whisper-large

1
00:00:00,000 --> 00:00:13,840
那我想開始的話我們會先從幾個簡單的定義

2
00:00:13,840 --> 00:00:18,320
就是這一張的目的主要是希望大家先有個概念

3
00:00:18,320 --> 00:00:20,720
有個印象 有個圖像的印象

4
00:00:20,720 --> 00:00:23,760
那首先的話是Puff RT

5
00:00:23,760 --> 00:00:27,400
就是Puff RT當然它是Samba的其中一個IP的產品

6
00:00:27,400 --> 00:00:33,560
以目前來講的話我們就先把它當作是有一把保管好的key

7
00:00:33,560 --> 00:00:35,400
所以這個key外面有一個框框

8
00:00:35,400 --> 00:00:38,440
那再來的話第二個是叫AES

9
00:00:38,440 --> 00:00:43,480
那AES的話圖像上的話大家可以看到它是由一個藍色的大寫A

10
00:00:43,480 --> 00:00:47,640
然後經過了藍色的箭頭到這個AES的block裡面

11
00:00:47,640 --> 00:00:51,160
然後並且有一把鑰匙從上面加入

12
00:00:51,160 --> 00:00:54,520
然後最後得到的output是大寫的A'

13
00:00:54,520 --> 00:01:00,920
那這個的話我們用這樣的意象想要講的是它是一個加密的過程

14
00:01:00,920 --> 00:01:05,080
就是從原本的型態A然後轉成變成是A'

