:50:20,000
為了要解決這個問題呢

1298
00:50:20,000 --> 00:50:22,000
我們會用類似叫簽章的方式

1299
00:50:22,000 --> 00:50:24,000
用簽章的方式可以避免什麼

1300
00:50:24,000 --> 00:50:26,000
可以避免兩種情況

1301
00:50:26,000 --> 00:50:28,000
第一種是說

1302
00:50:28,000 --> 00:50:30,000
第一種是說

1303
00:50:30,000 --> 00:50:32,000
冒用身份的問題

1304
00:50:32,000 --> 00:50:34,000
我們會假定只有我們自己

1305
00:50:34,000 --> 00:50:36,000
才能簽出我們自己的簽名別人

1306
00:50:36,000 --> 00:50:38,000
沒有辦法偽造你的簽名

1307
00:50:38,000 --> 00:50:40,000
那再來就是說

1308
00:50:40,000 --> 00:50:42,000
也一樣跟前面提到說

1309
00:50:42,000 --> 00:50:44,000
有可能會偽造

1310
00:50:44,000 --> 00:50:46,000
有可能會偽造訊息

1311
00:50:46,000 --> 00:50:48,000
簽章能夠解決這兩個問題

1312
00:50:48,000 --> 00:50:50,000
那簽章

1313
00:50:50,000 --> 00:50:52,000
簽章呢他也同樣都是用

1314
00:50:52,000 --> 00:50:54,000
這個非對稱式的演算法來做

1315
00:50:54,000 --> 00:51:00,000
所以他的簡單的流程來講的話

1316
00:51:00,000 --> 00:51:02,000
大概簡單的概念大概會是說

1317
00:51:02,000 --> 00:51:04,000
同樣我每一個人

1318
00:51:04,000 --> 00:51:06,000
有自己的一對

1319
00:51:06,000 --> 00:51:08,000
私藥和公藥

1320
00:51:08,000 --> 00:51:10,000
並且我很有可能是通常都是從

1321
00:51:10,000 --> 00:51:12,000
私藥開始去產生公藥

1322
00:51:12,000 --> 00:51:14,000
那

1323
00:51:14,000 --> 00:51:16,000
這邊講的是說

1324
00:51:16,000 --> 00:51:18,000
這邊講的是說為什麼

1325
00:51:18,000 --> 00:51:20,000
為什麼會有簽章 簽章的安全基礎在哪裡

1326
00:51:20,000 --> 00:51:22,000
簽章的安全基礎是在於說

1327
00:51:22,000 --> 00:51:24,000
只有我自己

1328
00:51:24,000 --> 00:51:26,000
擁有我自己的私藥

1329
00:51:26,000 --> 00:51:28,000
因為他絕對不外洩

1330
00:51:28,000 --> 00:51:30,000
只有我自己有

1331
00:51:30,000 --> 00:51:32,000
那並且我公藥事善在外

1332
00:51:32,000 --> 00:51:34,000
你單有公藥是推不回私藥的

1333
00:51:34,000 --> 00:51:36,000
他的數學基礎

1334
00:51:36,000 --> 00:51:38,000
這兩個前提之下呢

1335
00:51:38,000 --> 00:51:40,000
這兩個前提之下

1336
00:51:40,000 --> 00:51:42,000
要做這個簽章的人

1337
00:51:42,000 --> 00:51:44,000
要generate這個簽章的人

1338
00:51:44,000 --> 00:51:46,000
他會去用他自己的私藥

1339
00:51:46,000 --> 00:51:48,000
去簽

1340
00:51:48,000 --> 00:51:50,000
去簽一個訊息

1341
00:51:50,000 --> 00:51:52,000
然後所有其他人

1342
00:51:52,000 --> 00:51:54,000
因為都可以取得這個人的公藥

1343
00:51:54,000 --> 00:51:56,000
所有其他人都可以用這個

1344
00:51:56,000 --> 00:51:58,000
用這個簽署方的

1345
00:51:58,000 --> 00:52:00,000
公藥來確認這個

1346
00:52:00,000 --> 00:52:02,000
簽名是否有效

1347
00:52:02,000 --> 00:52:04,000
所以

1348
00:52:04,000 --> 00:52:06,000
概念跟我們一般會用

1349
00:52:06,000 --> 00:52:08,000
蠻類似就是說假設你去

1350
00:52:08,000 --> 00:52:10,000
有去到什麼做什麼簽名

1351
00:52:10,000 --> 00:52:12,000
鑑定這種 也是因為我們會認定

1352
00:52:12,000 --> 00:52:14,000
有人能夠驗得出你的

1353
00:52:14,000 --> 00:52:16,000
簽名是否由你所簽

1354
00:52:16,000 --> 00:52:18,000
並且我們會假定只有你能簽

1355
00:52:18,000 --> 00:52:20,000
出你自己的簽名 整個簽名

1356
00:52:20,000 --> 00:52:22,000
這件事情的安全性主要是建立在這裡

1357
00:52:22,000 --> 00:52:26,000
所以實用上的話

1358
00:52:26,000 --> 00:52:28,000
就會是類似說我這個

1359
00:52:28,000 --> 00:52:30,000
他要做簽章的時候

1360
00:52:30,000 --> 00:52:34,000
對不同人他都會用他同一把

1361
00:52:34,000 --> 00:52:36,000
私藥去做簽署

1362
00:52:36,000 --> 00:52:38,000
所有人都用

1363
00:52:38,000 --> 00:52:40,000
這個人的公藥

1364
00:52:40,000 --> 00:52:42,000
去確認

1365
00:52:42,000 --> 00:52:44,000
注意是確認這個簽名

1366
00:52:44,000 --> 00:52:46,000
這個方向

1367
00:52:46,000 --> 00:52:48,000
跟我們前面提到過用非對稱式

1368
00:52:48,000 --> 00:52:50,000
演算法做加密是反過來的

1369
00:52:50,000 --> 00:52:52,000
前面我們在講非對稱式的加密

1370
00:52:52,000 --> 00:52:54,000
的時候我們說

1371
00:52:54,000 --> 00:52:56,000
傳送方用

1372
00:52:56,000 --> 00:52:58,000
接收方的公藥加密

1373
00:52:58,000 --> 00:53:00,000
並且只有接收方自己

1374
00:53:00,000 --> 00:53:02,000
擁有那一把私藥能夠去解密

1375
00:53:02,000 --> 00:53:04,000
這邊的方向是反過來的

1376
00:53:04,000 --> 00:53:06,000
我要

1377
00:53:06,000 --> 00:53:08,000
issue一個簽章

1378
00:53:08,000 --> 00:53:10,000
是由我自己

1379
00:53:10,000 --> 00:53:12,000
用我的私藥才能證明我的

1380
00:53:12,000 --> 00:53:14,000
身份去簽

1381
00:53:14,000 --> 00:53:16,000
所有人都可以用我的公藥

1382
00:53:16,000 --> 00:53:18,000
所有人都可以用我的公藥去確認

1383
00:53:18,000 --> 00:53:20,000
這個簽名

1384
00:53:24,000 --> 00:53:26,000
再來我們再看一下

1385
00:53:26,000 --> 00:53:28,000
比較簡易的流程

1386
00:53:28,000 --> 00:53:30,000
通常會怎麼做

1387
00:53:30,000 --> 00:53:32,000
通常我們第一步會把

1388
00:53:32,000 --> 00:53:34,000
我們所要簽的這個訊息

1389
00:53:34,000 --> 00:53:36,000
我們所要簽的這個訊息

1390
00:53:36,000 --> 00:53:38,000
我們先經過 hash

1391
00:53:38,000 --> 00:53:40,000
得到摘要

1392
00:53:40,000 --> 00:53:42,000
再來

1393
00:53:42,000 --> 00:53:44,000
我們會用這一個私藥

1394
00:53:44,000 --> 00:53:46,000
我說的A要做簽名

1395
00:53:46,000 --> 00:53:48,000
A會把A的私藥拿來

1396
00:53:48,000 --> 00:53:50,000
然後對這個

1397
00:53:50,000 --> 00:53:52,000
訊息做

1398
00:53:52,000 --> 00:53:54,000
簽章,但是這邊我們講

1399
00:53:54,000 --> 00:53:56,000
好比是用私藥去做加密

1400
00:53:56,000 --> 00:53:58,000
所以這邊的加密我放了

1401
00:53:58,000 --> 00:54:00,000
call on call

1402
00:54:00,000 --> 00:54:04,000
當然為什麼我們要用

1403
00:54:04,000 --> 00:54:06,000
為什麼我們要經過一個hash,很簡單

1404
00:54:06,000 --> 00:54:08,000
因為背對測試的演算法

1405
00:54:08,000 --> 00:54:10,000
運算複雜,我們不希望它過

1406
00:54:10,000 --> 00:54:12,000
大量的input

1407
00:54:12,000 --> 00:54:14,000
所以

1408
00:54:14,000 --> 00:54:16,000
因為我們沒有要去確認

1409
00:54:16,000 --> 00:54:18,000
這個

1410
00:54:18,000 --> 00:54:20,000
就是簽章來講它並沒有要去

1411
00:54:20,000 --> 00:54:22,000
它並沒有要帶有那個訊息

1412
00:54:22,000 --> 00:54:24,000
你訊息是分開傳的

1413
00:54:24,000 --> 00:54:26,000
訊息夾帶簽章

1414
00:54:26,000 --> 00:54:28,000
所以你不用去管

1415
00:54:28,000 --> 00:54:30,000
那個訊息一不一樣

1416
00:54:30,000 --> 00:54:32,000
簽章裡面只要包含

1417
00:54:32,000 --> 00:54:34,000
成份就可以,所以它會用

1418
00:54:34,000 --> 00:54:36,000
hash

1419
00:54:36,000 --> 00:54:38,000
那再來

1420
00:54:38,000 --> 00:54:40,000
再來它有了這個簽名做好了

1421
00:54:40,000 --> 00:54:42,000
之後

1422
00:54:42,000 --> 00:54:44,000
它會把訊息

1423
00:54:44,000 --> 00:54:46,000
也傳送給B

1424
00:54:46,000 --> 00:54:48,000
然後簽章也傳送

1425
00:54:48,000 --> 00:54:50,000
給B,所以剛剛講的訊息跟

1426
00:54:50,000 --> 00:54:52,000
附件,這邊為了簡化

1427
00:54:52,000 --> 00:54:54,000
我們不去討論訊息的加密

1428
00:54:54,000 --> 00:54:56,000
我們就假設不可能

1429
00:54:56,000 --> 00:54:58,000
它有沒有加密,總之這個

1430
00:54:58,000 --> 00:55:00,000
訊息接收方它得到的訊息和

1431
00:55:00,000 --> 00:55:02,000
這個簽章

1432
00:55:02,000 --> 00:55:04,000
最後會做什麼事

1433
00:55:04,000 --> 00:55:06,000
最後我們這個

1434
00:55:06,000 --> 00:55:08,000
接收方B它會用一樣的

1435
00:55:08,000 --> 00:55:10,000
過程,把

1436
00:55:10,000 --> 00:55:12,000
收到的這個訊息經過hash

1437
00:55:12,000 --> 00:55:14,000
也得到摘要

1438
00:55:14,000 --> 00:55:16,000
然後把它收到的這個

1439
00:55:16,000 --> 00:55:18,000
簽章好比

1440
00:55:18,000 --> 00:55:20,000
是用A的公要去

1441
00:55:20,000 --> 00:55:22,000
做解密

1442
00:55:22,000 --> 00:55:24,000
好比是解密

1443
00:55:24,000 --> 00:55:26,000
但是實際上我們叫確認

1444
00:55:26,000 --> 00:55:28,000
做一個確認的函數

1445
00:55:28,000 --> 00:55:30,000
verification的函數,然後最後再來

1446
00:55:30,000 --> 00:55:32,000
比對這兩個hash值是否

1447
00:55:32,000 --> 00:55:34,000
相同

1448
00:55:34,000 --> 00:55:36,000
它大概是這樣的過程

1449
00:55:36,000 --> 00:55:42,000
所以到這邊為止有問題嗎

1450
00:55:42,000 --> 00:55:44,000
有問題嗎

1451
00:55:44,000 --> 00:55:50,000
我想我們先休息

1452
00:55:50,000 --> 00:55:52,000
10分鐘

1453
00:55:52,000 --> 00:55:54,000
10分鐘好了

1454
00:55:54,000 --> 00:55:56,000
我們回來的時候會再接著講

1455
00:55:56,000 --> 00:55:58,000
第四個authentication

1456
00:55:58,000 --> 00:56:00,000
我想時間差不多我們就

1457
00:56:00,000 --> 00:56:02,000
繼續,所以到剛剛為止

1458
00:56:02,000 --> 00:56:04,000
我們大概看了

1459
00:56:04,000 --> 00:56:06,000
四個安全目標的其中三種

1460
00:56:06,000 --> 00:56:08,000
保密性,資料完整性

1461
00:56:08,000 --> 00:56:10,000
跟不可否認性

1462
00:56:10,000 --> 00:56:12,000
接下來我們要看的是叫認證

1463
00:56:12,000 --> 00:56:14,000
為什麼認證放在最後

1464
00:56:14,000 --> 00:56:16,000
講,是因為它其實

1465
00:56:16,000 --> 00:56:18,000
要考量的細節比較多

1466
00:56:18,000 --> 00:56:20,000
然後它的做法也比較複雜

1467
00:56:20,000 --> 00:56:22,000
算是一個複合型的功能

1468
00:56:22,000 --> 00:56:24,000