15
00:01:05,080 --> 00:01:09,560
那同樣的這個AES的這個block也能夠支援的是說

16
00:01:09,560 --> 00:01:12,920
它能夠返回來做 就是把原本的這個A'的block

17
00:01:12,920 --> 00:01:16,440
然後一樣是進到這個AES走綠色的箭頭

18
00:01:16,440 --> 00:01:19,880
那並且也加入了同樣的一把黃色的key

19
00:01:19,880 --> 00:01:24,440
然後它會得到的output是能夠還原回來原本的大寫A

20
00:01:24,440 --> 00:01:27,720
這個就是相當於是算解密的過程

21
00:01:27,720 --> 00:01:31,720
那下一個的話我們這邊列的是ECC

22
00:01:31,720 --> 00:01:34,680
那這邊的話ECC講的是橢圓曲線的密碼學

23
00:01:34,680 --> 00:01:39,000
那簡單的來說的話它這邊比較不一樣的是說

24
00:01:39,000 --> 00:01:40,520
它的key上面是有寫字的

25
00:01:40,520 --> 00:01:42,680
就是它是有一個S跟一個P

26
00:01:42,680 --> 00:01:45,000
我們這邊講叫secret或是public key

27
00:01:45,000 --> 00:01:46,840
就是它是有一個私鑰跟公鑰的

28
00:01:46,840 --> 00:01:50,120
那它這邊在做的事情是說你把一個

29
00:01:50,280 --> 00:01:53,080
其中一把綠色的比方說叫私鑰

30
00:01:53,080 --> 00:01:54,680
這個寫S的這一把

31
00:01:54,680 --> 00:01:57,160
進到這個ECC的block之後

32
00:01:57,160 --> 00:02:01,480
它能夠出來的是一個黃色的public key這個公鑰

33
00:02:01,480 --> 00:02:05,640
那並且這個動作它是無法還原的

34
00:02:05,640 --> 00:02:09,960
就是你從公鑰是沒有辦法還原回私鑰的

35
00:02:09,960 --> 00:02:13,160
所以它的黃色箭頭回來的這個箭頭這邊打了X

36
00:02:13,160 --> 00:02:15,160
這個是還蠻重要的

37
00:02:15,720 --> 00:02:18,040
那所以它基本上可以想成是

38
00:02:18,040 --> 00:02:21,240
由從一把私鑰產生另外一把公鑰的過程

39
00:02:21,240 --> 00:02:24,520
那再來是最下面的這個叫hash

40
00:02:24,520 --> 00:02:27,960
那這個hash相信其實它不只在密碼學裡面會出現

41
00:02:27,960 --> 00:02:29,800
在其他很多資訊科學裡面也會用得到

42
00:02:29,800 --> 00:02:31,960
那這個的話我們給它的意象是說

43
00:02:31,960 --> 00:02:33,880
它是有一個大寫A

44
00:02:33,880 --> 00:02:37,080
然後進到這個像果汁機的這個雜綽函數

45
00:02:37,080 --> 00:02:38,040
就是這個東西

46
00:02:38,040 --> 00:02:41,400
然後它得到的output是一個小寫A

47
00:02:41,400 --> 00:02:43,640
在這邊我們用小寫主要是想要描述說

48
00:02:43,640 --> 00:02:46,440
它是類似一個壓縮成一個摘要的這樣的過程

49
00:02:46,440 --> 00:02:50,440
那同時這個hash這個果汁機

50
00:02:50,440 --> 00:02:51,800
我們都知道打成果汁之後

51
00:02:51,800 --> 00:02:53,240
也是沒有辦法還原回水果的

52
00:02:53,240 --> 00:02:56,920
所以它在這邊是一個單項的一個函數

53
00:02:56,920 --> 00:03:00,440
然後並且無法從output導回input

54
00:03:00,440 --> 00:03:04,440
所以這邊這一些簡單的定義

55
00:03:04,440 --> 00:03:07,480
就是希望大家能夠先有一個印象就好

56
00:03:07,480 --> 00:03:10,920
那接下來的內容也會跟這些

57
00:03:10,920 --> 00:03:14,840
慢慢會知道說這些定義跟接下來的內容

58
00:03:14,840 --> 00:03:15,880
有什麼樣的相關

59
00:03:15,880 --> 00:03:21,320
好 那在這邊的話我們最主要我們談的

60
00:03:21,320 --> 00:03:22,920
今天要談的是密碼學這件事情

61
00:03:22,920 --> 00:03:24,680
那密碼學這件事情的話

62
00:03:24,680 --> 00:03:27,080
簡單的來分類的話

63
00:03:27,080 --> 00:03:29,640
它大概其實是幾種不同的目標

64
00:03:29,640 --> 00:03:33,480
那這邊的話其實總共列了有五個黃色的格子

65
00:03:33,480 --> 00:03:34,600
可是它其實只有四種

66
00:03:34,600 --> 00:03:37,000
那一種一種開始講的話

67
00:03:37,000 --> 00:03:39,080
那第一個我們會看到是左邊A這邊

68
00:03:39,080 --> 00:03:42,040
它有它這邊有叫confidentiality

69
00:03:42,040 --> 00:03:43,080
叫保密性

70
00:03:43,080 --> 00:03:45,640
那並且它這邊是畫了一個圖

71
00:03:45,640 --> 00:03:47,720
是說它有資料存在身上

72
00:03:47,720 --> 00:03:50,920
那當然我們希望資料保密

73
00:03:50,920 --> 00:03:53,720
但是這個保密它其實會分兩種情境

74
00:03:53,720 --> 00:03:56,920
一種是說資料在靜態儲存的時候

75
00:03:56,920 --> 00:03:58,280
我們希望它不會被偷走

76
00:03:58,280 --> 00:04:00,840
希望不會有別人知道這個內容

77
00:04:00,840 --> 00:04:04,040
那另外一種是說在傳輸的過程中

78
00:04:04,040 --> 00:04:06,920
我們希望它也能夠保持隱密

79
00:04:06,920 --> 00:04:11,240
就是不會有我們不想要的接收方去收到

80
00:04:11,240 --> 00:04:15,000
所以它大概是說

81
00:04:15,000 --> 00:04:18,760
如果你今天在傳輸訊息的過程中

82
00:04:18,760 --> 00:04:20,520
你傳的是一個叫做plain text

83
00:04:20,520 --> 00:04:22,040
像明文這樣的形式的話

84
00:04:22,040 --> 00:04:24,360
那很容易當然很容易這個

85
00:04:24,360 --> 00:04:27,480
communication的通道就會被竊聽或被竊取

86
00:04:27,480 --> 00:04:31,240
所以這個是保密性的這件事情

87
00:04:31,240 --> 00:04:32,040
這個目標

88
00:04:32,040 --> 00:04:33,960
那第二個我們看到的是

89
00:04:34,040 --> 00:04:35,880
這邊寫的叫做data integrity

90
00:04:35,880 --> 00:04:37,160
叫做資料完整性

91
00:04:37,160 --> 00:04:38,760
那這個資料完整性的話

92
00:04:38,760 --> 00:04:39,960
簡單的講是說

93
00:04:39,960 --> 00:04:41,640
我要如何確定

94
00:04:41,640 --> 00:04:45,800
我要如何確定我的訊息或是資料沒有被竄改

95
00:04:45,800 --> 00:04:49,080
那沒有被竄改就表示它保持完整原樣

96
00:04:49,080 --> 00:04:50,680
那這個的話

97
00:04:50,680 --> 00:04:53,720
一個很簡單的例子是說

98
00:04:53,720 --> 00:04:57,720
假設我們現在把我們自己電腦裡面的資料

99
00:04:57,720 --> 00:05:00,200
然後去上傳到比方說雲端硬碟

100
00:05:00,200 --> 00:05:01,640
那我們上傳

101
00:05:01,640 --> 00:05:03,400
我們上傳了一段時間之後

102
00:05:03,400 --> 00:05:05,960
過一陣子我們要再把它拿下來

103
00:05:05,960 --> 00:05:08,040
那我們如何能夠知道說

104
00:05:08,040 --> 00:05:09,800
我們拿下來的資料是正確的

105
00:05:09,800 --> 00:05:11,320
沒有被改過的

106
00:05:11,320 --> 00:05:13,160
這個是資料完整性的意思

107
00:05:13,160 --> 00:05:17,080
那它所面臨的威脅就是說有可能

108
00:05:17,080 --> 00:05:19,080
有可能在傳輸的過程中

109
00:05:19,080 --> 00:05:22,360
然後有惡意的這個第三方會去偽造

110
00:05:22,360 --> 00:05:24,920
或者是篡改這樣的訊息

111
00:05:24,920 --> 00:05:27,400
第三個講到這邊是叫做authenticity

112
00:05:27,400 --> 00:05:29,400
叫做認證性

113
00:05:29,400 --> 00:05:33,320
那這個的話比較單純就是說

114
00:05:33,320 --> 00:05:36,680
我們想要知道說這個溝通裡面會有訊息的

115
00:05:36,680 --> 00:05:38,680
傳送方跟接收方

116
00:05:38,680 --> 00:05:40,680
那傳送方要能夠知道

117
00:05:40,680 --> 00:05:42,680
收到訊息的是正確的接收方

118
00:05:42,680 --> 00:05:43,880
那反之亦然

119
00:05:43,880 --> 00:05:47,000
就是說這個認證往往是一個雙向的過程

120
00:05:47,000 --> 00:05:49,960
我傳訊息的人要知道收訊息的人是對的

121
00:05:49,960 --> 00:05:52,760
那收訊息的人也要知道傳訊息的人是對的

122
00:05:52,760 --> 00:05:53,800
這樣

123
00:05:53,800 --> 00:05:57,400
那第四個講的叫做不可否認性

124
00:05:57,400 --> 00:06:00,200
它指向的一種問題是

125
00:06:00,200 --> 00:06:02,440
所謂像抵賴或者是否認

126
00:06:02,440 --> 00:06:04,440
那具體來說的話是說

127
00:06:04,440 --> 00:06:06,440
簡單來說比方說

128
00:06:06,440 --> 00:06:10,440
有可能A跟B說要借錢

129
00:06:10,440 --> 00:06:12,440
那過一陣子

130
00:06:12,440 --> 00:06:15,240
然後A跟B說我沒有說過要跟你借錢

131
00:06:15,240 --> 00:06:17,240
那這種情況下

132
00:06:17,240 --> 00:06:19,240
以借錢這個例子的話

133
00:06:19,240 --> 00:06:21,240
很容易聯想到說

134
00:06:21,240 --> 00:06:23,240
我們要怎麼樣解決這個問題

135
00:06:23,240 --> 00:06:25,240
其實就是要人家去押簽名

136
00:06:25,240 --> 00:06:27,240
那在密碼學裡面也是類似這樣的做法

137
00:06:27,240 --> 00:06:29,240
那就是會用一種叫數位簽章的方式

138
00:06:29,240 --> 00:06:31,240
那基本上就是能夠確保

139
00:06:31,240 --> 00:06:33,240
確保這個來源之外

140
00:06:33,240 --> 00:06:35,240
那也要能夠確保

141
00:06:35,240 --> 00:06:37,240
就是曾經說過什麼或做過什麼

142
00:06:37,240 --> 00:06:39,240
所以其實在這邊不可否認性的話

143
00:06:39,240 --> 00:06:41,240
可以把它想成類似

144
00:06:41,240 --> 00:06:43,240
既符合認證性

145
00:06:43,240 --> 00:06:45,240
那也符合資料完整性

146
00:06:45,240 --> 00:06:47,240
這兩個都必須要具備

147
00:06:47,240 --> 00:06:49,240
所以

148
00:06:49,240 --> 00:06:51,240
簡單的情境來講大概是這樣子

149
00:06:51,240 --> 00:06:53,240
那接下來的話我們會

150
00:06:53,240 --> 00:06:55,240
再從各個裡面去

151
00:06:55,240 --> 00:06:57,240
細節去看說

152