所以我們把它擺在最後

1469
00:56:24,000 --> 00:56:28,000
基本上

1470
00:56:28,000 --> 00:56:30,000
就像加密

1471
00:56:30,000 --> 00:56:32,000
一樣

1472
00:56:32,000 --> 00:56:34,000
認證其實也可以簡單的分為

1473
00:56:34,000 --> 00:56:36,000
對稱式或是非對稱式的做法

1474
00:56:36,000 --> 00:56:38,000
這邊兩種我們會各舉

1475
00:56:38,000 --> 00:56:40,000
一個例子

1476
00:56:40,000 --> 00:56:42,000
首先要看到的是對稱式的

1477
00:56:42,000 --> 00:56:44,000
對稱式的認證

1478
00:56:44,000 --> 00:56:46,000
我們常常會使用的一種方法

1479
00:56:46,000 --> 00:56:48,000
叫做訊息驗證碼

1480
00:56:48,000 --> 00:56:50,000
或我們叫MAC

1481
00:56:50,000 --> 00:56:52,000
訊息驗證碼

1482
00:56:52,000 --> 00:56:54,000
它的基本的原理

1483
00:56:54,000 --> 00:56:56,000
就是會去把

1484
00:56:56,000 --> 00:56:58,000
我們要加密的密文

1485
00:56:58,000 --> 00:57:00,000
跟一個

1486
00:57:00,000 --> 00:57:02,000
專門用來做

1487
00:57:02,000 --> 00:57:04,000
訊息驗證碼用的key

1488
00:57:04,000 --> 00:57:06,000
然後經過這個hash

1489
00:57:06,000 --> 00:57:08,000
得到這個摘要

1490
00:57:08,000 --> 00:57:10,000
或是在這邊我們叫做訊息驗證碼

1491
00:57:10,000 --> 00:57:12,000
在這時候

1492
00:57:12,000 --> 00:57:14,000
它的基本的原理是

1493
00:57:14,000 --> 00:57:16,000
它會把密文

1494
00:57:16,000 --> 00:57:18,000
跟一把專門用來做

1495
00:57:18,000 --> 00:57:20,000
MAC的MAC key

1496
00:57:20,000 --> 00:57:22,000
然後進到這個hash

1497
00:57:22,000 --> 00:57:24,000
然後得到一個摘要

1498
00:57:24,000 --> 00:57:26,000
或是在這邊叫做訊息驗證碼

1499
00:57:26,000 --> 00:57:28,000
那它的

1500
00:57:28,000 --> 00:57:30,000
最主要的目的是說

1501
00:57:30,000 --> 00:57:32,000
除了能夠確認身份之外

1502
00:57:32,000 --> 00:57:34,000
也能夠確認訊息有沒有被篡改

1503
00:57:34,000 --> 00:57:36,000
所以我們簡單的

1504
00:57:36,000 --> 00:57:38,000
再過一下這個流程的話

1505
00:57:38,000 --> 00:57:40,000
首先我們假設

1506
00:57:40,000 --> 00:57:42,000
可能用我們前面所提過的

1507
00:57:42,000 --> 00:57:44,000
這些方法呢

1508
00:57:44,000 --> 00:57:46,000
我們可以把一把藍色的這把MAC key

1509
00:57:46,000 --> 00:57:48,000
安全的傳送給

1510
00:57:48,000 --> 00:57:50,000
接收方B

1511
00:57:50,000 --> 00:57:52,000
所以這邊這個驚要的

1512
00:57:52,000 --> 00:57:54,000
的傳送我們就先不考慮

1513
00:57:54,000 --> 00:57:56,000
兩邊都有這把藍色的key

1514
00:57:56,000 --> 00:57:58,000
並且他們有

1515
00:57:58,000 --> 00:58:00,000
這個加密過的訊息

1516
00:58:00,000 --> 00:58:02,000
加密過的訊息呢我們在這邊

1517
00:58:02,000 --> 00:58:04,000
是用另外一把黃色的key

1518
00:58:04,000 --> 00:58:06,000
來做的,簡單來說就是要區分

1519
00:58:06,000 --> 00:58:08,000
就是要

1520
00:58:08,000 --> 00:58:10,000
多加一重保險的意思

1521
00:58:10,000 --> 00:58:12,000
加密訊息用的

1522
00:58:12,000 --> 00:58:14,000
這把黃色的key跟用來

1523
00:58:14,000 --> 00:58:16,000
做MAC的MAC key可以是不一樣

1524
00:58:16,000 --> 00:58:22,000
所以它會去

1525
00:58:22,000 --> 00:58:24,000
它的原理

1526
00:58:24,000 --> 00:58:26,000
上就是說

1527
00:58:26,000 --> 00:58:28,000
我們看步驟好了,就是首先

1528
00:58:28,000 --> 00:58:30,000
它是把用這個黃色

1529
00:58:30,000 --> 00:58:32,000
的這把key來加密它所要傳送的名文

1530
00:58:32,000 --> 00:58:34,000
然後把它變成

1531
00:58:34,000 --> 00:58:36,000
密文之後,那再來

1532
00:58:36,000 --> 00:58:38,000
安全的傳送過了這把藍色的MAC key

1533
00:58:38,000 --> 00:58:40,000
那

1534
00:58:40,000 --> 00:58:42,000
再來就可以像我們剛剛講的流程

1535
00:58:42,000 --> 00:58:44,000
一樣去把這個訊息驗證碼做出來

1536
00:58:44,000 --> 00:58:46,000
它會把密文

1537
00:58:46,000 --> 00:58:48,000
加上這把MAC key

1538
00:58:48,000 --> 00:58:50,000
經過hash得到

1539
00:58:50,000 --> 00:58:52,000
訊息驗證碼MAC

1540
00:58:52,000 --> 00:58:54,000
那再來下一步的話呢

1541
00:58:54,000 --> 00:58:56,000
我們傳送過去

1542
00:58:56,000 --> 00:58:58,000
的會是兩個東西,一樣是

1543
00:58:58,000 --> 00:59:00,000
加密的密文跟它附帶的

1544
00:59:00,000 --> 00:59:02,000
一個附件,就是訊息驗證碼

1545
00:59:02,000 --> 00:59:04,000
等於說我們把它attach在後面

1546
00:59:04,000 --> 00:59:06,000
那接收到的人

1547
00:59:06,000 --> 00:59:08,000
會做什麼事,他會去做驗證

1548
00:59:08,000 --> 00:59:10,000
驗證這個訊息

1549
00:59:10,000 --> 00:59:12,000
認證碼,首先呢

1550
00:59:12,000 --> 00:59:14,000
是正確的情境,是說

1551
00:59:14,000 --> 00:59:16,000
它如果是正確的話

1552
00:59:16,000 --> 00:59:18,000
它會收到,它會把一樣

1553
00:59:18,000 --> 00:59:20,000
收到這個密文,加上它有的MAC key

1554
00:59:20,000 --> 00:59:22,000
去做一樣的這個

1555
00:59:22,000 --> 00:59:24,000
訊息驗證碼,並且因為這個是

1556
00:59:24,000 --> 00:59:26,000
健康的

1557
00:59:26,000 --> 00:59:28,000
情境,所以它得到的這個訊息驗證碼會是一模一樣

1558
00:59:28,000 --> 00:59:30,000
前面我們提過

1559
00:59:30,000 --> 00:59:32,000
你進到hash來講

1560
00:59:32,000 --> 00:59:34,000
你只要輸入一樣

1561
00:59:34,000 --> 00:59:36,000
你的輸出一定會一樣

1562
00:59:36,000 --> 00:59:38,000
那如果

1563
00:59:38,000 --> 00:59:40,000
如果有出問題的話呢

1564
00:59:40,000 --> 00:59:42,000
一個可能是你的

1565
00:59:42,000 --> 00:59:44,000
訊息被篡改

1566
00:59:44,000 --> 00:59:46,000
就算你持有

1567
00:59:46,000 --> 00:59:48,000
相同的key,但是你

1568
00:59:48,000 --> 00:59:50,000
得不出一樣的這個MAC

1569
00:59:50,000 --> 00:59:52,000
所以

1570
00:59:52,000 --> 00:59:54,000
在這邊的話,B就知道說

1571
00:59:54,000 --> 00:59:56,000
這個訊息

1572
00:59:56,000 --> 00:59:58,000
我需要ignore

1573
00:59:58,000 --> 01:00:00,000
因為它有可能錯在兩種

1574
01:00:00,000 --> 01:00:02,000
環節,它錯的

1575
01:00:02,000 --> 01:00:04,000
可能性就是兩個

1576
01:00:04,000 --> 01:00:06,000
input,它有可能

1577
01:00:06,000 --> 01:00:08,000
是密文錯了,像這邊畫的是密文

1578
01:00:08,000 --> 01:00:10,000
錯了,或者是

1579
01:00:10,000 --> 01:00:12,000
它的MAC key是錯的

1580
01:00:12,000 --> 01:00:14,000
它只要輸入

1581
01:00:14,000 --> 01:00:16,000
的兩個裡面有一個不一樣

1582
01:00:16,000 --> 01:00:18,000
它的結果就會差很多

1583
01:00:18,000 --> 01:00:20,000
剛剛我們提過

1584
01:00:20,000 --> 01:00:22,000
所以以這種例子

1585
01:00:22,000 --> 01:00:24,000
你如果是惡意的第三方

1586
01:00:24,000 --> 01:00:26,000
hikeX去篡改這個密文的話

1587
01:00:26,000 --> 01:00:28,000
那它的得到的MAC

1588
01:00:28,000 --> 01:00:30,000
會是錯的,或者是

1589
01:00:30,000 --> 01:00:32,000
你本來就不是

1590
01:00:32,000 --> 01:00:34,000
合法的接收方B

1591
01:00:34,000 --> 01:00:36,000
然後你就不會有

1592
01:00:36,000 --> 01:00:38,000
這一把要用來

1593
01:00:38,000 --> 01:00:40,000
做訊息驗證碼用的MAC key

1594
01:00:40,000 --> 01:00:42,000
那你當然就得不出正確的MAC

1595
01:00:42,000 --> 01:00:46,000
所以大概的

1596
01:00:46,000 --> 01:00:48,000
情況會有這兩種

1597
01:00:48,000 --> 01:00:50,000
這個來講

1598
01:00:50,000 --> 01:00:52,000
相對來講是單純

1599
01:00:52,000 --> 01:00:54,000
跟對稱是

1600
01:00:54,000 --> 01:00:56,000
加密的概念很像

1601
01:00:56,000 --> 01:00:58,000
它就建立在說,你有一把

1602
01:00:58,000 --> 01:01:00,000
加密用的key是可以來確保說

1603
01:01:00,000 --> 01:01:02,000
溝通只有我們兩個人

1604
01:01:02,000 --> 01:01:04,000
可以看得到內容,並且你有

1605
01:01:04,000 --> 01:01:06,000
另外一個MAC key是

1606
01:01:06,000 --> 01:01:08,000
用來做類似是

1607
01:01:08,000 --> 01:01:10,000
作為身份的信物

1608
01:01:10,000 --> 01:01:12,000
只要我有這把MAC key,我就是合法的

1609
01:01:12,000 --> 01:01:14,000
接收方或傳送方

1610
01:01:14,000 --> 01:01:16,000
它的概念上大概

1611
01:01:16,000 --> 01:01:18,000
是這樣

1612
01:01:18,000 --> 01:01:20,000
接下來要看到的這個是

1613
01:01:20,000 --> 01:01:22,000
開始是叫非對甚私的做法

1614
01:01:22,000 --> 01:01:24,000
這個叫做我們一般講叫憑證

1615
01:01:24,000 --> 01:01:26,000
憑證這邊一個很簡單的示意圖

1616
01:01:26,000 --> 01:01:28,000
就是說

1617
01:01:28,000 --> 01:01:30,000
有一個人

1618
01:01:30,000 --> 01:01:32,000
A,他去把他的個人的

1619
01:01:32,000 --> 01:01:34,000
一些資訊跟他的公要

1620
01:01:34,000 --> 01:01:36,000
交給這個我們叫CA

1621
01:01:36,000 --> 01:01:38,000
叫做Certificate Authority,憑證機構

1622
01:01:38,000 --> 01:01:40,000
機關,他

1623
01:01:40,000 --> 01:01:42,000
會頒發一個憑證過來

1624
01:01:42,000 --> 01:01:44,000
類似於我們去

1625
01:01:44,000 --> 01:01:46,000
像護證事務所

1626
01:01:46,000 --> 01:01:48,000
怎麼樣的地方去辦身份證的感覺

1627
01:01:48,000 --> 01:01:50,000
我們得到了一個身份的

1628
01:01:50,000 --> 01:01:52,000
憑證

1629
01:01:52,000 --> 01:01:54,000
那為什麼要有這個東西

1630
01:01:54,000 --> 01:01:56,000
那為什麼要有這個東西

1631
01:01:56,000 --> 01:01:58,000
我們前面講過

1632
01:01:58,000 --> 01:02:00,000
在公開

1633
01:02:00,000 --> 01:02:02,000
經要密碼學,或是叫非對甚私

1634
01:02:02,000 --> 01:02:04,000
密碼學的世界裡面

1635
01:02:04,000 --> 01:02:06,000
公要可以釋善在外,私要

1636
01:02:06,000 --> 01:02:08,000
只能自己持有,絕對不外洩

1637
01:02:08,000 --> 01:02:10,000
公要可以釋善在外

1638
01:02:10,000 --> 01:02:12,000
代表什麼事情,就是說任何人都可以