00:06:57,240 --> 00:06:59,240
大概有什麼樣的做法

153
00:07:01,240 --> 00:07:03,240
所以到目前到這邊有任何疑問嗎

154
00:07:03,240 --> 00:07:11,240
那首先我們要

155
00:07:11,240 --> 00:07:13,240
接下來我們就要看的是各個安全目標

156
00:07:13,240 --> 00:07:15,240
那首先我們要看到的是

157
00:07:15,240 --> 00:07:17,240
保密性

158
00:07:17,240 --> 00:07:19,240
那保密性來講剛剛提過說我們不想要讓

159
00:07:19,240 --> 00:07:21,240
訊息不想要讓資料洩漏出去

160
00:07:21,240 --> 00:07:23,240
所以最直覺的做法

161
00:07:23,240 --> 00:07:25,240
最直覺的做法就是我們要去做假名

162
00:07:25,240 --> 00:07:27,240
好那所以以一個簡單的情境來講的話

163
00:07:27,240 --> 00:07:29,240
好那所以以一個簡單的情境來講的話

164
00:07:29,240 --> 00:07:31,240
好那所以以一個簡單的情境來講的話

165
00:07:31,240 --> 00:07:33,240
好那所以以一個簡單的情境來講的話

166
00:07:33,240 --> 00:07:35,240
那這個溝通往往是

167
00:07:35,240 --> 00:07:37,240
A傳送訊息經過一個通訊網路到B這邊

168
00:07:37,240 --> 00:07:39,240
那

169
00:07:39,240 --> 00:07:41,240
這個我們

170
00:07:41,240 --> 00:07:43,240
我們首先要介紹的是對稱式的加密

171
00:07:43,240 --> 00:07:45,240
對稱式的加密跟我們在

172
00:07:45,240 --> 00:07:47,240
一開始提過的定義裡面

173
00:07:47,240 --> 00:07:49,240
他跟那個AS的block還蠻像

174
00:07:49,240 --> 00:07:51,240
就是說

175
00:07:51,240 --> 00:07:53,240
他的重點是他是用同一把key來做加密

176
00:07:53,240 --> 00:07:55,240
同一把key所以叫對稱

177
00:07:55,240 --> 00:07:57,240
那這邊簡單的看一下他的流程

178
00:07:57,240 --> 00:07:59,240
他的流程大概會是說

179
00:07:59,240 --> 00:08:01,240
A把本來要傳的

180
00:08:01,240 --> 00:08:03,240
我們叫明文的這個plain text

181
00:08:03,240 --> 00:08:05,240
然後經過一個鑰匙

182
00:08:05,240 --> 00:08:07,240
然後加密變成這個有帶有鎖跟問號的方塊

183
00:08:07,240 --> 00:08:09,240
我們叫他密文

184
00:08:09,240 --> 00:08:11,240
那這個密文會傳過來到

185
00:08:11,240 --> 00:08:13,240
就經過通訊網路

186
00:08:13,240 --> 00:08:15,240
然後傳到B手上

187
00:08:15,240 --> 00:08:17,240
那B呢因為他擁有

188
00:08:17,240 --> 00:08:19,240
他擁有這把同樣的黃色鑰匙

189
00:08:19,240 --> 00:08:21,240
所以他可以

190
00:08:21,240 --> 00:08:23,240
把他還原回原本的這個明文

191
00:08:23,240 --> 00:08:25,240
那至於

192
00:08:25,240 --> 00:08:27,240
惡意的第三方X他手上沒有這把鑰匙的時候

193
00:08:27,240 --> 00:08:29,240
他就

194
00:08:29,240 --> 00:08:31,240
他就沒有辦法去解開這個密文

195
00:08:31,240 --> 00:08:33,240
他的基本的概念是這樣

196
00:08:33,240 --> 00:08:35,240
所以光從

197
00:08:35,240 --> 00:08:37,240
剛剛的敘述應該已經可以知道說

198
00:08:37,240 --> 00:08:39,240
這整件事情的這個安全性

199
00:08:39,240 --> 00:08:41,240
最主要是

200
00:08:41,240 --> 00:08:43,240
建立在說你只要

201
00:08:43,240 --> 00:08:45,240
沒有這把黃色的鑰匙你就沒有辦法

202
00:08:45,240 --> 00:08:47,240
解讀這個訊息

203
00:08:47,240 --> 00:08:49,240
他的安全性是建立在這個機制上面

204
00:08:49,240 --> 00:08:51,240
那

205
00:08:51,240 --> 00:08:53,240
對稱式的這種加密的方法

206
00:08:53,240 --> 00:08:55,240
他一般來講有幾項特性

207
00:08:55,240 --> 00:08:57,240
講得比較模糊一點的話就是

208
00:08:57,240 --> 00:08:59,240
他算他速度很快

209
00:08:59,240 --> 00:09:01,240
然後安全性也很高

210
00:09:01,240 --> 00:09:03,240
那但是他有一個致命的缺陷

211
00:09:03,240 --> 00:09:05,240
是他需要

212
00:09:05,240 --> 00:09:07,240
這個金鑰傳遞

213
00:09:07,240 --> 00:09:09,240
那金鑰傳遞的問題我們稍後會再提

214
00:09:09,240 --> 00:09:13,240
那這邊

215
00:09:13,240 --> 00:09:15,240
這邊我們用一個

216
00:09:15,240 --> 00:09:17,240
就是很簡單的例子來看

217
00:09:17,240 --> 00:09:19,240
對稱式加密這件事情

218
00:09:19,240 --> 00:09:21,240
首先我們看到左邊

219
00:09:21,240 --> 00:09:23,240
在做加密的時候

220
00:09:23,240 --> 00:09:25,240
我們有訊息鑰匙跟密文

221
00:09:25,240 --> 00:09:27,240
那這邊我們把它都用四個bit

222
00:09:27,240 --> 00:09:29,240
然後用exclusive for

223
00:09:29,240 --> 00:09:31,240
那exclusive for來講我們在這邊就是我們加密的函數

224
00:09:31,240 --> 00:09:33,240
那我想這大家應該滿熟悉的

225
00:09:33,240 --> 00:09:35,240
就是說這邊有他的真值表

226
00:09:35,240 --> 00:09:37,240
然後跟我們要怎麼樣用

227
00:09:37,240 --> 00:09:39,240
這個exclusive for來做加密跟解密

228
00:09:39,240 --> 00:09:41,240
那他的原理

229
00:09:41,240 --> 00:09:43,240
主要是說

230
00:09:43,240 --> 00:09:45,240
我今天就他有交換率

231
00:09:45,240 --> 00:09:47,240
跟結合率的關係

232
00:09:47,240 --> 00:09:49,240
所以我今天把一個明文

233
00:09:49,240 --> 00:09:51,240
然後加密過這一把

234
00:09:51,240 --> 00:09:53,240
經過這一把鑰匙然後去做

235
00:09:53,240 --> 00:09:55,240
operate之後得到了這個密文1001

236
00:09:55,240 --> 00:09:57,240
那在解密的時候

237
00:09:57,240 --> 00:09:59,240
我一樣我把這個1001

238
00:09:59,240 --> 00:10:01,240
再次對這個金鑰

239
00:10:01,240 --> 00:10:03,240
做exclusive for的運算之後

240
00:10:03,240 --> 00:10:05,240
得回來的會是原本的明文

241
00:10:05,240 --> 00:10:07,240
他是一個簡單的概念

242
00:10:07,240 --> 00:10:09,240
所以在這裡面的重點是說

243
00:10:09,240 --> 00:10:11,240
第一個他用的這個加密的方法是exclusive for

244
00:10:11,240 --> 00:10:13,240
那

245
00:10:13,240 --> 00:10:15,240
另外就是他是依靠這個

246
00:10:15,240 --> 00:10:17,240
同一把金鑰所以你沒有這把金鑰

247
00:10:17,240 --> 00:10:19,240
你是沒有辦法解回訊息的

248
00:10:19,240 --> 00:10:21,240
這是一個簡單的

249
00:10:21,240 --> 00:10:23,240
簡單的範例就是對稱式演算法

250
00:10:23,240 --> 00:10:25,240
大概是這麼樣做

251
00:10:25,240 --> 00:10:31,240
好那

252
00:10:31,240 --> 00:10:33,240
再來會補充一點就是

253
00:10:33,240 --> 00:10:35,240
對稱式演算法對稱式加密

254
00:10:35,240 --> 00:10:37,240
他的一些性質

255
00:10:37,240 --> 00:10:39,240
像剛剛我們看到的exclusive for

256
00:10:39,240 --> 00:10:41,240
來講的話他其實

257
00:10:41,240 --> 00:10:43,240
他應該可以想像他的安全強度

258
00:10:43,240 --> 00:10:45,240
相對算是蠻低的

259
00:10:45,240 --> 00:10:47,240
因為還蠻容易破解的

260
00:10:47,240 --> 00:10:49,240
那他之所以容易破解的其中一個主要的理由

261
00:10:49,240 --> 00:10:51,240
是在於說他的運算來講

262
00:10:51,240 --> 00:10:53,240
是比較是線性的

263
00:10:53,240 --> 00:10:55,240
那所以一般而言

264
00:10:55,240 --> 00:10:57,240
這種現在常用

265
00:10:57,240 --> 00:10:59,240
就是合規定

266
00:10:59,240 --> 00:11:01,240
夠安全的這種對稱式演算法

267
00:11:01,240 --> 00:11:03,240
來講他通常會帶有幾種運算

268
00:11:03,240 --> 00:11:05,240
像

269
00:11:05,240 --> 00:11:07,240
他會帶的是這種

270
00:11:07,240 --> 00:11:09,240
置換substitution

271
00:11:09,240 --> 00:11:11,240
然後跟排列的這種運算

272
00:11:11,240 --> 00:11:13,240
那排列

273
00:11:13,240 --> 00:11:15,240
置換我想應該蠻容易理解

274
00:11:15,240 --> 00:11:17,240
他其實完全就是一個非線性的

275
00:11:17,240 --> 00:11:19,240
那排列的話不管你是怎麼樣排

276
00:11:19,240 --> 00:11:21,240
你是重新排列

277
00:11:21,240 --> 00:11:23,240
或是你是transpose

278
00:11:23,240 --> 00:11:25,240
或是做怎麼樣的這種transposition

279
00:11:25,240 --> 00:11:27,240
或是去做mapping來講

280
00:11:27,240 --> 00:11:29,240
他其實某種程度上

281
00:11:29,240 --> 00:11:31,240
只要是屬於排列的這種的行為

282
00:11:31,240 --> 00:11:33,240
他都算是線性的

283
00:11:33,240 --> 00:11:35,240
那線性的以運算來講

284
00:11:35,240 --> 00:11:37,240
就等於說容易推倒

285
00:11:37,240 --> 00:11:39,240
所以現在的

286
00:11:39,240 --> 00:11:41,240
普遍會在使用的

287
00:11:41,240 --> 00:11:43,240
對稱式加密的演算法

288
00:11:43,240 --> 00:11:45,240
來講他的演算法的結構

289
00:11:45,240 --> 00:11:47,240
通常都一定會帶有

290
00:11:47,240 --> 00:11:49,240
至少一個非線性的運算

291
00:11:49,240 --> 00:11:51,240
比方說以現在來講

292
00:11:51,240 --> 00:11:53,240
最常用的是這個下面列的

293
00:11:53,240 --> 00:11:55,240
這個AES

294
00:11:55,240 --> 00:11:57,240
那AES的話熟的可能會知道說

295
00:11:57,240 --> 00:11:59,240
他大概大致上算是有

296
00:11:59,240 --> 00:12:01,240
四個transformation在做

297
00:12:01,240 --> 00:12:03,240
那其中只有一個

298
00:12:03,240 --> 00:12:05,240
是其中只有一個叫sub-by的

299
00:12:05,240 --> 00:12:07,240
這個步驟是在做substitution

300
00:12:07,240 --> 00:12:09,240
他是用類似查表

301
00:12:09,240 --> 00:12:11,240
的方式然後去把值換掉

302
00:12:11,240 --> 00:12:13,240
那其餘的都算是

303
00:12:13,240 --> 00:12:15,240
線性的運算都是

304
00:12:15,240 --> 00:12:17,240
shift或是去做矩陣的

305
00:12:17,240 --> 00:12:19,240
乘法這種類似是

306
00:12:19,240 --> 00:12:21,240
比較是線性的運算

307
00:12:21,240 --> 00:12:23,240
而且一般來講為了

308
00:12:23,240 --> 00:12:25,240
就是也同樣要符合效率

309
00:12:25,240 --> 00:12:27,240
所以其實只要有

310
00:12:27,240 --> 00:12:29,240
一個非線性的運算他就算是

311
00:12:29,240 --> 00:12:31,240
足夠安全那也因為

312
00:12:31,240 --> 00:12:33,240
非線性的運算他需要的資源

313
00:12:33,240 --> 00:12:35,240
的關係所以其實通常

314
00:12:35,240 --> 00:12:37,240
通常在這個對稱式的

315
00:12:37,240 --> 00:12:39,240
加密演算法裡面非對稱式的

316
00:12:39,240 --> 00:12:41,240
運算也就只有

317
00:12:41,240 --> 00:12:43,240
那麼一個其他都會是線性的排列

318
00:12:43,240 --> 00:12:45,240
這樣

319
00:12:45,240 --> 00:12:47,240
那下面這張表的話是列出說

320
00:12:47,240 --> 00:12:49,240
目前最主要有在使用的

321
00:12:49,240 --> 00:12:51,240
哪一些那你這邊可以看到的話

322
00:12:51,240 --> 00:12:53,240
以前的

323
00:12:53,240 --> 00:12:55,240
大概在1997

324
00:12:55,240 --> 00:12:57,240
年以前在用的都是一種

325
00:12:57,240 --> 00:12:59,240
叫做DES

326
00:12:59,240 --> 00:13:01,240
叫做Data Encryption Standard的一種

327
00:13:01,240 --> 00:13:03,240
舊型的加密演算法

328
00:13:03,240 --> 00:13:05,240
那到

329
00:13:05,240 --> 00:13:07,240
接近1997年的時候因為他的

330
00:13:07,240 --> 00:13:09,240
安全性已經開始下降所以那個時候

331
00:13:09,240 --> 00:13:11,240
有去做比方說

332
00:13:11,240 --> 00:13:13,240
把它變成

333
00:13:13,240 --> 00:13:15,240
triple dash就是說把它疊三次

334
00:13:15,240 --> 00:13:17,240
然後可能中間用兩把不同的key

335
00:13:17,240 --> 00:13:19,240
或是用三把不同的key這樣

336
00:13:19,240 --> 00:13:21,240
那這些來講到現在都已經

337
00:13:21,240 --> 00:13:23,240
非常勉強了

338
00:13:23,240 --> 00:13:25,240
所以才會有開始從1997年

339
00:13:25,240 --> 00:13:27,240
開始有現在的叫做AES

340
00:13:27,240 --> 00:13:29,240
那DES叫做Data

341
00:13:29,240 --> 00:13:31,240
Encryption Standard那AES的那個A

342
00:13:31,240 --> 00:13:33,240
叫Advanced就是進階加密標準

343
00:13:33,240 --> 00:13:35,240
如果去查那個AES的話通常會

344
00:13:35,240 --> 00:13:37,240
查到這樣的翻譯

345
00:13:37,240 --> 00:13:39,240
那所以這邊列的主要的

346
00:13:39,240 --> 00:13:41,240
主要的另外一個可以補充的是說

347
00:13:41,240 --> 00:13:43,240
這邊可以看到是在

348
00:13:43,240 --> 00:13:45,240
two key的triple dash的

349
00:13:45,240 --> 00:13:47,240
使用情境裡面他已經不被

350
00:13:47,240 --> 00:13:49,240
允許做加密但是

351
00:13:49,240 --> 00:13:51,240
可以在legacy user

352
00:13:51,240 --> 00:13:53,240
場合下去做解密

353
00:13:53,240 --> 00:13:55,240
那這個就跟我們一般很常會

354
00:13:55,240 --> 00:13:57,240
遇到的狀況一樣就是說你

355
00:13:57,240 --> 00:13:59,240
可能以前出的產品已經

356
00:13:59,240 --> 00:14:01,240
deploy到fuel裡面

357
00:14:01,240 --> 00:14:03,240
那你後面再出的時候他必須

358
00:14:03,240 --> 00:14:05,240
至少要能夠解讀

359
00:14:05,240 --> 00:14:07,240
當初前一代產品用

360
00:14:07,240 --> 00:14:09,240
two key triple dash所加密的訊息

361
00:14:09,240 --> 00:14:11,240
他至少要能夠解讀

362
00:14:11,240 --> 00:14:13,240
但是因為安全性的問題他已經

363
00:14:13,240 --> 00:14:15,240
不再容許用同樣舊的

364
00:14:15,240 --> 00:14:17,240
方法去做加密

365
00:14:17,240 --> 00:14:19,240
這個大概的概念

366
00:14:19,240 --> 00:14:21,240
大概的概念是這樣

367
00:14:21,240 --> 00:14:23,240
那所以現在來講

368
00:14:23,240 --> 00:14:25,240
最流行然後最常被使用的

369
00:14:25,240 --> 00:14:27,240
是這邊列的

370
00:14:27,240 --> 00:14:29,240
最下面這一列

371
00:14:29,240 --> 00:14:31,240
AES的128或是192或是256

372
00:14:31,240 --> 00:14:33,240
那這個數字的話

373
00:14:33,240 --> 00:14:35,240
可能大家大概有個

374
00:14:35,240 --> 00:14:37,240
印象就好就是說

375
00:14:37,240 --> 00:14:39,240
他是以一個區塊一個區塊來做加密

376
00:14:39,240 --> 00:14:41,240
所以你不管你的輸入多長

377
00:14:41,240 --> 00:14:43,240
他都是照這樣的數字去切分他

378
00:14:43,240 --> 00:14:45,240
一個block一個block來做加密

379
00:14:45,240 --> 00:14:49,240
那到這邊

380
00:14:49,240 --> 00:14:51,240
有任何問題嗎

381
00:14:53,240 --> 00:14:55,240
好

382
00:14:55,240 --> 00:14:57,240
好

383
00:14:57,240 --> 00:14:59,240
那

384
00:14:59,240 --> 00:15:01,240
再來繼續講到的是

385
00:15:01,240 --> 00:15:03,240
在我們

386
00:15:03,240 --> 00:15:05,240
講到加密的時候他是有另外一種

387
00:15:05,240 --> 00:15:07,240
做法叫做有對稱就有

388
00:15:07,240 --> 00:15:09,240
非對稱那這邊講的是非對稱式的

389
00:15:09,240 --> 00:15:11,240
加密的做法

390
00:15:11,240 --> 00:15:13,240
那他的流程

391
00:15:13,240 --> 00:15:15,240
大概跟我們前面有看過

392
00:15:15,240 --> 00:15:17,240
有兩種不同的鑰匙的情境

393
00:15:17,240 --> 00:15:19,240
有私鑰跟公鑰的情境

394
00:15:19,240 --> 00:15:21,240
那我們先

395
00:15:21,240 --> 00:15:23,240
簡單的提一下他的流程

396
00:15:23,240 --> 00:15:25,240
他的流程大概會是這樣

397
00:15:25,240 --> 00:15:27,240
今天A要傳送訊息給B的時候

398
00:15:27,240 --> 00:15:29,240
那特別要注意

399
00:15:29,240 --> 00:15:31,240
有這兩把鑰匙

400
00:15:31,240 --> 00:15:33,240
這邊列的P跟S

401
00:15:33,240 --> 00:15:35,240
一樣是一把是私鑰

402
00:15:35,240 --> 00:15:37,240
一把是公鑰

403
00:15:37,240 --> 00:15:39,240
這兩把鑰匙都是訊息

404
00:15:39,240 --> 00:15:41,240
接收方B的

405
00:15:41,240 --> 00:15:43,240
這個很重要

406
00:15:43,240 --> 00:15:45,240
那所以

407
00:15:45,240 --> 00:15:47,240
有了這兩把鑰匙

408
00:15:47,240 --> 00:15:49,240
然後怎麼做加密的溝通

409
00:15:49,240 --> 00:15:51,240
那訊息傳送方

410
00:15:51,240 --> 00:15:53,240
A他會把

411
00:15:53,240 --> 00:15:55,240
這個plain text

412
00:15:55,240 --> 00:15:57,240
他會把他要傳送的訊息明文

413
00:15:57,240 --> 00:15:59,240
然後用訊息接收方

414
00:15:59,240 --> 00:16:01,240
B這個人的公鑰

415
00:16:01,240 --> 00:16:03,240
做加密

416
00:16:03,240 --> 00:16:05,240
然後傳送這個

417
00:16:05,240 --> 00:16:07,240
密文過來

418
00:16:07,240 --> 00:16:09,240
收到這個訊息收到這個密文的

419
00:16:09,240 --> 00:16:11,240
接收方B他會去用他自己

420
00:16:11,240 --> 00:16:13,240
同樣是B這個人的

421
00:16:13,240 --> 00:16:15,240
私鑰去做解密

422
00:16:15,240 --> 00:16:17,240
來還原回這個原本的訊息

423
00:16:17,240 --> 00:16:21,240
所以這個滿重要

424
00:16:21,240 --> 00:16:23,240
就是說在這樣的情境裡面

425
00:16:23,240 --> 00:16:25,240
在這樣溝通的情境裡面

426
00:16:25,240 --> 00:16:27,240
這兩把key都是屬於

427
00:16:27,240 --> 00:16:29,240
都是屬於訊息接收方B的

428
00:16:29,240 --> 00:16:31,240
那

429
00:16:31,240 --> 00:16:33,240
為什麼A有這把key可以用

430
00:16:33,240 --> 00:16:35,240
因為顧名思義

431
00:16:35,240 --> 00:16:37,240
他叫公鑰我們是希望他是能夠公開的

432
00:16:37,240 --> 00:16:39,240
那但是

433
00:16:39,240 --> 00:16:41,240
反過來講的話這把私鑰

434
00:16:41,240 --> 00:16:43,240
是絕對不會出去是只有B才有的

435
00:16:43,240 --> 00:16:45,240
非對稱式的

436
00:16:45,240 --> 00:16:47,240
這個或是說公開

437
00:16:47,240 --> 00:16:49,240
公開金鑰密碼學的這兩是一樣東西

438
00:16:49,240 --> 00:16:51,240
公開金鑰密碼學的基礎

439
00:16:51,240 --> 00:16:53,240