1639
01:02:12,000 --> 01:02:14,000
去Access,或者是去

1640
01:02:14,000 --> 01:02:16,000
去派發公要

1641
01:02:16,000 --> 01:02:18,000
但是問題在於說,你怎麼知道

1642
01:02:18,000 --> 01:02:20,000
這個公要是誰的

1643
01:02:20,000 --> 01:02:22,000
所以這邊我們舉一個

1644
01:02:22,000 --> 01:02:24,000
例子

1645
01:02:24,000 --> 01:02:28,000
這邊有一個惡意的駭客X

1646
01:02:28,000 --> 01:02:30,000
他首先

1647
01:02:30,000 --> 01:02:32,000
他就聲稱自己是B

1648
01:02:32,000 --> 01:02:34,000
把他的公要

1649
01:02:34,000 --> 01:02:36,000
PX交給A

1650
01:02:36,000 --> 01:02:38,000
A不知道

1651
01:02:38,000 --> 01:02:40,000
他以為

1652
01:02:40,000 --> 01:02:42,000
這個公要是屬於B的

1653
01:02:42,000 --> 01:02:44,000
他用這個公要

1654
01:02:44,000 --> 01:02:46,000
去加密訊息

1655
01:02:46,000 --> 01:02:48,000
傳給駭客X

1656
01:02:48,000 --> 01:02:50,000
那駭客X

1657
01:02:50,000 --> 01:02:52,000
他有他自己的私要

1658
01:02:52,000 --> 01:02:54,000
他當然可以解讀這個訊息

1659
01:02:54,000 --> 01:02:56,000
這個是我們前面講的非對甚私的加密

1660
01:02:56,000 --> 01:02:58,000
各位應該還記得

1661
01:02:58,000 --> 01:03:00,000
所以他可以解讀這個訊息

1662
01:03:00,000 --> 01:03:02,000
假設他拿到的是

1663
01:03:02,000 --> 01:03:04,000
正確的這個PB的話

1664
01:03:04,000 --> 01:03:06,000
他可以隨心所欲的

1665
01:03:06,000 --> 01:03:08,000
改這個訊息,交給B

1666
01:03:08,000 --> 01:03:10,000
因為他有拿到B的公要

1667
01:03:10,000 --> 01:03:12,000
並且B會依照駭客X

1668
01:03:12,000 --> 01:03:14,000
所設定的

1669
01:03:14,000 --> 01:03:16,000
用他的私要去做解密

1670
01:03:16,000 --> 01:03:18,000
然後得到一個假的訊息

1671
01:03:18,000 --> 01:03:20,000
這個是有可能發生的一種狀況

1672
01:03:20,000 --> 01:03:22,000
那大家可以想

1673
01:03:22,000 --> 01:03:24,000
更恐怖的狀況

1674
01:03:24,000 --> 01:03:26,000
會是說,他可以

1675
01:03:26,000 --> 01:03:28,000
他可以自己解讀這個訊息之外

1676
01:03:28,000 --> 01:03:30,000
他甚至可以把正確的

1677
01:03:30,000 --> 01:03:32,000
訊息傳給B

1678
01:03:32,000 --> 01:03:34,000
他可以,並且A

1679
01:03:34,000 --> 01:03:36,000
B以為溝通暢通無阻

1680
01:03:36,000 --> 01:03:38,000
可是不知道有人

1681
01:03:38,000 --> 01:03:40,000
完全的竊聽了這整個通訊

1682
01:03:40,000 --> 01:03:42,000
各位應該可以想像

1683
01:03:42,000 --> 01:03:44,000
就是這兩種都是有可能發生的

1684
01:03:44,000 --> 01:03:46,000
所以這樣的關鍵的

1685
01:03:46,000 --> 01:03:48,000
這樣的事發的原因是在於說

1686
01:03:48,000 --> 01:03:50,000
因為認錯了這一把公要

1687
01:03:50,000 --> 01:03:52,000
以為他是合法的

1688
01:03:52,000 --> 01:03:54,000
以為他是合法的

1689
01:03:54,000 --> 01:03:56,000
接收方B的公要

1690
01:03:56,000 --> 01:03:58,000
但其實他是駭客X的公要

1691
01:03:58,000 --> 01:04:00,000
因為我們前面講過公要示範在外

1692
01:04:00,000 --> 01:04:02,000
但是你不知道

1693
01:04:02,000 --> 01:04:04,000
如何去證明這個公要的身份

1694
01:04:06,000 --> 01:04:08,000
OK,所以

1695
01:04:08,000 --> 01:04:10,000
像前面講的

1696
01:04:10,000 --> 01:04:12,000
假設有這個憑證

1697
01:04:12,000 --> 01:04:14,000
事先

1698
01:04:14,000 --> 01:04:16,000
A就先把他的憑證

1699
01:04:16,000 --> 01:04:18,000
交給B

1700
01:04:18,000 --> 01:04:20,000
我們再回頭看一下憑證的內容

1701
01:04:20,000 --> 01:04:22,000
憑證的內容有什麼呢

1702
01:04:22,000 --> 01:04:24,000
憑證的內容有A的身份

1703
01:04:24,000 --> 01:04:26,000
要知道這個是誰

1704
01:04:26,000 --> 01:04:28,000
綁定了他的公要

1705
01:04:28,000 --> 01:04:30,000
這樣就把身份跟公要綁定在一起

1706
01:04:30,000 --> 01:04:32,000
再來

1707
01:04:32,000 --> 01:04:34,000
這邊有一個CA在這裡

1708
01:04:34,000 --> 01:04:36,000
就是說

1709
01:04:36,000 --> 01:04:38,000
這一個憑證是由

1710
01:04:38,000 --> 01:04:40,000
CA所頒發

1711
01:04:40,000 --> 01:04:42,000
並且有CA的簽名

1712
01:04:42,000 --> 01:04:44,000
換回我們

1713
01:04:44,000 --> 01:04:46,000
具體一點的例子來講

1714
01:04:46,000 --> 01:04:48,000
我們的身份證會有什麼

1715
01:04:48,000 --> 01:04:50,000
就是我們的身份證會有

1716
01:04:50,000 --> 01:04:52,000
到底是誰

1717
01:04:52,000 --> 01:04:54,000
一些個人的資訊,父母配偶

1718
01:04:54,000 --> 01:04:56,000
並且有我們最重要的

1719
01:04:56,000 --> 01:04:58,000
用來證明身份用的

1720
01:04:58,000 --> 01:05:00,000
我們可能叫做身份證字號

1721
01:05:00,000 --> 01:05:02,000
同時

1722
01:05:02,000 --> 01:05:04,000
他會告訴你說

1723
01:05:04,000 --> 01:05:06,000
到底是

1724
01:05:06,000 --> 01:05:08,000
為什麼他是身份證

1725
01:05:08,000 --> 01:05:10,000
是因為他的規定是這樣

1726
01:05:10,000 --> 01:05:12,000
他是由什麼機構所頒發

1727
01:05:12,000 --> 01:05:14,000
然後怎麼做成這樣身份證

1728
01:05:14,000 --> 01:05:16,000
然後跟一些你絕對不可能

1729
01:05:16,000 --> 01:05:18,000
去輕易去篡改的一些

1730
01:05:18,000 --> 01:05:20,000
加工

1731
01:05:20,000 --> 01:05:22,000
大概的概念

1732
01:05:22,000 --> 01:05:24,000
是類似這樣子

1733
01:05:24,000 --> 01:05:26,000
所以只要今天

1734
01:05:26,000 --> 01:05:28,000
A有先把這個憑證交給B

1735
01:05:28,000 --> 01:05:30,000
這個憑證上面會載明

1736
01:05:30,000 --> 01:05:32,000
A到底是誰,公要到底是什麼

1737
01:05:32,000 --> 01:05:34,000
那

1738
01:05:34,000 --> 01:05:36,000
再來,駭客X要去

1739
01:05:36,000 --> 01:05:38,000
冒充成A的時候

1740
01:05:38,000 --> 01:05:40,000
他就會遇到問題,因為他沒有辦法

1741
01:05:40,000 --> 01:05:42,000
提出正確的

1742
01:05:42,000 --> 01:05:44,000
公要加上

1743
01:05:44,000 --> 01:05:46,000
他的,就他沒有辦法提出一個

1744
01:05:46,000 --> 01:05:48,000
偽造的證書

1745
01:05:48,000 --> 01:05:50,000
沒有辦法把他的公要

1746
01:05:50,000 --> 01:05:52,000
PX跟A的身份綁在

1747
01:05:52,000 --> 01:05:54,000
一起,因為A的

1748
01:05:54,000 --> 01:05:56,000
身份已經跟A的公要綁在一起

1749
01:05:56,000 --> 01:05:58,000
他的大概的概念是這樣子

1750
01:05:58,000 --> 01:06:02,000
好,那我們這邊

1751
01:06:02,000 --> 01:06:04,000
會先看一個簡圖,就是說

1752
01:06:04,000 --> 01:06:06,000
到底這個

1753
01:06:06,000 --> 01:06:08,000
證書是怎麼樣,憑證

1754
01:06:08,000 --> 01:06:10,000
是怎麼樣做出來的

1755
01:06:10,000 --> 01:06:12,000
所以前面講過了,我們

1756
01:06:12,000 --> 01:06:14,000
這裡面我們講的是,我們要去

1757
01:06:14,000 --> 01:06:16,000
證明,我們要做一張給Bub的憑證

1758
01:06:16,000 --> 01:06:18,000
那我們分為

1759
01:06:18,000 --> 01:06:20,000
左半邊是

1760
01:06:20,000 --> 01:06:22,000
就是左半邊是

1761
01:06:22,000 --> 01:06:24,000
建立這個憑證的過程

1762
01:06:24,000 --> 01:06:26,000
右半邊是確認

1763
01:06:26,000 --> 01:06:28,000
這個憑證的過程

1764
01:06:28,000 --> 01:06:30,000
左半邊來講,我們先從他的

1765
01:06:30,000 --> 01:06:32,000
成分來,他會包含Bub的ID

1766
01:06:32,000 --> 01:06:34,000
就是他的個人的一些

1767
01:06:34,000 --> 01:06:36,000
資訊

1768
01:06:36,000 --> 01:06:38,000
跟最重要的Bub的公要

1769
01:06:38,000 --> 01:06:40,000
然後再來,這一張憑證

1770
01:06:40,000 --> 01:06:42,000
是由誰所簽發的

1771
01:06:42,000 --> 01:06:44,000
然後最後下面

1772
01:06:44,000 --> 01:06:46,000
再配合一段簽章

1773
01:06:46,000 --> 01:06:48,000
好,那

1774
01:06:48,000 --> 01:06:50,000
他怎麼做的,他會把前面這三

1775
01:06:50,000 --> 01:06:52,000
前面這三個,上面這三個成分

1776
01:06:52,000 --> 01:06:54,000
過一個

1777
01:06:54,000 --> 01:06:56,000
Hash一樣,過一個Hash,然後得到

1778
01:06:56,000 --> 01:06:58,000
一個短的摘要

1779
01:06:58,000 --> 01:07:00,000
再來用,再來就是用

1780
01:07:00,000 --> 01:07:02,000
簽章,我們剛剛講說,簽章是類似

1781
01:07:02,000 --> 01:07:04,000
於你用私要去

1782
01:07:04,000 --> 01:07:06,000
做加密

1783
01:07:06,000 --> 01:07:08,000
這邊的話,這個簽章是由

1784
01:07:08,000 --> 01:07:10,000
CA來做的

1785
01:07:10,000 --> 01:07:12,000
由這個

1786
01:07:12,000 --> 01:07:14,000
國家單位或是憑證機構來幫你

1787
01:07:14,000 --> 01:07:16,000
的公要背書

1788
01:07:16,000 --> 01:07:18,000
他用他的私要去簽

1789
01:07:18,000 --> 01:07:20,000
得到了這個簽章

1790
01:07:20,000 --> 01:07:22,000
所以把這三個

1791
01:07:22,000 --> 01:07:24,000
資訊欄跟這一個

1792
01:07:24,000 --> 01:07:26,000
簽章的這個

1793
01:07:26,000 --> 01:07:28,000
附件,組合起來,這就是一張

1794
01:07:28,000 --> 01:07:30,000
完整的憑證

1795
01:07:30,000 --> 01:07:32,000
這樣的憑證,收到的人會做什麼事

1796
01:07:32,000 --> 01:07:34,000
收到的人會一樣把

1797
01:07:34,000 --> 01:07:36,000
這三個資訊過Hash

1798
01:07:36,000 --> 01:07:38,000
然後並且,也就是去

1799
01:07:38,000 --> 01:07:40,000
Verify這個Signature

1800
01:07:40,000 --> 01:07:42,000
確認這個簽名,他們會用

1801
01:07:42,000 --> 01:07:44,000
CA的公要

1802
01:07:44,000 --> 01:07:46,000
來去,類似於

1803
01:07:46,000 --> 01:07:48,000
對這個簽章做解密

1804
01:07:48,000 --> 01:07:50,000
我們叫做確認簽名,得出來的是

1805
01:07:50,000 --> 01:07:52,000
會應該要跟這個Hash

1806
01:07:52,000 --> 01:07:54,000
能夠做比對

1807
01:07:54,000 --> 01:07:56,000
這個會太

1808
01:07:56,000 --> 01:07:58,000
複雜嗎

1809
01:07:58,000 --> 01:08:02,000
所以

1810
01:08:02,000 --> 01:08:04,000
整體來說呢

1811
01:08:04,000 --> 01:08:06,000