是建立在此公鑰可以

440
00:16:53,240 --> 00:16:55,240
四散在外可是私鑰絕對

441
00:16:55,240 --> 00:16:57,240
只有自己有

442
00:16:57,240 --> 00:16:59,240
那

443
00:16:59,240 --> 00:17:01,240
所以可以看到的是因為

444
00:17:01,240 --> 00:17:03,240
公鑰可以四散在外所以

445
00:17:03,240 --> 00:17:05,240
這樣的這樣的做法來講

446
00:17:05,240 --> 00:17:07,240
的話他的特性是說

447
00:17:07,240 --> 00:17:09,240
他不需要他不需要有

448
00:17:09,240 --> 00:17:11,240
他不需要有一把事先就有一把

449
00:17:11,240 --> 00:17:13,240
註冊好的兩個人都一樣的對稱

450
00:17:13,240 --> 00:17:15,240
的金鑰

451
00:17:15,240 --> 00:17:17,240
你只要需要溝通的時候然後

452
00:17:17,240 --> 00:17:19,240
比方說我要傳訊息給給別人

453
00:17:19,240 --> 00:17:21,240
的時候我只要能夠

454
00:17:21,240 --> 00:17:23,240
隨意的取得他的公鑰

455
00:17:23,240 --> 00:17:25,240
這個是合法的那我就能傳送訊息

456
00:17:25,240 --> 00:17:27,240
給人家但是只有

457
00:17:27,240 --> 00:17:29,240
他因為他擁有他自己的私鑰

458
00:17:29,240 --> 00:17:31,240
所以他可以用他自己的私鑰

459
00:17:31,240 --> 00:17:33,240
去解讀我傳給他的

460
00:17:33,240 --> 00:17:35,240
這個加密過的訊息

461
00:17:35,240 --> 00:17:37,240
那所以他的特性是說

462
00:17:37,240 --> 00:17:39,240
他不需要有一把事先註冊好的

463
00:17:39,240 --> 00:17:41,240
鑰匙

464
00:17:41,240 --> 00:17:43,240
安全性也相對高

465
00:17:43,240 --> 00:17:45,240
但是他

466
00:17:45,240 --> 00:17:47,240
因為他用到的數學比較難

467
00:17:47,240 --> 00:17:49,240
所以一般來講耗費的資源會比較多

468
00:17:49,240 --> 00:17:51,240
運算速度會比較慢

469
00:17:51,240 --> 00:17:55,240
那這邊的話就在

470
00:17:55,240 --> 00:17:57,240
比較具體的補充

471
00:17:57,240 --> 00:17:59,240
剛剛講到的例子

472
00:17:59,240 --> 00:18:01,240
所以在

473
00:18:01,240 --> 00:18:03,240
開始做這個溝通之前

474
00:18:03,240 --> 00:18:05,240
會像我們前面的定義的

475
00:18:05,240 --> 00:18:07,240
那一頁裡面有提到會先經過

476
00:18:07,240 --> 00:18:09,240
由私鑰去產生公鑰的過程

477
00:18:09,240 --> 00:18:11,240
那並且

478
00:18:11,240 --> 00:18:13,240
這個私鑰一旦產生了

479
00:18:13,240 --> 00:18:15,240
公鑰之後他們兩個就是成對的

480
00:18:15,240 --> 00:18:17,240
就是每個人會有

481
00:18:17,240 --> 00:18:19,240
每個人會有一對自己的私鑰

482
00:18:19,240 --> 00:18:21,240
跟公鑰

483
00:18:21,240 --> 00:18:23,240
所以一樣這個圖畫

484
00:18:23,240 --> 00:18:25,240
是說不同的人要傳訊息

485
00:18:25,240 --> 00:18:27,240
給同一個接收方

486
00:18:27,240 --> 00:18:29,240
他們所用來加密訊息的這一把

487
00:18:29,240 --> 00:18:31,240
這一把key通通都是同一把

488
00:18:31,240 --> 00:18:33,240
因為他們用的是訊息

489
00:18:33,240 --> 00:18:35,240
接收方的公鑰

490
00:18:35,240 --> 00:18:37,240
那所以每個人要傳訊息

491
00:18:37,240 --> 00:18:39,240
給這個接收方的時候他們都用訊息接收方的

492
00:18:39,240 --> 00:18:41,240
這個公鑰來做加密

493
00:18:41,240 --> 00:18:43,240
但是只有

494
00:18:43,240 --> 00:18:45,240
只有接收方他自己擁有這個

495
00:18:45,240 --> 00:18:47,240
secret key的時候才可以去做解密

496
00:18:47,240 --> 00:18:49,240
這個是他的

497
00:18:49,240 --> 00:18:51,240
運作是這樣子運作

498
00:18:51,240 --> 00:18:53,240
那比較好理解的

499
00:18:53,240 --> 00:18:55,240
一種方式是可以把

500
00:18:55,240 --> 00:18:57,240
可以把這個公鑰

501
00:18:57,240 --> 00:18:59,240
這個事情想成是地址

502
00:18:59,240 --> 00:19:01,240
或是信箱或是可能會在

503
00:19:01,240 --> 00:19:03,240
家裡前面那種那個

504
00:19:03,240 --> 00:19:05,240
信的那種郵箱

505
00:19:05,240 --> 00:19:07,240
任何人都可以

506
00:19:07,240 --> 00:19:09,240
知道要怎麼樣傳訊息

507
00:19:09,240 --> 00:19:11,240
給這個郵箱的主人

508
00:19:11,240 --> 00:19:13,240
但是郵箱你投進去

509
00:19:13,240 --> 00:19:15,240
但是你打不開除非你有鑰匙

510
00:19:15,240 --> 00:19:17,240
只有這個郵箱的主人

511
00:19:17,240 --> 00:19:19,240
他有辦法打開這個郵箱

512
00:19:19,240 --> 00:19:21,240
去看裡面的信

513
00:19:21,240 --> 00:19:23,240
看裡面的訊息

514
00:19:23,240 --> 00:19:25,240
私鑰跟公鑰的概念大概就是

515
00:19:25,240 --> 00:19:27,240
公鑰就像是一個

516
00:19:27,240 --> 00:19:29,240
像是一個地址或是一個

517
00:19:29,240 --> 00:19:31,240
郵箱這樣子

518
00:19:31,240 --> 00:19:33,240
更具體來說的話

519
00:19:33,240 --> 00:19:35,240
現在常常在用的像是比特幣這種東西

520
00:19:35,240 --> 00:19:37,240
比特幣他的帳號

521
00:19:37,240 --> 00:19:39,240
他其實就是公鑰

522
00:19:39,240 --> 00:19:41,240
所以

523
00:19:41,240 --> 00:19:43,240
也蠻符合就是剛所謂公鑰

524
00:19:43,240 --> 00:19:45,240
就像是地址任何人都可以傳過去

525
00:19:45,240 --> 00:19:47,240
但是以比特幣來講

526
00:19:47,240 --> 00:19:49,240
任何人都可以傳錢到你的地址

527
00:19:49,240 --> 00:19:51,240
可是你要動裡面的錢

528
00:19:51,240 --> 00:19:53,240
只有你有自己的那把鑰匙才能去動

529
00:19:53,240 --> 00:19:55,240
他的概念大概是這樣

530
00:19:55,240 --> 00:19:59,240
好那

531
00:19:59,240 --> 00:20:01,240
再來是談這個

532
00:20:01,240 --> 00:20:03,240
非對稱式的加密

533
00:20:03,240 --> 00:20:05,240
非對稱式密碼學

534
00:20:05,240 --> 00:20:07,240
的一些性質

535
00:20:07,240 --> 00:20:09,240
首先要再釐清的是說

536
00:20:09,240 --> 00:20:11,240
非對稱式的這種

537
00:20:11,240 --> 00:20:13,240
就是有私鑰也有公鑰的

538
00:20:13,240 --> 00:20:15,240
這種數學來講

539
00:20:15,240 --> 00:20:17,240
他能夠做到的事情其實非常多種

540
00:20:17,240 --> 00:20:19,240
絕對不只有

541
00:20:19,240 --> 00:20:21,240
做加密這件事情

542
00:20:21,240 --> 00:20:23,240
所以這邊大概列了

543
00:20:23,240 --> 00:20:25,240
就是說他能夠去做什麼

544
00:20:25,240 --> 00:20:27,240
他能夠去做加密解密

545
00:20:27,240 --> 00:20:29,240
他能夠去做數位簽章

546
00:20:29,240 --> 00:20:31,240
他也能夠去做金鑰交換

547
00:20:31,240 --> 00:20:33,240
下面兩個後面會提

548
00:20:33,240 --> 00:20:35,240
那這邊來講的話主要是

549
00:20:35,240 --> 00:20:37,240
要先跟大家補充說

550
00:20:37,240 --> 00:20:39,240
這種非對稱式的

551
00:20:39,240 --> 00:20:41,240
數學他都是用一種叫做

552
00:20:41,240 --> 00:20:43,240
他都是用

553
00:20:43,240 --> 00:20:45,240
一種叫做Trapdoor One-Way Function

554
00:20:45,240 --> 00:20:47,240
這個算是陷阱門

555
00:20:47,240 --> 00:20:49,240
的這種函數

556
00:20:49,240 --> 00:20:51,240
陷阱門什麼意思就是說

557
00:20:51,240 --> 00:20:53,240
我們今天要做陷阱的時候我們會希望人家

558
00:20:53,240 --> 00:20:55,240
容易掉入這個陷阱但是一

559
00:20:55,240 --> 00:20:57,240
掉進去之後是沒有辦法反著出來的

560
00:20:57,240 --> 00:20:59,240
這樣的概念

561
00:20:59,240 --> 00:21:01,240
精神希望大家可以理解

562
00:21:01,240 --> 00:21:03,240
那他的

563
00:21:03,240 --> 00:21:05,240
具體來說就是說

564
00:21:05,240 --> 00:21:07,240
今天我們有

565
00:21:07,240 --> 00:21:09,240
這個要用非對稱式的這個

566
00:21:09,240 --> 00:21:11,240
密碼學的時候我們都會有

567
00:21:11,240 --> 00:21:13,240
先從私鑰去產生公鑰

568
00:21:13,240 --> 00:21:15,240
那

569
00:21:15,240 --> 00:21:17,240
同時我們剛剛也講過

570
00:21:17,240 --> 00:21:19,240
公鑰是可以釋散在外的

571
00:21:19,240 --> 00:21:21,240
為什麼他可以釋散在外

572
00:21:21,240 --> 00:21:23,240
是因為我們有信心

573
00:21:23,240 --> 00:21:25,240
依照他數學的原理

574
00:21:25,240 --> 00:21:27,240
你今天有公鑰是沒有辦法

575
00:21:27,240 --> 00:21:29,240
退回去私鑰

576
00:21:29,240 --> 00:21:31,240
他的安全性完全就建立在這個基礎

577
00:21:31,240 --> 00:21:33,240
之上

578
00:21:33,240 --> 00:21:35,240
那

579
00:21:35,240 --> 00:21:37,240
所以這邊介紹的是

580
00:21:37,240 --> 00:21:39,240
他幾種不同功能的用法

581
00:21:39,240 --> 00:21:41,240
以加解密而言的話

582
00:21:41,240 --> 00:21:43,240
我們剛剛提過了我們會用公鑰去做

583
00:21:43,240 --> 00:21:45,240
加密然後收訊息

584
00:21:45,240 --> 00:21:47,240
的人用私鑰去做解密

585
00:21:47,240 --> 00:21:49,240
這方向會不太一樣

586
00:21:49,240 --> 00:21:51,240
那如果是以數位

587
00:21:51,240 --> 00:21:53,240
簽章來講的話

588
00:21:53,240 --> 00:21:55,240
那他會用私鑰去簽

589
00:21:55,240 --> 00:21:57,240
然後大家可以用公鑰

590
00:21:57,240 --> 00:21:59,240
去確認這個簽章

591
00:21:59,240 --> 00:22:01,240
那另外

592
00:22:01,240 --> 00:22:03,240
還有金鑰交換的這種功能

593
00:22:03,240 --> 00:22:05,240
我們透過交換

594
00:22:05,240 --> 00:22:07,240
我們透過交換這個公鑰

595
00:22:07,240 --> 00:22:09,240
然後去想辦法

596
00:22:09,240 --> 00:22:11,240
產生了一個一樣的一把

597
00:22:11,240 --> 00:22:13,240
對稱的這個金鑰

598
00:22:13,240 --> 00:22:15,240
所以這邊還沒有要

599
00:22:15,240 --> 00:22:17,240
不希望這邊先搞亂大家

600
00:22:17,240 --> 00:22:19,240
但是主要的重點是在於說

601
00:22:19,240 --> 00:22:21,240
非對稱式的密碼學

602
00:22:21,240 --> 00:22:23,240
密碼系統他是有非常非常多的用途

603
00:22:23,240 --> 00:22:25,240
那我們剛剛提的

604
00:22:25,240 --> 00:22:27,240
是先提的加解密的這一種

605
00:22:27,240 --> 00:22:29,240
那後續我們會提到

606
00:22:29,240 --> 00:22:31,240
其他的功能也很多都會跟

607
00:22:31,240 --> 00:22:33,240
非對稱式的密碼學有關

608
00:22:33,240 --> 00:22:35,240
那

609
00:22:35,240 --> 00:22:37,240
一樣這邊有一張表整理現在會在用的東西

610
00:22:37,240 --> 00:22:39,240
那整個非對稱式

611
00:22:39,240 --> 00:22:41,240
密碼學的數學的原理

612
00:22:41,240 --> 00:22:43,240
都是從這個Diffie-Hellman

613
00:22:43,240 --> 00:22:45,240
這個演算法來的這是兩個姓氏

614
00:22:45,240 --> 00:22:47,240
那他最剛開始

615
00:22:47,240 --> 00:22:49,240
最剛開始被發明這是1975年的事情

616
00:22:49,240 --> 00:22:51,240
那純粹

617
00:22:51,240 --> 00:22:53,240
目的就是去做金鑰交換

618
00:22:53,240 --> 00:22:55,240
金鑰交換是一切這個

619
00:22:55,240 --> 00:22:57,240
非對稱式密碼學的基礎

620
00:22:57,240 --> 00:22:59,240
所以大部分我們看到的

621
00:22:59,240 --> 00:23:01,240
只要是非對稱式的演算法

622
00:23:01,240 --> 00:23:03,240
只要是非對稱式演算法

623
00:23:03,240 --> 00:23:05,240
通常都一定能夠做金鑰交換的功能

624
00:23:05,240 --> 00:23:07,240
那我們現在

625
00:23:07,240 --> 00:23:09,240
比較常在用的

626
00:23:09,240 --> 00:23:11,240
像是這邊列的這個橢圓曲線

627
00:23:11,240 --> 00:23:13,240
就跟我們前面定義裡面看到的

628
00:23:13,240 --> 00:23:15,240
跟另外一種叫做

629
00:23:15,240 --> 00:23:17,240
RSA

630
00:23:17,240 --> 00:23:19,240
RSA來講它是比較

631
00:23:19,240 --> 00:23:21,240
古老但比較龐大一點的東西

632
00:23:21,240 --> 00:23:23,240
現在還會用但比較少

633
00:23:23,240 --> 00:23:25,240
因為最主要是因為它的金鑰的長度

634
00:23:25,240 --> 00:23:27,240
非常的長比較厚重

635
00:23:27,240 --> 00:23:29,240
像這種東西可能會在哪裡

636
00:23:29,240 --> 00:23:31,240
看到會在比方說

637
00:23:31,240 --> 00:23:33,240
信用卡裡面的那一顆IC

638
00:23:33,240 --> 00:23:35,240
它裡面就會有用

639
00:23:35,240 --> 00:23:37,240
RSA去做不管是做簽章

640
00:23:37,240 --> 00:23:39,240
通常是做簽章的這種做法

641
00:23:39,240 --> 00:23:41,240
是現在還有在用的

642
00:23:43,240 --> 00:23:45,240
那所以剛剛也有提到過

643
00:23:45,240 --> 00:23:47,240
我們提過比較模糊說

644
00:23:47,240 --> 00:23:49,240
對稱式的加密算是安全

645
00:23:49,240 --> 00:23:51,240
那非對稱式的加密也算安全

646
00:23:51,240 --> 00:23:53,240
那具體來講有多安全的話

647
00:23:53,240 --> 00:23:55,240
那這邊就有一張

648
00:23:55,240 --> 00:23:57,240
對照表可以給大家參考

649
00:23:57,240 --> 00:23:59,240
這個對照表是純粹是用

650
00:23:59,240 --> 00:24:01,240
金鑰的長度

651
00:24:01,240 --> 00:24:03,240
然後去

652
00:24:03,240 --> 00:24:05,240
equivalent to 它的

653
00:24:05,240 --> 00:24:07,240
破解的難度

654
00:24:07,240 --> 00:24:09,240
所以怎麼看就是說

655
00:24:09,240 --> 00:24:11,240
比方說以我們前面講說

656
00:24:11,240 --> 00:24:13,240
對稱式的演算法

657
00:24:13,240 --> 00:24:15,240
比方說AES,然後我們可能在

658
00:24:15,240 --> 00:24:17,240
128bit的時候

659
00:24:17,240 --> 00:24:19,240
它的key長度128bit的時候

660
00:24:19,240 --> 00:24:21,240
它相當於RSA的

661
00:24:21,240 --> 00:24:23,240
3kbit的key長度

662
00:24:23,240 --> 00:24:25,240
然後也相當於

663
00:24:25,240 --> 00:24:27,240
這個橢圓曲線密碼學

664
00:24:27,240 --> 00:24:29,240
差不多key長度為

665
00:24:29,240 --> 00:24:31,240
256bit左右的強度

666
00:24:31,240 --> 00:24:33,240
那

667
00:24:33,240 --> 00:24:35,240
所以這樣大家

668
00:24:35,240 --> 00:24:37,240
可以比較有概念說

669
00:24:37,240 --> 00:24:39,240
為什麼RSA現在已經慢慢的在退流行

670
00:24:39,240 --> 00:24:41,240
主要是因為它要能夠達到

671
00:24:41,240 --> 00:24:43,240
同樣的強度,它所需要的

672
00:24:43,240 --> 00:24:45,240
金鑰的長度很長

673
00:24:45,240 --> 00:24:47,240
那很常是會卡在storage的問題

674
00:24:47,240 --> 00:24:49,240
就是你反而

675
00:24:49,240 --> 00:24:51,240
你裝置或是你晶片裡面

676
00:24:51,240 --> 00:24:53,240
沒有那麼多的空間可以用來儲存

677
00:24:53,240 --> 00:24:55,240
這個用途比較

678
00:24:55,240 --> 00:24:57,240
單薄的這種演算法

679
00:24:57,240 --> 00:24:59,240
的參數

680
00:24:59,240 --> 00:25:01,240
那這中間的話

681
00:25:01,240 --> 00:25:03,240
是

682
00:25:03,240 --> 00:25:05,240
原始的這個Diffie-Hellman

683
00:25:05,240 --> 00:25:07,240
跟由這個NIST

684
00:25:07,240 --> 00:25:09,240
我們叫國家技術標準局

685
00:25:09,240 --> 00:25:11,240
他們所發佈的一種比較基礎的

686
00:25:11,240 --> 00:25:13,240
數位千張的算法

687
00:25:13,240 --> 00:25:15,240
那這個當然是因為比較早期的東西

688
00:25:15,240 --> 00:25:17,240
所以它所需要的這個份量又更大

689
00:25:17,240 --> 00:25:19,240
所以

690
00:25:19,240 --> 00:25:21,240
所以再回過頭來說

691
00:25:21,240 --> 00:25:23,240
就是說雖然我們說

692
00:25:23,240 --> 00:25:25,240
雖然你看,在這邊可以看到

693
00:25:25,240 --> 00:25:27,240
對稱式的演算法

694
00:25:27,240 --> 00:25:29,240
它好像是數字最小的

695
00:25:29,240 --> 00:25:31,240
是,沒有錯,但是重點還是在於說

696
00:25:31,240 --> 00:25:33,240
它有先天的缺陷

697
00:25:33,240 --> 00:25:35,240
它會有金鑰傳遞的問題

698
00:25:37,240 --> 00:25:39,240
接下來我們就要看

699
00:25:39,240 --> 00:25:41,240
到底什麼樣叫金鑰傳遞的問題

700
00:25:41,240 --> 00:25:43,240
我們都知道說

701
00:25:43,240 --> 00:25:45,240
你要用對稱式的加密演算法的時候

702
00:25:45,240 --> 00:25:47,240
你這個訊息的

703
00:25:47,240 --> 00:25:49,240
傳送方跟接收方

704
00:25:49,240 --> 00:25:51,240
兩邊必須要

705
00:25:51,240 --> 00:25:53,240
持有同樣的一把鑰匙

706
00:25:53,240 --> 00:25:55,240
那其中一方用這一把

707
00:25:55,240 --> 00:25:57,240
鑰匙做加密

708
00:25:57,240 --> 00:25:59,240
另外一方有同樣的鑰匙

709
00:25:59,240 --> 00:26:01,240
他就可以用這一把鑰匙做解密

710
00:26:01,240 --> 00:26:03,240
所以我們要initiate一個對話

711
00:26:03,240 --> 00:26:05,240
它大概會發生什麼事

712
00:26:05,240 --> 00:26:07,240
我們首先要做加密通訊

713
00:26:07,240 --> 00:26:09,240
我們當然就要能夠去加密

714
00:26:09,240 --> 00:26:11,240
這個訊息或是資料

715
00:26:11,240 --> 00:26:13,240
為了要加密這個資料

716
00:26:13,240 --> 00:26:15,240
我們會需要一把key

717
00:26:15,240 --> 00:26:17,240
那為了要

718
00:26:17,240 --> 00:26:19,240
但是我們要

719
00:26:19,240 --> 00:26:21,240
如何由一方產生

720
00:26:21,240 --> 00:26:23,240
這一把key之後,傳送到另外一方

721
00:26:23,240 --> 00:26:25,240
最直覺的方法就是

722
00:26:25,240 --> 00:26:27,240
把這一把key去做加密

723
00:26:27,240 --> 00:26:29,240
要把這一把key做加密的時候

724
00:26:29,240 --> 00:26:31,240
我們會需要另外一把key

725
00:26:31,240 --> 00:26:33,240
所以從這邊開始

726
00:26:33,240 --> 00:26:35,240
下面就是不斷地在循環

727
00:26:35,240 --> 00:26:37,240
所以金鑰傳遞的問題的意思

728
00:26:37,240 --> 00:26:39,240
是在這裡

729
00:26:39,240 --> 00:26:41,240
除非你很確定

730
00:26:41,240 --> 00:26:43,240
一開始就已經有兩把

731
00:26:43,240 --> 00:26:45,240
中好的key在裡面

732
00:26:45,240 --> 00:26:47,240