這樣的就包含了說

1812
01:08:06,000 --> 01:08:08,000
應該說,整件事情

1813
01:08:08,000 --> 01:08:10,000
的關鍵在於,我們

1814
01:08:10,000 --> 01:08:12,000
如何解決公要事善在外

1815
01:08:12,000 --> 01:08:14,000
不可信的問題

1816
01:08:14,000 --> 01:08:16,000
他的解法其實非常的單純

1817
01:08:16,000 --> 01:08:18,000
我們就是找人幫我們背書

1818
01:08:18,000 --> 01:08:20,000
找人幫我們背書

1819
01:08:20,000 --> 01:08:22,000
誰有資格幫我們背書

1820
01:08:22,000 --> 01:08:24,000
誰有資格幫我們背書,我們

1821
01:08:24,000 --> 01:08:26,000
誰有資格幫我們背書的話

1822
01:08:26,000 --> 01:08:28,000
那個答案會是說,我們不會去懷疑

1823
01:08:28,000 --> 01:08:30,000
他的公要

1824
01:08:30,000 --> 01:08:32,000
普通人的公要

1825
01:08:32,000 --> 01:08:34,000
我們不信,有利人士的

1826
01:08:34,000 --> 01:08:36,000
公要我們相信

1827
01:08:36,000 --> 01:08:38,000
關鍵就在這裡,他的解法就是

1828
01:08:38,000 --> 01:08:40,000
這麼樣的單純

1829
01:08:40,000 --> 01:08:42,000
所以,等於說

1830
01:08:42,000 --> 01:08:44,000
再回來看到,這邊的關鍵是什麼

1831
01:08:44,000 --> 01:08:46,000
你明明就已經要證明公要

1832
01:08:46,000 --> 01:08:48,000
公要跟身份的關係了

1833
01:08:48,000 --> 01:08:50,000
為什麼你這邊可以用一個CA的公要

1834
01:08:50,000 --> 01:08:52,000
去確認這個簽名

1835
01:08:52,000 --> 01:08:54,000
原因很單純,因為CA是有利人士

1836
01:08:54,000 --> 01:08:56,000
我們不會去懷疑他的公要

1837
01:08:56,000 --> 01:08:58,000
就這樣而已

1838
01:08:58,000 --> 01:09:00,000
那當然來講

1839
01:09:00,000 --> 01:09:02,000
這樣的CA就會慢慢的

1840
01:09:02,000 --> 01:09:04,000
構成一個類似

1841
01:09:04,000 --> 01:09:06,000
樹狀的結構,你可能有

1842
01:09:06,000 --> 01:09:08,000
普通等級的有利人士

1843
01:09:08,000 --> 01:09:10,000
可能到

1844
01:09:10,000 --> 01:09:12,000
地方代表,往上一路到政府

1845
01:09:12,000 --> 01:09:14,000
之類的,這樣子的情況

1846
01:09:14,000 --> 01:09:16,000
可能最後會停在

1847
01:09:16,000 --> 01:09:18,000
RootCA這樣的機構

1848
01:09:18,000 --> 01:09:20,000
並且,他的

1849
01:09:20,000 --> 01:09:22,000
憑證是由自己來簽自己

1850
01:09:22,000 --> 01:09:24,000
因為他是最有利的人士

1851
01:09:24,000 --> 01:09:28,000
所以,剛剛提的是

1852
01:09:28,000 --> 01:09:30,000
比較簡化的情境

1853
01:09:30,000 --> 01:09:32,000
就是說,我們剛剛所提到的

1854
01:09:32,000 --> 01:09:34,000
憑證,大概是

1855
01:09:34,000 --> 01:09:36,000
包含這幾個基本的資訊

1856
01:09:36,000 --> 01:09:38,000
實務上來講的話

1857
01:09:38,000 --> 01:09:40,000
現在會在

1858
01:09:40,000 --> 01:09:42,000
比較常使用的憑證的系統

1859
01:09:42,000 --> 01:09:44,000
我們都是叫做X.509

1860
01:09:44,000 --> 01:09:46,000
這一套的憑證

1861
01:09:46,000 --> 01:09:48,000
他現在是在第七版

1862
01:09:48,000 --> 01:09:50,000
簡單的講他的內容的話

1863
01:09:50,000 --> 01:09:52,000
左邊這個是

1864
01:09:52,000 --> 01:09:54,000
他完整的憑證的資料結構

1865
01:09:54,000 --> 01:09:56,000
那他裡面會包含

1866
01:09:56,000 --> 01:09:58,000
很快的帶過,就是包含

1867
01:09:58,000 --> 01:10:00,000
除了剛剛提到的那些簡易的話

1868
01:10:00,000 --> 01:10:02,000
包含他的版本號,可能他的

1869
01:10:02,000 --> 01:10:04,000
證書號

1870
01:10:04,000 --> 01:10:06,000
或者是說,他用哪些演算法

1871
01:10:06,000 --> 01:10:08,000
他是用哪些演算法做的憑證

1872
01:10:08,000 --> 01:10:10,000
或是說,他用哪一個演算法

1873
01:10:10,000 --> 01:10:12,000
跟哪一些參數等等的

1874
01:10:12,000 --> 01:10:14,000
這些資訊,總之

1875
01:10:14,000 --> 01:10:16,000
Ease跟前面我們看到的製作憑證

1876
01:10:16,000 --> 01:10:18,000
確認憑證的那一套是

1877
01:10:18,000 --> 01:10:20,000
類似的

1878
01:10:20,000 --> 01:10:22,000
並且他也會有另外一個是

1879
01:10:22,000 --> 01:10:24,000
叫做Revification List

1880
01:10:24,000 --> 01:10:26,000
就是說,你憑證會有效期

1881
01:10:26,000 --> 01:10:28,000
當然我們希望你過一陣子之後

1882
01:10:28,000 --> 01:10:30,000
再去更新你的憑證

1883
01:10:30,000 --> 01:10:32,000
所以,他會有一個

1884
01:10:32,000 --> 01:10:34,000
憑證撤回的時候,他也需要

1885
01:10:34,000 --> 01:10:36,000
留存做記錄,然後以後可以做集合

1886
01:10:36,000 --> 01:10:38,000
所以

1887
01:10:38,000 --> 01:10:40,000
這樣的,提這件事情的

1888
01:10:40,000 --> 01:10:42,000
重點是跟大家講說

1889
01:10:42,000 --> 01:10:44,000
現在來講,最常使用的

1890
01:10:44,000 --> 01:10:46,000
不管是在怎麼樣的

1891
01:10:46,000 --> 01:10:48,000
Cloud的結構什麼,都會用這種

1892
01:10:48,000 --> 01:10:50,000
叫做公開

1893
01:10:50,000 --> 01:10:52,000
基要基礎建設

1894
01:10:52,000 --> 01:10:54,000
Infrastructure,或叫做Public Key Infrastructure

1895
01:10:54,000 --> 01:10:56,000
就是PKI這種東西

1896
01:10:56,000 --> 01:10:58,000
這個東西的重點是什麼,我們這邊提供一個

1897
01:10:58,000 --> 01:11:00,000
簡單的定義,就是說

1898
01:11:00,000 --> 01:11:02,000
他是有,可能是有硬體,有軟體

1899
01:11:02,000 --> 01:11:04,000
有人,有政策,有流程

1900
01:11:04,000 --> 01:11:06,000
但是,他來做什麼呢

1901
01:11:06,000 --> 01:11:08,000
他會去建立

1902
01:11:08,000 --> 01:11:10,000
管理,儲存,派發

1903
01:11:10,000 --> 01:11:12,000
或者是去撤回憑證

1904
01:11:12,000 --> 01:11:14,000
這邊的重點是在於說

1905
01:11:14,000 --> 01:11:16,000
他整件事情,整個Public Key Infrastructure

1906
01:11:16,000 --> 01:11:18,000
他能夠去做認證的

1907
01:11:18,000 --> 01:11:20,000
基礎,都建立在

1908
01:11:20,000 --> 01:11:22,000
憑證上面

1909
01:11:22,000 --> 01:11:24,000
下面這邊就是

1910
01:11:24,000 --> 01:11:26,000
下面這邊就是多一些包含說

1911
01:11:26,000 --> 01:11:28,000
他的這個PKI裡面

1912
01:11:28,000 --> 01:11:30,000
有什麼樣的成員

1913
01:11:30,000 --> 01:11:32,000
成員可能就會有各個

1914
01:11:32,000 --> 01:11:34,000
那個中端的實體

1915
01:11:34,000 --> 01:11:36,000
比方說像Bob,可能是

1916
01:11:36,000 --> 01:11:38,000
系統裡面的成員

1917
01:11:38,000 --> 01:11:40,000
然後是,也會有我們剛剛講到的CA

1918
01:11:40,000 --> 01:11:42,000
那,有CA之外呢

1919
01:11:42,000 --> 01:11:44,000
也有可能會有RA

1920
01:11:44,000 --> 01:11:46,000
RA是專門做註冊的,就是說

1921
01:11:46,000 --> 01:11:48,000
剛剛在

1922
01:11:48,000 --> 01:11:50,000
我們舉的例子裡面,我們人去

1923
01:11:50,000 --> 01:11:52,000
然後護政事務所辦,然後拿到

1924
01:11:52,000 --> 01:11:54,000
那個身分證,之所以

1925
01:11:54,000 --> 01:11:56,000
我們以後能夠用身分證暢行無阻

1926
01:11:56,000 --> 01:11:58,000
是因為,我們在去辦的時候

1927
01:11:58,000 --> 01:12:00,000
他經過了嚴格的確認

1928
01:12:00,000 --> 01:12:02,000
確認你是正確的人,才頒發給你

1929
01:12:02,000 --> 01:12:04,000
你的身分證,所以註冊的時候

1930
01:12:04,000 --> 01:12:06,000
也是非常重要的一步,你當然不會希望說

1931
01:12:06,000 --> 01:12:08,000
註冊

1932
01:12:08,000 --> 01:12:10,000
註冊的時候可以輕易的

1933
01:12:10,000 --> 01:12:12,000
可以輕易的把駭客X的身分跟

1934
01:12:12,000 --> 01:12:14,000
A的公要綁在一起

1935
01:12:14,000 --> 01:12:16,000
所以註冊也是另外一個難題

1936
01:12:16,000 --> 01:12:18,000
所以註冊有可能是會分開另外一個RA來做的

1937
01:12:18,000 --> 01:12:20,000
然後並且也會有

1938
01:12:20,000 --> 01:12:22,000
憑證測回,叫revocation list

1939
01:12:22,000 --> 01:12:24,000
revocation list

1940
01:12:24,000 --> 01:12:26,000
的管理

1941
01:12:26,000 --> 01:12:28,000
跟,最後就是

1942
01:12:28,000 --> 01:12:30,000
storage,所以整個

1943
01:12:30,000 --> 01:12:32,000
PKI大概會有類似這樣的

1944
01:12:32,000 --> 01:12:34,000
架構,跟他的目的是

1945
01:12:34,000 --> 01:12:36,000
在這裡,所以

1946
01:12:36,000 --> 01:12:38,000
重點

1947
01:12:38,000 --> 01:12:40,000
還是回到說,現在來講

1948
01:12:40,000 --> 01:12:42,000
最常用的這些,特別是

1949
01:12:42,000 --> 01:12:44,000
認證的手段,大部分都圍繞

1950
01:12:44,000 --> 01:12:46,000
在這個憑證上面

1951
01:12:46,000 --> 01:12:50,000
好,那,所以

1952
01:12:50,000 --> 01:12:52,000
到剛剛為止

1953
01:12:52,000 --> 01:12:54,000
到剛剛為止

1954
01:12:54,000 --> 01:12:56,000
大概講了

1955
01:12:56,000 --> 01:12:58,000
我們大概是已經完成了四個

1956
01:12:58,000 --> 01:13:00,000
安全的目標

1957
01:13:00,000 --> 01:13:02,000
那剛剛

1958
01:13:02,000 --> 01:13:04,000
剛才講完的認證

1959
01:13:04,000 --> 01:13:06,000
我們有講了所謂

1960
01:13:06,000 --> 01:13:08,000
有對稱式的跟非對稱式的認證

1961
01:13:08,000 --> 01:13:10,000
再來的話

1962
01:13:10,000 --> 01:13:12,000
我們要提的是,這邊

1963
01:13:12,000 --> 01:13:14,000
先幫大家整理了我們前面所提過的

1964
01:13:14,000 --> 01:13:16,000
下面有四個

1965
01:13:16,000 --> 01:13:18,000
下面有四個我們前面提到的

1966
01:13:18,000 --> 01:13:20,000
安全的目標,跟對應的做法

1967
01:13:20,000 --> 01:13:22,000
在保密性,以保密性而言

1968
01:13:22,000 --> 01:13:24,000
我們會利用加密

1969
01:13:24,000 --> 01:13:26,000
可能包含了對稱跟非對稱式的加密

1970
01:13:26,000 --> 01:13:28,000
那資料完整性的話,我們用雜湊函數

1971
01:13:28,000 --> 01:13:30,000
用來比對摘要是否一樣

1972
01:13:30,000 --> 01:13:32,000
來確認資料完整性

1973
01:13:32,000 --> 01:13:34,000
那這個認證的話

1974
01:13:34,000 --> 01:13:36,000
剛剛最後提的,比較難一點

1975
01:13:36,000 --> 01:13:38,000
我們會用對稱式的,我們會用這個

1976
01:13:38,000 --> 01:13:40,000
訊息認證碼

1977
01:13:40,000 --> 01:13:42,000
或者是用非對稱式的時候,我們會用這個