同樣的一把key

733
00:26:47,240 --> 00:26:49,240
在訊息的傳送跟接收方

734
00:26:49,240 --> 00:26:51,240
中好的裡面的話

735
00:26:51,240 --> 00:26:53,240
不然在一開始沒有

736
00:26:53,240 --> 00:26:55,240
共同的這一把金鑰的狀況下

737
00:26:55,240 --> 00:26:57,240
一定會遇到這樣的問題

738
00:26:57,240 --> 00:26:59,240
到底怎麼樣能夠安全地傳遞金鑰

739
00:26:59,240 --> 00:27:01,240
以密碼學而言的話

740
00:27:01,240 --> 00:27:03,240
解決這個問題

741
00:27:03,240 --> 00:27:05,240
是有幾種方法

742
00:27:05,240 --> 00:27:07,240
首先我們看的是第一種

743
00:27:07,240 --> 00:27:09,240
第一種當然是

744
00:27:09,240 --> 00:27:11,240
像我們剛剛講的

745
00:27:11,240 --> 00:27:13,240
如果你在加密的時候

746
00:27:13,240 --> 00:27:15,240
使用非對稱式的密碼學

747
00:27:15,240 --> 00:27:17,240
也就是說我們剛剛提過那種

748
00:27:17,240 --> 00:27:19,240
用訊息接收方的A要傳訊息給B

749
00:27:19,240 --> 00:27:21,240
那A把訊息用

750
00:27:21,240 --> 00:27:23,240
B的公鑰做加密

751
00:27:23,240 --> 00:27:25,240
並且讓B

752
00:27:25,240 --> 00:27:27,240
用他自己的私鑰做解密

753
00:27:27,240 --> 00:27:29,240
這個是絕對可以行得通

754
00:27:29,240 --> 00:27:31,240
但是比較沒有效率

755
00:27:31,240 --> 00:27:33,240
為什麼

756
00:27:33,240 --> 00:27:35,240
因為最主要的問題是

757
00:27:35,240 --> 00:27:37,240
前面有提過他數學比較難

758
00:27:37,240 --> 00:27:39,240
運算比較慢

759
00:27:39,240 --> 00:27:41,240
所以我們會盡可能的希望

760
00:27:41,240 --> 00:27:43,240
能夠減少

761
00:27:43,240 --> 00:27:45,240
這個非對稱式

762
00:27:45,240 --> 00:27:47,240
加密的使用

763
00:27:47,240 --> 00:27:49,240
就加密而言

764
00:27:49,240 --> 00:27:51,240
我們絕對是希望能夠使用

765
00:27:51,240 --> 00:27:53,240
對稱式加密又快又安全

766
00:27:53,240 --> 00:27:55,240
是最好的

767
00:27:55,240 --> 00:27:57,240
然後能夠解決那個傳遞金鑰的難題

768
00:27:57,240 --> 00:27:59,240
之後

769
00:27:59,240 --> 00:28:01,240
接下來我們在做

770
00:28:01,240 --> 00:28:03,240
加密溝通的時候

771
00:28:03,240 --> 00:28:05,240
都希望能夠用對稱式的

772
00:28:05,240 --> 00:28:07,240
算法來做

773
00:28:07,240 --> 00:28:09,240
所以

774
00:28:09,240 --> 00:28:11,240
第一種解決方案

775
00:28:11,240 --> 00:28:13,240
顯然是不太理想

776
00:28:13,240 --> 00:28:15,240
就是說他要用到

777
00:28:15,240 --> 00:28:17,240
比較耗費資源的

778
00:28:17,240 --> 00:28:19,240
非對稱式的加密的做法

779
00:28:19,240 --> 00:28:21,240
所以不推薦

780
00:28:21,240 --> 00:28:23,240
再來還有第二種跟第三種

781
00:28:23,240 --> 00:28:25,240
那

782
00:28:25,240 --> 00:28:33,240
接下來的話

783
00:28:33,240 --> 00:28:35,240
接下來的話

784
00:28:35,240 --> 00:28:37,240
我們希望能夠把大家分成四組

785
00:28:37,240 --> 00:28:39,240
然後讓大家去討論

786
00:28:39,240 --> 00:28:41,240
然後推導看看

787
00:28:41,240 --> 00:28:43,240
第二種解法 當然我會給一定程度的提示

788
00:28:43,240 --> 00:28:45,240
那

789
00:28:45,240 --> 00:28:47,240
主要是有奉命

790
00:28:47,240 --> 00:28:49,240
要做exercise

791
00:28:49,240 --> 00:28:51,240
所以大家多包涵

792
00:28:51,240 --> 00:28:53,240
所以

793
00:28:53,240 --> 00:28:55,240
分四組的話

794
00:28:55,240 --> 00:28:57,240
白色椅子前後

795
00:28:57,240 --> 00:28:59,240
是兩邊

796
00:28:59,240 --> 00:29:01,240
所以現在如果大家都已經知道

797
00:29:01,240 --> 00:29:03,240
自己屬於哪一組的話

798
00:29:03,240 --> 00:29:05,240
那我這邊再把問題描述清楚一點

799
00:29:05,240 --> 00:29:07,240
為了要

800
00:29:07,240 --> 00:29:09,240
解決金鑰傳遞的問題

801
00:29:09,240 --> 00:29:11,240
那我們剛剛提過

802
00:29:11,240 --> 00:29:13,240
可能可以用現在上面所列的

803
00:29:13,240 --> 00:29:15,240
現在上面所列的

804
00:29:15,240 --> 00:29:17,240
你單純的用非對稱式的加密來做

805
00:29:17,240 --> 00:29:19,240
但是不推薦

806
00:29:19,240 --> 00:29:21,240
因為它比較厚重

807
00:29:21,240 --> 00:29:23,240
那有沒有其他種方法

808
00:29:23,240 --> 00:29:25,240
可以混合

809
00:29:25,240 --> 00:29:27,240
非對稱式跟對稱式的使用

810
00:29:27,240 --> 00:29:29,240
可以達到我們的目的

811
00:29:29,240 --> 00:29:31,240
好

812
00:29:31,240 --> 00:29:33,240
我再試著把題目說明清楚一點

813
00:29:33,240 --> 00:29:35,240
就是說

814
00:29:35,240 --> 00:29:37,240
為了要解決金鑰傳遞的問題

815
00:29:37,240 --> 00:29:39,240
我們的目標

816
00:29:39,240 --> 00:29:41,240
是希望溝通

817
00:29:41,240 --> 00:29:43,240
能夠使用對稱式的密碼學演算法

818
00:29:43,240 --> 00:29:45,240
來做溝通

819
00:29:45,240 --> 00:29:47,240
可是那一把key要怎麼辦

820
00:29:47,240 --> 00:29:49,240
因為一開始沒有

821
00:29:49,240 --> 00:29:51,240
兩邊都有同樣的這一把key

822
00:29:51,240 --> 00:29:57,240
希望大家可以稍微看看

823
00:29:57,240 --> 00:29:59,240
中間的那一行

824
00:29:59,240 --> 00:30:01,240
灰色的那個字

825
00:30:01,240 --> 00:30:03,240
有哪一組還需要時間討論嗎

826
00:30:03,240 --> 00:30:07,240
沒有

827
00:30:07,240 --> 00:30:13,240
那有哪一組有人要自願嗎

828
00:30:15,240 --> 00:30:17,240
點喔

829
00:30:17,240 --> 00:30:23,240
那我們這一組的朋友

830
00:30:23,240 --> 00:30:25,240
可以派一個代表回答嗎

831
00:30:25,240 --> 00:30:33,240
用那個

832
00:30:33,240 --> 00:30:35,240
非對稱式加密去加密你要傳輸的那把鑰匙

833
00:30:35,240 --> 00:30:37,240
對

834
00:30:37,240 --> 00:30:39,240
這樣至少

835
00:30:39,240 --> 00:30:41,240
因為鑰匙的長度基本上遠小於

836
00:30:41,240 --> 00:30:43,240
傳輸的長度

837
00:30:43,240 --> 00:30:45,240
所以這樣的做法應該會有效的節省

838
00:30:45,240 --> 00:30:47,240
你的運算資源

839
00:30:47,240 --> 00:30:49,240
然後本身資料的部分還是用

840
00:30:49,240 --> 00:30:51,240
對稱式加密加密就好

841
00:30:51,240 --> 00:30:59,240
非常非常的

842
00:30:59,240 --> 00:31:01,240
正確且詳細

843
00:31:01,240 --> 00:31:07,240
本來應該要點第二組的可是被講完

844
00:31:09,240 --> 00:31:11,240
蛤

845
00:31:11,240 --> 00:31:17,240
得到了

846
00:31:17,240 --> 00:31:19,240
大家的尊重

847
00:31:19,240 --> 00:31:25,240
好

848
00:31:25,240 --> 00:31:27,240
確實就是剛剛提的情境裡面

849
00:31:27,240 --> 00:31:29,240
重點是在於說

850
00:31:29,240 --> 00:31:31,240
最後在做加密

851
00:31:31,240 --> 00:31:33,240
傳輸主要的溝通的

852
00:31:33,240 --> 00:31:35,240
要加密訊息的時候

853
00:31:35,240 --> 00:31:37,240
絕對是希望使用對稱式的演算法

854
00:31:37,240 --> 00:31:39,240
是比較有效率的

855
00:31:39,240 --> 00:31:41,240
但是我們為了要解決前面的這個

856
00:31:41,240 --> 00:31:43,240
禁藥傳遞的問題

857
00:31:43,240 --> 00:31:45,240
我們可以容許我們稍微的使用

858
00:31:45,240 --> 00:31:47,240
非對稱式的

859
00:31:47,240 --> 00:31:49,240
加密的方法來去加密

860
00:31:49,240 --> 00:31:51,240
那一把禁藥

861
00:31:51,240 --> 00:31:53,240
因為禁藥的長度絕對會是

862
00:31:53,240 --> 00:31:55,240
比這個訊息還要短上很多

863
00:31:55,240 --> 00:31:57,240
那所以這邊有列幾個圖示

864
00:31:57,240 --> 00:31:59,240
就是說

865
00:31:59,240 --> 00:32:01,240
首先我們希望

866
00:32:01,240 --> 00:32:03,240
最後能夠使用這一把

867
00:32:03,240 --> 00:32:05,240
這一把紅色的這個key

868
00:32:05,240 --> 00:32:07,240
來當作對稱式的禁藥來做加密

869
00:32:07,240 --> 00:32:09,240
所以一開始我們會要怎麼樣做

870
00:32:09,240 --> 00:32:11,240
我們會把

871
00:32:11,240 --> 00:32:13,240
沒錯就像剛剛這位同仁講

872
00:32:13,240 --> 00:32:15,240
就是我們會把這個鑰匙當作是

873
00:32:15,240 --> 00:32:17,240
當作是訊息

874
00:32:17,240 --> 00:32:19,240
然後A

875
00:32:19,240 --> 00:32:21,240
由這個用這個

876
00:32:21,240 --> 00:32:23,240
接收方B的公藥做加密之後

877
00:32:23,240 --> 00:32:25,240
然後傳送

878
00:32:25,240 --> 00:32:27,240
B用他的這個私藥去做解密

879
00:32:27,240 --> 00:32:29,240
然後得到這一把紅色的鑰匙

880
00:32:29,240 --> 00:32:31,240
接下來的溝通的話

881
00:32:31,240 --> 00:32:33,240
就會是

882
00:32:33,240 --> 00:32:35,240