1978
01:13:42,000 --> 01:13:44,000
憑證來做

1979
01:13:44,000 --> 01:13:46,000
那不可否認性的話

1980
01:13:46,000 --> 01:13:48,000
就通常是依靠數位簽章

1981
01:13:48,000 --> 01:13:50,000
那可以

1982
01:13:50,000 --> 01:13:52,000
值得注意的是說,這裡面大部分

1983
01:13:52,000 --> 01:13:54,000
都會有牽涉到key

1984
01:13:54,000 --> 01:13:56,000
所以其實在我們在講整套

1985
01:13:56,000 --> 01:13:58,000
要去做密碼學的時候,也有一個

1986
01:13:58,000 --> 01:14:00,000
組,也有一個種類的

1987
01:14:00,000 --> 01:14:02,000
這個算法是很常會被用到的

1988
01:14:02,000 --> 01:14:04,000
它都是跟經要有關

1989
01:14:04,000 --> 01:14:06,000
那我們這邊放叫key schemes

1990
01:14:06,000 --> 01:14:08,000
接下來要講的,就是其中一個

1991
01:14:08,000 --> 01:14:10,000
叫做share secret

1992
01:14:10,000 --> 01:14:14,000
所以在講share secret之前,我們要回顧一下

1993
01:14:14,000 --> 01:14:16,000
前面所提到的經要傳遞的問題

1994
01:14:16,000 --> 01:14:18,000
再一次呢,這個經要

1995
01:14:18,000 --> 01:14:20,000
的傳遞的問題是來自於說

1996
01:14:20,000 --> 01:14:22,000
在要做正常的加密

1997
01:14:22,000 --> 01:14:24,000
傳輸訊息的時候,我們會推薦

1998
01:14:24,000 --> 01:14:26,000
使用對稱式的加密的算法

1999
01:14:26,000 --> 01:14:28,000
比較快,也很安全

2000
01:14:28,000 --> 01:14:30,000
但是它的致命的缺陷是在於說

2001
01:14:30,000 --> 01:14:32,000
你會需要有包含有經要的傳遞

2002
01:14:32,000 --> 01:14:34,000
所以前面講過了兩種

2003
01:14:34,000 --> 01:14:36,000
解決這個經要傳遞

2004
01:14:36,000 --> 01:14:38,000
問題的方法,第一種是說

2005
01:14:38,000 --> 01:14:40,000
你就單純的直接使用

2006
01:14:40,000 --> 01:14:42,000
非對稱式經要來做

2007
01:14:42,000 --> 01:14:44,000
那這個比較不推薦

2008
01:14:44,000 --> 01:14:46,000
因為你會變成,你會用複雜的算法

2009
01:14:46,000 --> 01:14:48,000
去算到大量的這個資料

2010
01:14:48,000 --> 01:14:50,000
那第二種我們提的是說

2011
01:14:50,000 --> 01:14:52,000
我們簡化一些,我們先用

2012
01:14:52,000 --> 01:14:54,000
先用這個非對稱式的加密

2013
01:14:54,000 --> 01:14:56,000
來把鑰匙做加密

2014
01:14:56,000 --> 01:14:58,000
之後我們就用那一把鑰匙

2015
01:14:58,000 --> 01:15:00,000
來做對稱式的溝通

2016
01:15:00,000 --> 01:15:02,000
那現在要講的這一種叫做

2017
01:15:02,000 --> 01:15:04,000
用經要交換的協定,那這個是

2018
01:15:04,000 --> 01:15:06,000
其實是一種更快的做法

2019
01:15:06,000 --> 01:15:08,000
你只要有公司要就可以做

2020
01:15:08,000 --> 01:15:10,000
那大部分的

2021
01:15:10,000 --> 01:15:12,000
我們大部分的這種經要交換的協定

2022
01:15:12,000 --> 01:15:14,000
前面有提過

2023
01:15:14,000 --> 01:15:16,000
都是根源於一種叫

2024
01:15:16,000 --> 01:15:18,000
DevHellman,是整套

2025
01:15:18,000 --> 01:15:20,000
非對稱式密碼系統的始祖

2026
01:15:20,000 --> 01:15:22,000
所以我們這邊看的

2027
01:15:22,000 --> 01:15:24,000
就是DevHellman的結構

2028
01:15:24,000 --> 01:15:26,000
那大致上很簡單,它就是

2029
01:15:26,000 --> 01:15:28,000
A跟B各自有他們的公私要對

2030
01:15:28,000 --> 01:15:30,000
私要跟公要是成對的

2031
01:15:30,000 --> 01:15:32,000
所以A會有

2032
01:15:32,000 --> 01:15:34,000
Secret Key of A跟Public Key of A

2033
01:15:34,000 --> 01:15:36,000
這邊是SA跟PA

2034
01:15:36,000 --> 01:15:38,000
同樣的B會有SV跟PB

2035
01:15:38,000 --> 01:15:40,000
那按照道理

2036
01:15:40,000 --> 01:15:42,000
我們前面講過了

2037
01:15:42,000 --> 01:15:44,000
就是私要是絕對不會外洩

2038
01:15:44,000 --> 01:15:46,000
可以四散在外

2039
01:15:46,000 --> 01:15:48,000
所以這邊的話

2040
01:15:48,000 --> 01:15:50,000
我們把PA交給B

2041
01:15:50,000 --> 01:15:52,000
把PB交給A

2042
01:15:52,000 --> 01:15:54,000
也只有這種選項了,就是你不會把

2043
01:15:54,000 --> 01:15:56,000
私要系列的都交出去

2044
01:15:56,000 --> 01:15:58,000
所以你只會交公要

2045
01:15:58,000 --> 01:16:00,000
交了以後發生什麼事情呢

2046
01:16:00,000 --> 01:16:02,000
A這邊有SA跟PB,B這邊有

2047
01:16:02,000 --> 01:16:04,000
SV跟PA,就是他們各自的

2048
01:16:04,000 --> 01:16:06,000
私要都保留得

2049
01:16:06,000 --> 01:16:08,000
好好的,跟對方的公要

2050
01:16:08,000 --> 01:16:10,000
因為公要可以隨意取用

2051
01:16:10,000 --> 01:16:12,000
那很神奇的

2052
01:16:12,000 --> 01:16:14,000
因為數學上設計的原因

2053
01:16:14,000 --> 01:16:16,000
你的SA去跟PB

2054
01:16:16,000 --> 01:16:18,000
做operation得到的這一把G

2055
01:16:18,000 --> 01:16:20,000
會跟SV跟PA

2056
01:16:20,000 --> 01:16:22,000
operate做出來的這一把G

2057
01:16:22,000 --> 01:16:24,000
一模一樣

2058
01:16:24,000 --> 01:16:26,000
就很神奇的數學原因

2059
01:16:26,000 --> 01:16:28,000
造成了這一把得到的G

2060
01:16:28,000 --> 01:16:30,000
是一樣的,也就是說

2061
01:16:30,000 --> 01:16:32,000
你只要有這樣子的成分

2062
01:16:32,000 --> 01:16:34,000
這兩個人就相當於有一把

2063
01:16:34,000 --> 01:16:36,000
一模一樣的key

2064
01:16:36,000 --> 01:16:38,000
因此就可以開始做對稱式的

2065
01:16:38,000 --> 01:16:40,000
加密的傳輸

2066
01:16:40,000 --> 01:16:42,000
所以這邊再舉個例子

2067
01:16:42,000 --> 01:16:44,000
就是說,這邊開始會有一些

2068
01:16:44,000 --> 01:16:46,000
數學細節我們不會去提

2069
01:16:46,000 --> 01:16:48,000
但是最重要的是希望大家

2070
01:16:48,000 --> 01:16:50,000
可以藉由類似圖像記憶的方式

2071
01:16:50,000 --> 01:16:52,000
只要知道結構就好

2072
01:16:52,000 --> 01:16:54,000
結構會是說各自

2073
01:16:54,000 --> 01:16:56,000
A跟B雙方會有一些

2074
01:16:56,000 --> 01:16:58,000
需要的,演算法需要的

2075
01:16:58,000 --> 01:17:00,000
公開的參數

2076
01:17:00,000 --> 01:17:02,000
A跟B,先會有

2077
01:17:02,000 --> 01:17:04,000
產生他們的私要

2078
01:17:04,000 --> 01:17:06,000
在這裡SA跟SV

2079
01:17:06,000 --> 01:17:08,000
就相當於圖裡面的SA跟SV

2080
01:17:08,000 --> 01:17:10,000
藉由這個私要去產生公要

2081
01:17:10,000 --> 01:17:12,000
這邊用的是一個指數

2082
01:17:12,000 --> 01:17:14,000
然後再取mod的這個做法

2083
01:17:14,000 --> 01:17:16,000
所以A跟B兩方都是

2084
01:17:16,000 --> 01:17:18,000
由SA產生PA,由SV產生PB

2085
01:17:18,000 --> 01:17:20,000
做好之後

2086
01:17:20,000 --> 01:17:22,000
把公要交換

2087
01:17:22,000 --> 01:17:24,000
我們剛剛提過了,因為私要

2088
01:17:24,000 --> 01:17:26,000
絕對不會交出去,所以你能交換的

2089
01:17:26,000 --> 01:17:28,000
只有公要,把公要交換了之後

2090
01:17:28,000 --> 01:17:30,000
得到A得到B的公要

2091
01:17:30,000 --> 01:17:32,000
B得到A的公要

2092
01:17:32,000 --> 01:17:34,000
再來就是下一步我們講

2093
01:17:34,000 --> 01:17:36,000
因為神奇的數學的原因

2094
01:17:36,000 --> 01:17:38,000
造成他們做同樣的運算

2095
01:17:38,000 --> 01:17:40,000
所得到的這一把

2096
01:17:40,000 --> 01:17:42,000
這一把金鑰是相同的

2097
01:17:42,000 --> 01:17:44,000
一模一樣的

2098
01:17:44,000 --> 01:17:46,000
這個數學大部分都是

2099
01:17:46,000 --> 01:17:48,000
都是離散數學的

2100
01:17:48,000 --> 01:17:50,000
大部分都是離散數學

2101
01:17:50,000 --> 01:17:52,000
像這一種就是

2102
01:17:52,000 --> 01:17:54,000
前面也講過說

2103
01:17:54,000 --> 01:17:56,000
大部分的非對稱式的演算法

2104
01:17:56,000 --> 01:17:58,000
都是有這樣子的backbone在

2105
01:17:58,000 --> 01:18:00,000
就是基本都能做金鑰交換的協定

2106
01:18:00,000 --> 01:18:04,000
並且我們也提過

2107
01:18:04,000 --> 01:18:06,000
它的重點是在於說

2108
01:18:06,000 --> 01:18:08,000
你有公要的時候

2109
01:18:08,000 --> 01:18:10,000
基本是沒有辦法推回私要的

2110
01:18:10,000 --> 01:18:14,000
之所以為什麼沒有辦法推回私要的原因

2111
01:18:14,000 --> 01:18:16,000
是在於說

2112
01:18:16,000 --> 01:18:18,000
它一定是用到了

2113
01:18:18,000 --> 01:18:20,000
某個數學難題

2114
01:18:20,000 --> 01:18:22,000
所以以離散對數而言

2115
01:18:22,000 --> 01:18:24,000
以Diffie-Hellman而言

2116
01:18:24,000 --> 01:18:26,000
它所用到的難題

2117
01:18:26,000 --> 01:18:28,000
叫做

2118
01:18:28,000 --> 01:18:30,000
對,叫做離散對數

2119
01:18:30,000 --> 01:18:32,000
它的具體來講是怎麼樣的

2120
01:18:32,000 --> 01:18:34,000
就是說我們這邊看很簡單的數字裡

2121
01:18:34,000 --> 01:18:36,000
我們用很小的數字,我們用一個直數

2122
01:18:36,000 --> 01:18:38,000
有一個直數353

2123
01:18:38,000 --> 01:18:40,000
然後有一個直數的原根

2124
01:18:40,000 --> 01:18:42,000
這個是

2125
01:18:42,000 --> 01:18:44,000
離散數學裡面會有

2126
01:18:44,000 --> 01:18:46,000
簡單的來講就是

2127
01:18:46,000 --> 01:18:48,000
我們如果把

2128
01:18:48,000 --> 01:18:50,000
我們現在有一個原根3

2129
01:18:50,000 --> 01:18:52,000
我們把3的一次方

2130
01:18:52,000 --> 01:18:54,000
兩次方三次方一路到

2131
01:18:54,000 --> 01:18:56,000
353次方

2132
01:18:56,000 --> 01:18:58,000
3的一次方到3的

2133
01:18:58,000 --> 01:19:00,000
353次方

2134
01:19:00,000 --> 01:19:02,000
然後都去Mode

2135
01:19:02,000 --> 01:19:04,000
353

2136
01:19:04,000 --> 01:19:06,000
它會以某種排列

2137
01:19:06,000 --> 01:19:08,000
完成1到

2138
01:19:08,000 --> 01:19:10,000
353這個數字

2139
01:19:10,000 --> 01:19:12,000
並且只會各出現一次

2140
01:19:12,000 --> 01:19:16,000
用比較簡單的例子

2141
01:19:16,000 --> 01:19:18,000
假設有一個直數11

2142
01:19:18,000 --> 01:19:20,000
它有一個原根2

2143
01:19:20,000 --> 01:19:22,000
2的一次方Mode11

2144
01:19:22,000 --> 01:19:24,000
2,然後2的二次方Mode11

2145
01:19:24,000 --> 01:19:26,000
4,那一路這樣往上

2146
01:19:26,000 --> 01:19:28,000
疊加到2的11次方

2147
01:19:28,000 --> 01:19:30,000
2的11次方Mode11

2148
01:19:30,000 --> 01:19:32,000
你得到的那個數字

2149
01:19:32,000 --> 01:19:34,000
它會以某種排列完成1到11

2150
01:19:34,000 --> 01:19:38,000
這就是原根

2151
01:19:38,000 --> 01:19:40,000
所以它的整個難題是建立在說

2152
01:19:40,000 --> 01:19:42,000
接下來我們看

2153
01:19:42,000 --> 01:19:44,000
A選的施藥97

2154
01:19:44,000 --> 01:19:46,000
B選的施藥233

2155
01:19:46,000 --> 01:19:48,000
這都是在

2156
01:19:48,000 --> 01:19:50,000
合法的範圍裡面,因為要小於Q

2157
01:19:50,000 --> 01:19:52,000
小於353

2158
01:19:52,000 --> 01:19:54,000
再來就是做公藥的過程

2159
01:19:54,000 --> 01:19:56,000
他們分別去取次方

2160
01:19:56,000 --> 01:19:58,000
去像我們剛剛提的

2161
01:19:58,000 --> 01:20:00,000
取97次方之後Mode353

2162
01:20:00,000 --> 01:20:02,000
得到40

2163
01:20:02,000 --> 01:20:04,000
那B也去做他的公藥

2164
01:20:04,000 --> 01:20:06,000
他把3計算

2165
01:20:06,000 --> 01:20:08,000
233次方之後去Mode353

2166
01:20:08,000 --> 01:20:10,000
得到248

2167
01:20:10,000 --> 01:20:12,000
然後最後一步呢

2168
01:20:12,000 --> 01:20:14,000
很神奇的因為數學的原因

2169
01:20:14,000 --> 01:20:16,000
你把公藥呢

2170
01:20:16,000 --> 01:20:18,000
再乘上施藥的次方再去做Mode

2171
01:20:18,000 --> 01:20:20,000
這兩個會是完全一樣的

2172
01:20:20,000 --> 01:20:22,000
得到的會是160

2173
01:20:22,000 --> 01:20:24,000
這個事情的困難的

2174
01:20:24,000 --> 01:20:26,000
點是在於說我們要從施藥

2175
01:20:26,000 --> 01:20:28,000
去計算公藥相對很容易

2176
01:20:28,000 --> 01:20:30,000
我們

2177
01:20:30,000 --> 01:20:32,000
這就是單純的把算數算完

2178
01:20:32,000 --> 01:20:34,000
然後去做Mode而已,這個容易

2179
01:20:34,000 --> 01:20:36,000
但是難是難在說我今天

2180
01:20:36,000 --> 01:20:38,000
告訴你40

2181
01:20:38,000 --> 01:20:40,000
你要怎麼樣能夠知道是3的97次方

2182
01:20:40,000 --> 01:20:42,000
Mode353的,這個非常

2183
01:20:42,000 --> 01:20:44,000
非常的困難

2184
01:20:44,000 --> 01:20:46,000
所以這是離散對數的難題,是類似這樣的意思

2185
01:20:46,000 --> 01:20:48,000
大概有個感覺

2186
01:20:48,000 --> 01:20:50,000
就可以了

2187
01:20:50,000 --> 01:20:52,000
另外來講的話這邊是

2188
01:20:52,000 --> 01:20:54,000
橢圓曲線的版本,我們前面講過

2189
01:20:54,000 --> 01:20:56,000
橢圓曲線它也能夠做加解密

2190
01:20:56,000 --> 01:20:58,000
也能夠做簽章

2191
01:20:58,000 --> 01:21:00,000
也能夠做精藥交換,這邊就是

2192
01:21:00,000 --> 01:21:02,000
Elliptive Curve版的Devihelm

2193
01:21:02,000 --> 01:21:04,000
那它的

2194
01:21:04,000 --> 01:21:06,000
細節也不用管,它的結構一樣

2195
01:21:06,000 --> 01:21:08,000
我會有公開的參數,A跟B

2196
01:21:08,000 --> 01:21:10,000
先有它們各自的施藥

2197
01:21:10,000 --> 01:21:12,000
從施藥生出

2198
01:21:12,000 --> 01:21:14,000
公藥,然後把公藥做交換

2199
01:21:14,000 --> 01:21:16,000
最後神奇的數學得到它們

2200
01:21:16,000 --> 01:21:18,000
有一把共同的精藥

2201
01:21:18,000 --> 01:21:20,000
一樣的

2202
01:21:20,000 --> 01:21:22,000
所以

2203
01:21:22,000 --> 01:21:24,000
有想要知道細節的話

2204
01:21:24,000 --> 01:21:26,000
或是

2205
01:21:26,000 --> 01:21:28,000
有很多資料可以查詢,或是要討論也都可以

2206
01:21:28,000 --> 01:21:30,000
在關於

2207
01:21:30,000 --> 01:21:32,000
關於這個SharedSecret

2208
01:21:32,000 --> 01:21:34,000
這個部分,我們先暫時就談到這

2209
01:21:34,000 --> 01:21:36,000
接下來的話,要進到的是

2210
01:21:36,000 --> 01:21:38,000
Case Study,就是基本上是

2211
01:21:38,000 --> 01:21:40,000
幫大家能夠複習一下我們今天所提的所有東西

2212
01:21:40,000 --> 01:21:42,000
我們這邊用一個

2213
01:21:42,000 --> 01:21:44,000
簡單的

2214
01:21:44,000 --> 01:21:46,000
生活中的範例,我們假設呢

2215
01:21:46,000 --> 01:21:48,000
今天

2216
01:21:48,000 --> 01:21:50,000
我們手機的iOS要更新

2217
01:21:50,000 --> 01:21:52,000
所以我們手機的iOS

2218
01:21:52,000 --> 01:21:54,000
要更新的時候,是從我們當然是

2219
01:21:54,000 --> 01:21:56,000
由Apple送這個File來

2220
01:21:56,000 --> 01:21:58,000
所以這邊呢,我們要

2221
01:21:58,000 --> 01:22:00,000
先做幾點假設

2222
01:22:00,000 --> 01:22:02,000
第一個,我們認定

2223
01:22:02,000 --> 01:22:04,000
Apple不希望iOS

2224
01:22:04,000 --> 01:22:06,000
File輕易的外洩

2225
01:22:06,000 --> 01:22:08,000
它指的是保密性

2226
01:22:08,000 --> 01:22:10,000
我們這邊隱含的就是說

2227
01:22:10,000 --> 01:22:12,000
我們假定它是有加密過的File

2228
01:22:12,000 --> 01:22:14,000
加密過的iOSFile傳過來

2229
01:22:14,000 --> 01:22:16,000
那當然

2230
01:22:16,000 --> 01:22:18,000
iOSFile我們知道它的檔案非常

2231
01:22:18,000 --> 01:22:20,000
龐大,所以就像我們一直在講的

2232
01:22:20,000 --> 01:22:22,000
只要是這種加密的傳輸

2233
01:22:22,000 --> 01:22:24,000
我們推薦使用的是對稱式的

2234
01:22:24,000 --> 01:22:26,000
的這個加密的演算法

2235
01:22:26,000 --> 01:22:28,000
比較不會吃力

2236
01:22:28,000 --> 01:22:30,000
所以為了你要能夠用

2237
01:22:30,000 --> 01:22:32,000
對稱式的加密演算法

2238
01:22:32,000 --> 01:22:34,000
你就會需要有

2239
01:22:34,000 --> 01:22:36,000
那把對稱的key

2240
01:22:36,000 --> 01:22:38,000
所以沒有一開始

2241
01:22:38,000 --> 01:22:40,000
我們跟Apple可能沒有對稱的那把key的時候

2242
01:22:40,000 --> 01:22:42,000
我們會做什麼,我們就可能

2243
01:22:42,000 --> 01:22:44,000
可以用剛剛所提到的SharedSecret

2244
01:22:44,000 --> 01:22:46,000
去做一把SharedKey出來

2245
01:22:46,000 --> 01:22:48,000
所以剛剛怎麼樣提到

2246
01:22:48,000 --> 01:22:50,000
做SharedKey呢,我們都是

2247
01:22:50,000 --> 01:22:52,000
交換PublicKey

2248
01:22:52,000 --> 01:22:54,000
我們這樣一路道著回去

2249
01:22:54,000 --> 01:22:56,000
我們要做SharedKey,我們必須要交換PublicKey

2250
01:22:56,000 --> 01:22:58,000
就是表示我們各自有我們各自的公要

2251
01:22:58,000 --> 01:23:00,000
跟私要,並且我們拿公要

2252
01:23:00,000 --> 01:23:02,000
出去跟別人交換

2253
01:23:02,000 --> 01:23:04,000
然後再經過神奇的數學運算得到

2254
01:23:04,000 --> 01:23:06,000
同樣一把共同的金鑰

2255
01:23:06,000 --> 01:23:08,000
問題又來了,這一把公要

2256
01:23:08,000 --> 01:23:10,000
怎麼樣知道能夠信

2257
01:23:10,000 --> 01:23:12,000
所以我們需要有

2258
01:23:12,000 --> 01:23:14,000
那一把公要跟

2259
01:23:14,000 --> 01:23:16,000
公要持有人的身份

2260
01:23:16,000 --> 01:23:18,000
我們需要把這件事情綁定在一起

2261
01:23:18,000 --> 01:23:20,000
那就是我們照我們剛剛講的,用憑證

2262
01:23:20,000 --> 01:23:22,000
有憑證的機構可以來幫我們做這件事情

2263
01:23:22,000 --> 01:23:26,000
所以這裡面至少會

2264
01:23:26,000 --> 01:23:28,000
需要什麼呢,至少會需要說

2265
01:23:28,000 --> 01:23:30,000
Apple有一個

2266
01:23:30,000 --> 01:23:32,000
由Ca,由憑證機構

2267
01:23:32,000 --> 01:23:34,000
所簽發的這一個憑證

2268
01:23:34,000 --> 01:23:36,000
那我們要更新的

2269
01:23:36,000 --> 01:23:38,000
User呢,我們可以

2270
01:23:38,000 --> 01:23:40,000
用這個

2271
01:23:40,000 --> 01:23:42,000
用Ca的公要去Verify

2272
01:23:42,000 --> 01:23:44,000
確認這一個憑證

2273
01:23:44,000 --> 01:23:46,000
以得到正確的Apple的

2274
01:23:46,000 --> 01:23:48,000
PublicKey

2275
01:23:48,000 --> 01:23:50,000
得到Apple的PublicKey,我們的PublicKey之後

2276
01:23:50,000 --> 01:23:52,000
就可以做金鑰交換

2277
01:23:52,000 --> 01:23:54,000
就可以得到

2278
01:23:54,000 --> 01:23:56,000
共同的一把金鑰,再來用這把共同的金鑰

2279
01:23:56,000 --> 01:23:58,000
做加密,所以這樣一路

2280
01:23:58,000 --> 01:24:00,000
道著回去是這樣

2281
01:24:00,000 --> 01:24:02,000
那再來

2282
01:24:02,000 --> 01:24:04,000
收到了之後會需要什麼

2283
01:24:04,000 --> 01:24:06,000
收到了之後呢,我們

2284
01:24:06,000 --> 01:24:08,000
會想要知道幾件事情,我們想要知道說

2285
01:24:08,000 --> 01:24:10,000
這個File是Apple

2286
01:24:10,000 --> 01:24:12,000
送過來的,而且是

2287
01:24:12,000 --> 01:24:14,000
不是由別人所送過來的

2288
01:24:14,000 --> 01:24:16,000
並且呢

2289
01:24:16,000 --> 01:24:18,000
並且這個

2290
01:24:18,000 --> 01:24:20,000
我們收到的File的內容沒有經過篡改

2291
01:24:20,000 --> 01:24:22,000
跟Apple原本想傳的那個東西是一樣的

2292
01:24:22,000 --> 01:24:24,000
所以有這兩個條件

2293
01:24:24,000 --> 01:24:26,000
我們會要用到的是數位簽章

2294
01:24:26,000 --> 01:24:28,000
數位簽章能夠

2295
01:24:28,000 --> 01:24:30,000
幫我們確認,只有擁有那個

2296
01:24:30,000 --> 01:24:32,000
私藥的人能夠簽,大家都

2297
01:24:32,000 --> 01:24:34,000
可以確認,並且

2298
01:24:34,000 --> 01:24:36,000
因為你簽的東西也包含了

2299
01:24:36,000 --> 01:24:38,000
這個內容的摘要

2300
01:24:38,000 --> 01:24:40,000
所以內容經過篡改

2301
01:24:40,000 --> 01:24:42,000
的時候,簽名就不會

2302
01:24:42,000 --> 01:24:44,000
簽名就會變得不一樣

2303
01:24:44,000 --> 01:24:48,000
好,那

2304
01:24:48,000 --> 01:24:50,000
再來的話,再來的話我們就

2305
01:24:50,000 --> 01:24:52,000
畫幾個簡單的圖,所以

2306
01:24:52,000 --> 01:24:54,000
所以剛剛講了這麼多呢

2307
01:24:54,000 --> 01:24:56,000
我們把整件事情整個要

2308
01:24:56,000 --> 01:24:58,000
完成IOS的更新,我們把它分成三個步驟

2309
01:24:58,000 --> 01:25:00,000
我們前面提過我們需要

2310
01:25:00,000 --> 01:25:02,000
得到正確的Apple的Public Key

2311
01:25:02,000 --> 01:25:04,000
這個怎麼做

2312
01:25:04,000 --> 01:25:06,000
我們會用到憑證

2313
01:25:06,000 --> 01:25:08,000
我們要想辦法得到Apple的Public Key

2314
01:25:08,000 --> 01:25:10,000
正確的Public Key之後,我們就可以

2315
01:25:10,000 --> 01:25:12,000
跑這個經藥交換的協定

2316
01:25:12,000 --> 01:25:14,000
得到一把共同的經藥

2317
01:25:14,000 --> 01:25:16,000
再來是

2318
01:25:16,000 --> 01:25:18,000
收到了加密過後

2319
01:25:18,000 --> 01:25:20,000
的這個file之後,我們要確認它的來源

2320
01:25:20,000 --> 01:25:22,000
跟確認它的內容有沒有經過

2321
01:25:22,000 --> 01:25:24,000
篡改,會用數位簽章

2322
01:25:24,000 --> 01:25:26,000
所以

2323
01:25:26,000 --> 01:25:28,000
首先是第一步

2324
01:25:28,000 --> 01:25:30,000
是要取得正確的Public Key

2325
01:25:30,000 --> 01:25:32,000
我們會做什麼事情呢,大概會是這樣

2326
01:25:32,000 --> 01:25:34,000
A,把它的Public Key

2327
01:25:34,000 --> 01:25:36,000
它自己拿去找CA

2328
01:25:36,000 --> 01:25:38,000
去做註冊

2329
01:25:38,000 --> 01:25:40,000
註冊通過CA去

2330
01:25:40,000 --> 01:25:42,000
你是Apple,你的Public Key也

2331
01:25:42,000 --> 01:25:44,000
對了,我就頒發證書給你

2332
01:25:44,000 --> 01:25:46,000
這個證書就會有

2333
01:25:46,000 --> 01:25:48,000
Apple的ID跟

2334
01:25:48,000 --> 01:25:50,000
Apple的Public Key

2335
01:25:50,000 --> 01:25:52,000
並且是由

2336
01:25:52,000 --> 01:25:54,000
CA的私藥所

2337
01:25:54,000 --> 01:25:56,000
簽發的

2338
01:25:56,000 --> 01:25:58,000
得到了這個憑證

2339
01:25:58,000 --> 01:26:00,000
之後呢,Apple

2340
01:26:00,000 --> 01:26:02,000
也就可以把這個憑證交給Bubb

2341
01:26:02,000 --> 01:26:04,000
那Bubb可以去確認這個

2342
01:26:04,000 --> 01:26:06,000
憑證,他可以用CA的

2343
01:26:06,000 --> 01:26:08,000
公要,因為我們不會懷疑他的公要

2344
01:26:08,000 --> 01:26:10,000
然後去對這個

2345
01:26:10,000 --> 01:26:12,000
去確認這個憑證得到正確的Apple

2346
01:26:12,000 --> 01:26:14,000
ID跟Public Key

2347
01:26:14,000 --> 01:26:16,000
我們就得到正確的Public Key

2348
01:26:16,000 --> 01:26:20,000
那下一步的話,再來就是

2349
01:26:20,000 --> 01:26:22,000
一樣用這個經藥交換協定

2350
01:26:22,000 --> 01:26:24,000
就是很神奇的呢

2351
01:26:24,000 --> 01:26:26,000
我們就有

2352
01:26:26,000 --> 01:26:28,000
SAPA,SP,PB之後把PA跟PB交換

2353
01:26:28,000 --> 01:26:30,000
就得到了一把對稱的

2354
01:26:30,000 --> 01:26:32,000
並且是一樣的這個

2355
01:26:32,000 --> 01:26:34,000
完全一模一樣的這一把共同

2356
01:26:34,000 --> 01:26:36,000
經藥機

2357
01:26:36,000 --> 01:26:38,000
前面再補充一點就是說這邊指的是

2358
01:26:38,000 --> 01:26:40,000
這邊指的是取得了正確的

2359
01:26:40,000 --> 01:26:42,000
Apple的Public Key,但是

2360
01:26:42,000 --> 01:26:44,000
等於說反過來Bubb也可以做這件事

2361
01:26:44,000 --> 01:26:46,000
也可以去得到他的

2362
01:26:46,000 --> 01:26:48,000
憑證,然後把他的

2363
01:26:48,000 --> 01:26:50,000
公要跟憑證也一併交給Apple

2364
01:26:50,000 --> 01:26:52,000
所以這是

2365
01:26:52,000 --> 01:26:54,000
雙向

2366
01:26:54,000 --> 01:26:56,000
到這邊已經有了一把共同的

2367
01:26:56,000 --> 01:26:58,000
經藥機可以用來做對稱式的

2368
01:26:58,000 --> 01:27:00,000
加密

2369
01:27:00,000 --> 01:27:02,000
加密了過後我們把

2370
01:27:02,000 --> 01:27:04,000
IOS File經過加密之後變成這個

2371
01:27:04,000 --> 01:27:06,000
問號的框框,那我們把

2372
01:27:06,000 --> 01:27:08,000
這個Sign過的這一個

2373
01:27:08,000 --> 01:27:10,000
沒有,我們要做

2374
01:27:10,000 --> 01:27:12,000
Sign這一段,我們把加密

2375
01:27:12,000 --> 01:27:14,000
過的這個File進Hash得到

2376
01:27:14,000 --> 01:27:16,000
摘要,然後呢我們

2377
01:27:16,000 --> 01:27:18,000
用這個撕藥

2378
01:27:18,000 --> 01:27:20,000
用Apple用他自己的撕藥去

2379
01:27:20,000 --> 01:27:22,000
對這個Hash

2380
01:27:22,000 --> 01:27:24,000
的digest去做簽章

2381
01:27:24,000 --> 01:27:26,000
那把這個簽章

2382
01:27:26,000 --> 01:27:28,000
跟這個File都

2383
01:27:28,000 --> 01:27:30,000
傳到Bubb手上的時候

2384
01:27:30,000 --> 01:27:32,000
那Bubb也可以把這個加密過的

2385
01:27:32,000 --> 01:27:34,000
問號的框框進到Hash

2386
01:27:34,000 --> 01:27:36,000
然後再來用

2387
01:27:36,000 --> 01:27:38,000
Apple的公要,因為他有正確的

2388
01:27:38,000 --> 01:27:40,000
公要,然後去Verify

2389
01:27:40,000 --> 01:27:42,000
Verify這個Signature

2390
01:27:42,000 --> 01:27:44,000
然後得到比對是不是一樣的

2391
01:27:44,000 --> 01:27:46,000
是的話就表示這個

2392
01:27:46,000 --> 01:27:48,000
File確實是正確的沒有被修改

2393
01:27:48,000 --> 01:27:50,000
並且這個簽章是由Apple

2394
01:27:50,000 --> 01:27:52,000
的Private Key所

2395
01:27:52,000 --> 01:27:54,000
簽的

2396
01:27:54,000 --> 01:27:56,000
到

2397
01:27:56,000 --> 01:27:58,000
到這邊這樣的流程

2398
01:27:58,000 --> 01:28:00,000
有問題嗎?這樣基本上我們就

2399
01:28:00,000 --> 01:28:02,000
跑完了剛剛我們前面講到的情境

2400
01:28:02,000 --> 01:28:04,000
跟假設

2401
01:28:04,000 --> 01:28:06,000
好

2402
01:28:06,000 --> 01:28:08,000
好,那

2403
01:28:08,000 --> 01:28:10,000
很快的就在最後再帶一下

2404
01:28:10,000 --> 01:28:12,000
結論,那

2405
01:28:12,000 --> 01:28:14,000
整個要講這一堂課的目的來講

2406
01:28:14,000 --> 01:28:16,000
最主要還是希望大家

2407
01:28:16,000 --> 01:28:18,000
能夠了解,了解說

2408
01:28:18,000 --> 01:28:20,000
到底Security在做什麼

2409
01:28:20,000 --> 01:28:22,000
首先要再來回

2410
01:28:22,000 --> 01:28:24,000
過頭來講的是

2411
01:28:24,000 --> 01:28:26,000
我們剛剛有一張表看到的是

2412
01:28:26,000 --> 01:28:28,000
有我們今天學過的

2413
01:28:28,000 --> 01:28:30,000
今天學過的四個安全

2414
01:28:30,000 --> 01:28:32,000
的目標,再配上

2415
01:28:32,000 --> 01:28:34,000
一個key scheme

2416
01:28:34,000 --> 01:28:36,000
那張圖如果各位還有印象的話

2417
01:28:36,000 --> 01:28:38,000
現在這張表是一個更完整的補充

2418
01:28:38,000 --> 01:28:40,000
就是說,到底總共來講

2419
01:28:40,000 --> 01:28:42,000
有哪一些這個密碼學相關的

2420
01:28:42,000 --> 01:28:44,000
功能,所以前面

2421
01:28:44,000 --> 01:28:46,000
有所謂的BlockCypher跟BlockCypherMode

2422
01:28:46,000 --> 01:28:48,000
這個其實都講的是加密

2423
01:28:48,000 --> 01:28:50,000
虛塊的加密,就是說

2424
01:28:50,000 --> 01:28:52,000
以固定的長度為單位去做加密

2425
01:28:52,000 --> 01:28:54,000
以128倍為單位

2426
01:28:54,000 --> 01:28:56,000
或以256倍為單位去做加密

2427
01:28:56,000 --> 01:28:58,000
跟加密的不同的

2428
01:28:58,000 --> 01:29:00,000
這個工作模式,這個有需要的話

2429
01:29:00,000 --> 01:29:02,000
再補充就好,那並且也有

2430
01:29:02,000 --> 01:29:04,000
做數位簽章

2431
01:29:04,000 --> 01:29:06,000
那再來是跟key有關的

2432
01:29:06,000 --> 01:29:08,000
有像是KDF是說

2433
01:29:08,000 --> 01:29:10,000
用一把,如何用一把key

2434
01:29:10,000 --> 01:29:12,000
衍生出多個key,這個

2435
01:29:12,000 --> 01:29:14,000
很重要,因為我們不希望一把key太常

2436
01:29:14,000 --> 01:29:16,000
被重複利用,它的安全性自然就會

2437
01:29:16,000 --> 01:29:18,000
降低,所以如何用一把key

2438
01:29:18,000 --> 01:29:20,000
健康的去生出很多把

2439
01:29:20,000 --> 01:29:22,000
也可以使用的key

2440
01:29:22,000 --> 01:29:24,000
這是KDF在做的事情,那也會包含

2441
01:29:24,000 --> 01:29:26,000
像key management的一個

2442
01:29:26,000 --> 01:29:28,000
這個演算法來講比較像是組合計

2443
01:29:28,000 --> 01:29:30,000
就是說它包含

2444
01:29:30,000 --> 01:29:32,000
有像生成、交換、儲存、使用等等

2445
01:29:32,000 --> 01:29:34,000
這樣一整套

2446
01:29:34,000 --> 01:29:36,000
那另外也有我們前面

2447
01:29:36,000 --> 01:29:38,000
提過的message authentication

2448
01:29:38,000 --> 01:29:40,000
訊息認證碼這種的

2449
01:29:40,000 --> 01:29:42,000
那或者是

2450
01:29:42,000 --> 01:29:44,000
我們也講過

2451
01:29:44,000 --> 01:29:46,000
非常重要的

2452
01:29:46,000 --> 01:29:48,000
叫做亂數產生

2453
01:29:48,000 --> 01:29:50,000
注意這邊講的這個亂數產生

2454
01:29:50,000 --> 01:29:52,000
指的都是用函數

2455
01:29:52,000 --> 01:29:54,000
產生的那一種,就是叫

2456
01:29:54,000 --> 01:29:56,000
pseudo-random,或是在這邊

2457
01:29:56,000 --> 01:29:58,000
以這邊這個DRB去,這叫做deterministic

2458
01:29:58,000 --> 01:30:00,000
random bit generator,就是說它是

2459
01:30:00,000 --> 01:30:02,000
基本上來講它就是

2460
01:30:02,000 --> 01:30:04,000
可以重現的,它並不是真水級的

2461
01:30:04,000 --> 01:30:06,000
就像我們寫程式的時候會用的

2462
01:30:06,000 --> 01:30:08,000
那種,比方說我們要call一個random

2463
01:30:08,000 --> 01:30:10,000
的function,然後我們去

2464
01:30:10,000 --> 01:30:12,000
給它一個seed

2465
01:30:12,000 --> 01:30:14,000
這種random的函數都會是

2466
01:30:14,000 --> 01:30:16,000
尾隨機的函數

2467
01:30:16,000 --> 01:30:18,000
那再來的話還有像hashing

2468
01:30:18,000 --> 01:30:20,000
secure hashing,那我們就我們前面

2469
01:30:20,000 --> 01:30:22,000
提過的,就是如何確保

2470
01:30:22,000 --> 01:30:24,000
資料完整性,我們會用hash

2471
01:30:24,000 --> 01:30:26,000
function,這邊我們主要使用sharp

2472
01:30:26,000 --> 01:30:28,000
那再來也是其他的組合計

2473
01:30:28,000 --> 01:30:30,000
包含說你,因為你的這個

2474
01:30:30,000 --> 01:30:32,000
橢圓曲線的密碼學,它能夠負擔

2475
01:30:32,000 --> 01:30:34,000
很多功能,所以通常在

2476
01:30:34,000 --> 01:30:36,000
implement的時候,我們會

2477
01:30:36,000 --> 01:30:38,000
真正會做到的事情是比較像是去

2478
01:30:38,000 --> 01:30:40,000
做一個專門來運算

2479
01:30:40,000 --> 01:30:42,000
橢圓曲線的數學的一個加速器

2480
01:30:42,000 --> 01:30:44,000
那至於說

2481
01:30:44,000 --> 01:30:46,000
你有那個橢圓曲線的算法

2482
01:30:46,000 --> 01:30:48,000
你也可以去算這個

2483
01:30:48,000 --> 01:30:50,000
橢圓曲線的點相乘,點相加

2484
01:30:50,000 --> 01:30:52,000
這種的,那再來要怎麼樣做到

2485
01:30:52,000 --> 01:30:54,000
像是橢圓曲線千張

2486
01:30:54,000 --> 01:30:56,000
或是橢圓曲線的金鑰交換

2487
01:30:56,000 --> 01:30:58,000
那就是在把它組合起來

2488
01:30:58,000 --> 01:31:00,000
所以會有個別的組件

2489
01:31:00,000 --> 01:31:02,000
這樣子,所以這樣子的

2490
01:31:02,000 --> 01:31:04,000
表格大概就是

2491
01:31:04,000 --> 01:31:06,000
實際上在

2492
01:31:06,000 --> 01:31:08,000
演算法認證的時候會要

2493
01:31:08,000 --> 01:31:10,000
去做的事情

2494
01:31:10,000 --> 01:31:12,000
那

2495
01:31:12,000 --> 01:31:14,000
所以

2496
01:31:14,000 --> 01:31:16,000
快要總結了

2497
01:31:16,000 --> 01:31:18,000
所以到底

2498
01:31:18,000 --> 01:31:20,000
PUF或者是

2499
01:31:20,000 --> 01:31:22,000
力望跟SAMA到底跟這個有什麼樣的關係

2500
01:31:22,000 --> 01:31:24,000
所以這邊我們回顧一下

2501
01:31:24,000 --> 01:31:26,000
用一張很簡單的圖回顧一下今天

2502
01:31:26,000 --> 01:31:28,000
所提的內容,我們就有提到說

2503
01:31:28,000 --> 01:31:30,000
有不同的這個,不同的安全的目標

2504
01:31:30,000 --> 01:31:32,000
然後跟有各式各樣的

2505
01:31:32,000 --> 01:31:34,000
做法,那可以從

2506
01:31:34,000 --> 01:31:36,000
這張圖上面看到的是說

2507
01:31:36,000 --> 01:31:38,000
大部分我們為了要達到

2508
01:31:38,000 --> 01:31:40,000
安全的目標

2509
01:31:40,000 --> 01:31:42,000
我們都會需要用到

2510
01:31:42,000 --> 01:31:44,000
我們都會需要用到的是有

2511
01:31:44,000 --> 01:31:46,000
這個算法,就是密碼學的運算

2512
01:31:46,000 --> 01:31:48,000
跟金鑰

2513
01:31:48,000 --> 01:31:50,000
那前面我們也

2514
01:31:50,000 --> 01:31:52,000
很多次提到就是說

2515
01:31:52,000 --> 01:31:54,000
整個系統的安全會建立在金鑰上面

2516
01:31:54,000 --> 01:31:56,000
金鑰是我們假設

2517
01:31:56,000 --> 01:31:58,000
絕對不能外洩的

2518
01:31:58,000 --> 01:32:00,000
那再來呢

2519
01:32:00,000 --> 01:32:02,000
再來,所以因為

2520
01:32:02,000 --> 01:32:04,000
這些運算或運作裡面

2521
01:32:04,000 --> 01:32:06,000
安全的運作裡面,大部分都會牽涉到

2522
01:32:06,000 --> 01:32:08,000
演算法或是金鑰

2523
01:32:08,000 --> 01:32:10,000
那並且

2524
01:32:10,000 --> 01:32:12,000
並且安全性是建立在

2525
01:32:12,000 --> 01:32:14,000
金鑰上面,而並非

2526
01:32:14,000 --> 01:32:16,000
演算法,我這邊指的並非

2527
01:32:16,000 --> 01:32:18,000
演算法的意思是說,因為我們要

2528
01:32:18,000 --> 01:32:20,000
互相做溝通的時候,我們用的演算法

2529
01:32:20,000 --> 01:32:22,000
會是統一的規格

2530
01:32:22,000 --> 01:32:24,000
或是會是某一種大家都可以

2531
01:32:24,000 --> 01:32:26,000
接受的標準,才能夠互相溝通

2532
01:32:26,000 --> 01:32:28,000
這應該可以理解

2533
01:32:28,000 --> 01:32:30,000
也因此,我們必須要能夠

2534
01:32:30,000 --> 01:32:32,000
我們必須要假設,攻擊

2535
01:32:32,000 --> 01:32:34,000
你的這些駭客,他也相當熟悉你的

2536
01:32:34,000 --> 01:32:36,000
系統,熟悉你的演算法

2537
01:32:36,000 --> 01:32:38,000
唯一不知道的只有金鑰

2538
01:32:38,000 --> 01:32:40,000
這個大家可以接受嗎?可以

2539
01:32:40,000 --> 01:32:42,000
那

2540
01:32:42,000 --> 01:32:44,000
所以接下來呢,就是說

2541
01:32:44,000 --> 01:32:46,000
既然整個安全性都

2542
01:32:46,000 --> 01:32:48,000
建立在金鑰上面

2543
01:32:48,000 --> 01:32:50,000
保護這把金鑰當然相當重要

2544
01:32:50,000 --> 01:32:52,000
所以我們把剛剛的

2545
01:32:52,000 --> 01:32:54,000
流程再經過簡化

2546
01:32:54,000 --> 01:32:56,000
剛剛的我們大概都只看到

2547
01:32:56,000 --> 01:32:58,000
有Data,然後有Cryptoengine

2548
01:32:58,000 --> 01:33:00,000
像AES或是ECC這種

2549
01:33:00,000 --> 01:33:02,000
這種Block,這種Operation

2550
01:33:02,000 --> 01:33:04,000
然後得到了Cypher,或得到

2551
01:33:04,000 --> 01:33:06,000
密文,或是它的Output,剛剛我們

2552
01:33:06,000 --> 01:33:08,000
大概都只在看這一段

2553
01:33:08,000 --> 01:33:10,000
那現在因為有Key加入了

2554
01:33:10,000 --> 01:33:12,000
那我們前面也會包含有Key的

2555
01:33:12,000 --> 01:33:14,000
產生,跟Key的

2556
01:33:14,000 --> 01:33:16,000
儲存,這個很自然

2557
01:33:16,000 --> 01:33:18,000
我們先產生了一把Key,然後存

2558
01:33:18,000 --> 01:33:20,000
把它妥善的存好

2559
01:33:20,000 --> 01:33:22,000
需要的時候

2560
01:33:22,000 --> 01:33:24,000
需要的時候把它叫來使用

2561
01:33:24,000 --> 01:33:26,000
在Cryptoengine裡面,然後就可以

2562
01:33:26,000 --> 01:33:28,000
把這個Data進到Cryptoengine得到Cypher

2563
01:33:28,000 --> 01:33:30,000
那所以當然

2564
01:33:30,000 --> 01:33:32,000
跟Key最重要的就是

2565
01:33:32,000 --> 01:33:34,000
這三步了

2566
01:33:34,000 --> 01:33:36,000
那我們這三步等於說是

2567
01:33:36,000 --> 01:33:38,000
基本上是錨定整個裝置或是整個

2568
01:33:38,000 --> 01:33:40,000
晶片的安全

2569
01:33:40,000 --> 01:33:42,000
所以我們一般把這樣子的

2570
01:33:42,000 --> 01:33:44,000
負責這樣子的功能的

2571
01:33:44,000 --> 01:33:46,000
的Unit

2572
01:33:46,000 --> 01:33:48,000
叫做Rule of Trust,叫做信任根

2573
01:33:48,000 --> 01:33:52,000
到這邊可以接受的話,那接下來

2574
01:33:52,000 --> 01:33:54,000
剩下的問題就很簡單了

2575
01:33:54,000 --> 01:33:56,000
就像前面看到的

2576
01:33:56,000 --> 01:33:58,000
第一、二、三

2577
01:33:58,000 --> 01:34:00,000
我們現在就是問這三個問題說

2578
01:34:00,000 --> 01:34:02,000
怎麼樣能夠產生Secret Key

2579
01:34:02,000 --> 01:34:04,000
第二個是怎麼樣能夠儲存Secret Key

2580
01:34:04,000 --> 01:34:06,000
第三個是怎麼樣

2581
01:34:06,000 --> 01:34:08,000
安全的使用這些Key

2582
01:34:08,000 --> 01:34:10,000
用來做密碼學的運算

2583
01:34:10,000 --> 01:34:12,000
那這三個問題分別

2584
01:34:12,000 --> 01:34:14,000
都有它的簡答,就是說怎麼樣

2585
01:34:14,000 --> 01:34:16,000
產生Key,我們用製程

2586
01:34:16,000 --> 01:34:18,000
變異,我們常常講的晶片

2587
01:34:18,000 --> 01:34:20,000
指紋,到這邊大家應該可以開始

2588
01:34:20,000 --> 01:34:22,000
感受到接下來要說什麼

2589
01:34:22,000 --> 01:34:24,000
那我們要怎麼樣能夠安全的儲存Key

2590
01:34:24,000 --> 01:34:26,000
我們把Rule of Trust

2591
01:34:26,000 --> 01:34:28,000
讓它配備有靜態跟動態的

2592
01:34:28,000 --> 01:34:30,000
Entropy

2593
01:34:30,000 --> 01:34:32,000
配備有靜態跟動態的

2594
01:34:32,000 --> 01:34:34,000
桑源

2595
01:34:34,000 --> 01:34:36,000
再來最後一個是我們要怎麼樣

2596
01:34:36,000 --> 01:34:38,000
我們要怎麼樣能夠

2597
01:34:38,000 --> 01:34:40,000
安全的讓Key用在密碼學的運作裡面

2598
01:34:40,000 --> 01:34:42,000
那就是我們把

2599
01:34:42,000 --> 01:34:44,000
Rule of Trust的單元

2600
01:34:44,000 --> 01:34:46,000
我們再給它配備密碼

2601
01:34:46,000 --> 01:34:48,000
學演算法

2602
01:34:48,000 --> 01:34:50,000
的目的在於說,如果

2603
01:34:50,000 --> 01:34:52,000
今天所有安全功能都執行

2604
01:34:52,000 --> 01:34:54,000
在一個固定的邊界裡面

2605
01:34:54,000 --> 01:34:56,000
它就不會

2606
01:34:56,000 --> 01:34:58,000
有比方說Key

2607
01:34:58,000 --> 01:35:00,000
或是未加密的重要資料

2608
01:35:00,000 --> 01:35:02,000
在Bus上面流傳這樣子的狀況

2609
01:35:02,000 --> 01:35:04,000
它可以

2610
01:35:04,000 --> 01:35:06,000
安全的鎖在一個邊界裡面

2611
01:35:06,000 --> 01:35:08,000
那這三個問題的答案

2612
01:35:08,000 --> 01:35:10,000
對應過來就是

2613
01:35:10,000 --> 01:35:12,000
怎麼樣產生Key NeoPath

2614
01:35:12,000 --> 01:35:14,000
怎麼樣安全的儲存Key用Path RT

2615
01:35:14,000 --> 01:35:16,000
我們前面講過Path RT有Dynamic跟Static

2616
01:35:16,000 --> 01:35:18,000
Static的Entropy,就是說

2617
01:35:18,000 --> 01:35:20,000
你這邊有Secure OTP

2618
01:35:20,000 --> 01:35:22,000
你另外有TRNG可以產生

2619
01:35:22,000 --> 01:35:24,000
真隨機的亂數給你使用

2620
01:35:24,000 --> 01:35:26,000
怎麼樣安全的用Key在

2621
01:35:26,000 --> 01:35:28,000
密碼學的運作裡面

2622
01:35:28,000 --> 01:35:30,000
我們把這一個Path RT的單元

2623
01:35:30,000 --> 01:35:32,000
外面再掛上其他的演算法

2624
01:35:32,000 --> 01:35:34,000
所有安全功能都會執行

2625
01:35:34,000 --> 01:35:36,000
在這一個邊界裡面

2626
01:35:36,000 --> 01:35:38,000
然後你這一個邊界它另外才接到Bus上面去

2627
01:35:38,000 --> 01:35:40,000
所以不會有

2628
01:35:40,000 --> 01:35:42,000
任何進要

2629
01:35:42,000 --> 01:35:44,000
什麼資料在外面流通的這樣的問題

2630
01:35:44,000 --> 01:35:46,000
所以三個問題

2631
01:35:46,000 --> 01:35:48,000
對應三個答案

2632
01:35:48,000 --> 01:35:50,000
今天如果大家能夠帶走這個多少會有點幫助

2633
01:35:50,000 --> 01:35:52,000
今天的內容大概就到這邊

2634
01:35:52,000 --> 01:35:54,000
謝謝大家

2635
01:35:54,000 --> 01:35:56,000
謝謝大家