A B雙方是用這一把已經傳過來

883
00:32:35,240 --> 00:32:37,240
並且解回去的這一把紅色的鑰匙

884
00:32:37,240 --> 00:32:39,240
來做訊息的加密

885
00:32:39,240 --> 00:32:41,240
所以這是

886
00:32:41,240 --> 00:32:43,240
簡化的圖示

887
00:32:43,240 --> 00:32:45,240
那所以

888
00:32:45,240 --> 00:32:47,240
對幾個重點就是說

889
00:32:47,240 --> 00:32:49,240
非對稱式的加密不是不能用

890
00:32:49,240 --> 00:32:51,240
而是要小心使用

891
00:32:51,240 --> 00:32:53,240
因為我們不希望大量的用它

892
00:32:53,240 --> 00:32:55,240
然後它會運算的時間比較久

893
00:32:55,240 --> 00:32:57,240
或是耗比較多資源

894
00:32:59,240 --> 00:33:01,240
好那接下來的話

895
00:33:01,240 --> 00:33:03,240
我們下一個要提的是資料完整性

896
00:33:03,240 --> 00:33:05,240
然後資料完整性的話

897
00:33:05,240 --> 00:33:07,240
像我們前面定義裡面有看到

898
00:33:07,240 --> 00:33:09,240
一個果汁機

899
00:33:09,240 --> 00:33:11,240
我們通常會使用雜湊函數

900
00:33:11,240 --> 00:33:13,240
來做這個資料完整性

901
00:33:13,240 --> 00:33:15,240
那首先雜湊函數的話

902
00:33:15,240 --> 00:33:17,240
大家可能也熟悉

903
00:33:17,240 --> 00:33:19,240
那它的重點跟我們剛剛提過一樣

904
00:33:19,240 --> 00:33:21,240
是說它是有

905
00:33:21,240 --> 00:33:23,240
它會有任意長度的

906
00:33:23,240 --> 00:33:25,240
輸入

907
00:33:25,240 --> 00:33:27,240
把它進到這個hash function之後

908
00:33:27,240 --> 00:33:29,240
它會轉成固定長度的輸出

909
00:33:29,240 --> 00:33:33,240
任意長度的輸入

910
00:33:33,240 --> 00:33:35,240
進果汁機之後出來

911
00:33:35,240 --> 00:33:37,240
變成固定長度的輸出

912
00:33:37,240 --> 00:33:39,240
所以我們一般習慣叫這個

913
00:33:39,240 --> 00:33:41,240
它出來的這個output叫做digest

914
00:33:41,240 --> 00:33:43,240
就是像摘要一樣

915
00:33:43,240 --> 00:33:45,240
就是訊息摘要

916
00:33:45,240 --> 00:33:47,240
但這個摘要並不包含它任何字面的

917
00:33:47,240 --> 00:33:49,240
就是並不包含這個訊息任何字面的意思

918
00:33:49,240 --> 00:33:51,240
而是就是一串

919
00:33:51,240 --> 00:33:53,240
一串hash value

920
00:33:53,240 --> 00:33:55,240
通常都是hash

921
00:33:55,240 --> 00:33:57,240
那這樣的

922
00:33:57,240 --> 00:33:59,240
這個雜湊函數

923
00:33:59,240 --> 00:34:01,240
它就有幾個性質

924
00:34:01,240 --> 00:34:03,240
那我們一個一個看

925
00:34:03,240 --> 00:34:05,240
那首先來講

926
00:34:05,240 --> 00:34:07,240
就是剛剛這個很重要的任意長度的這件事情

927
00:34:07,240 --> 00:34:09,240
那依據

928
00:34:09,240 --> 00:34:11,240
你所使用的雜湊函數的不同

929
00:34:11,240 --> 00:34:13,240
那它的輸出的長度也會不同

930
00:34:13,240 --> 00:34:15,240
可能

931
00:34:15,240 --> 00:34:17,240
短的可能128

932
00:34:17,240 --> 00:34:19,240
或64

933
00:34:19,240 --> 00:34:21,240
或是到一般比較常使用的256

934
00:34:21,240 --> 00:34:23,240
或是更長的512這種

935
00:34:23,240 --> 00:34:25,240
那但是不管怎麼樣

936
00:34:25,240 --> 00:34:27,240
它都一定要能夠吃任意

937
00:34:27,240 --> 00:34:29,240
任意長度的輸入

938
00:34:29,240 --> 00:34:31,240
注意是任意而且沒有上限

939
00:34:31,240 --> 00:34:33,240
那

940
00:34:33,240 --> 00:34:35,240
所以這邊的圖示

941
00:34:35,240 --> 00:34:37,240
大概就是這樣

942
00:34:37,240 --> 00:34:39,240
你不管輸入的是很長的

943
00:34:39,240 --> 00:34:41,240
或是很短的只有一個字母

944
00:34:41,240 --> 00:34:43,240
甚至是空集合

945
00:34:43,240 --> 00:34:45,240
甚至是你的input是空的

946
00:34:45,240 --> 00:34:47,240
它都有辦法吐東西給你

947
00:34:47,240 --> 00:34:49,240
它都有辦法吐出

948
00:34:49,240 --> 00:34:51,240
固定長度的摘要給你

949
00:34:51,240 --> 00:34:53,240
那這是比較極端的例子

950
00:34:53,240 --> 00:34:55,240
但是它必須要能夠做到這件事情

951
00:34:55,240 --> 00:34:57,240
這是第一個性質

952
00:34:57,240 --> 00:34:59,240
就是它任意長度

953
00:34:59,240 --> 00:35:01,240
那第二個性質這邊講的是說

954
00:35:01,240 --> 00:35:03,240
只要

955
00:35:03,240 --> 00:35:05,240
你的這個

956
00:35:05,240 --> 00:35:07,240
只要你的輸入是一樣的

957
00:35:07,240 --> 00:35:09,240
那

958
00:35:09,240 --> 00:35:11,240
你的輸出就會要一模一樣

959
00:35:11,240 --> 00:35:13,240
任意長度

960
00:35:13,240 --> 00:35:15,240
所以搭配前面這個你會得到說

961
00:35:15,240 --> 00:35:17,240
任意長度的輸入只要一樣

962
00:35:17,240 --> 00:35:19,240
你都可以得到短短的輸出

963
00:35:19,240 --> 00:35:21,240
而且這個短短的輸出也一模一樣

964
00:35:21,240 --> 00:35:23,240
那大家可以再回想一下

965
00:35:23,240 --> 00:35:25,240
前面我在解釋資料完整性的時候

966
00:35:25,240 --> 00:35:27,240
舉的例子

967
00:35:27,240 --> 00:35:29,240
就是說假設我們上傳了

968
00:35:29,240 --> 00:35:31,240
我們之前存的資料

969
00:35:31,240 --> 00:35:33,240
到雲端硬碟裡面

970
00:35:33,240 --> 00:35:35,240
就假設我寫了一本書

971
00:35:35,240 --> 00:35:37,240
非常非常非常多字

972
00:35:37,240 --> 00:35:39,240
那到這個雲端連結裡面

973
00:35:39,240 --> 00:35:41,240
雲端的硬碟裡面

974
00:35:41,240 --> 00:35:43,240
過一陣子我再把它download回來

975
00:35:43,240 --> 00:35:45,240
那但是我怎麼知道

976
00:35:45,240 --> 00:35:47,240
我怎麼知道有沒有人動過它

977
00:35:47,240 --> 00:35:49,240
我不可能逐字的去比對

978
00:35:49,240 --> 00:35:51,240
所以套用到這兩個性質

979
00:35:51,240 --> 00:35:53,240
我們可以做到什麼事情

980
00:35:53,240 --> 00:35:55,240
我們可以在上傳的時候

981
00:35:55,240 --> 00:35:57,240
先把這樣子的一個資料

982
00:35:57,240 --> 00:35:59,240
過這個hash得到一個摘要

983
00:35:59,240 --> 00:36:01,240
到時候過了一段時間

984
00:36:01,240 --> 00:36:03,240
我們再要把它download回來的時候

985
00:36:03,240 --> 00:36:05,240
我們同樣的把我們下載

986
00:36:05,240 --> 00:36:07,240
我們下載的這個file

987
00:36:07,240 --> 00:36:09,240
也一樣過這個hash function

988
00:36:09,240 --> 00:36:11,240
得到一個短短的摘要

989
00:36:11,240 --> 00:36:13,240
這個時候就會發現

990
00:36:13,240 --> 00:36:15,240
我們只要比摘要就好

991
00:36:15,240 --> 00:36:17,240
我們就能夠得到訊息的內容

992
00:36:17,240 --> 00:36:19,240
那再來是第三個性質

993
00:36:19,240 --> 00:36:21,240
這個也跟剛剛提到的一樣

994
00:36:21,240 --> 00:36:23,240
就是說只要

995
00:36:23,240 --> 00:36:25,240
只要你有任何一點變化

996
00:36:25,240 --> 00:36:27,240
這邊的例子是說

997
00:36:27,240 --> 00:36:29,240
從abc改成abd

998
00:36:29,240 --> 00:36:31,240
那你經過hash

999
00:36:31,240 --> 00:36:33,240
所出來的這個output

1000
00:36:33,240 --> 00:36:35,240
會劇烈的變化

1001
00:36:35,240 --> 00:36:37,240
會大大的不相同

1002
00:36:37,240 --> 00:36:39,240
那到這邊來講

1003
00:36:39,240 --> 00:36:41,240
就有一個問題

1004
00:36:41,240 --> 00:36:43,240
就是說它的重點是在說

1005
00:36:43,240 --> 00:36:45,240
你就算是只改一個bit

1006
00:36:45,240 --> 00:36:47,240
那你出來的結果也要很不一樣

1007
00:36:47,240 --> 00:36:49,240
所以

1008
00:36:49,240 --> 00:36:51,240
下一個問題來了

1009
00:36:51,240 --> 00:36:53,240
就是說到底應該要多不一樣

1010
00:36:53,240 --> 00:36:55,240
那這一題的話

1011
00:36:55,240 --> 00:36:57,240
我們用

1012
00:36:57,240 --> 00:36:59,240
我們用投票好了

1013
00:36:59,240 --> 00:37:01,240
那有幾個選項

1014
00:37:01,240 --> 00:37:03,240
假設

1015
00:37:03,240 --> 00:37:05,240
我們就看

1016
00:37:05,240 --> 00:37:07,240
現在的情境是在問說

1017
00:37:07,240 --> 00:37:09,240
我們把上面的input改了一個bit

1018
00:37:09,240 --> 00:37:11,240
下面的這兩個output

1019
00:37:11,240 --> 00:37:13,240
有多不一樣

1020
00:37:13,240 --> 00:37:15,240
那當然我們指的是

1021
00:37:15,240 --> 00:37:17,240
in general的情況

1022
00:37:17,240 --> 00:37:19,240
不是要你去數說這兩個到底有多少格不一樣

1023
00:37:19,240 --> 00:37:21,240
那我們就用

1024
00:37:21,240 --> 00:37:23,240
這個兩個output

1025
00:37:23,240 --> 00:37:25,240
它有比方說完全不一樣

1026
00:37:25,240 --> 00:37:27,240
我們就是100%不一樣

1027
00:37:27,240 --> 00:37:29,240
或完全一樣

1028
00:37:29,240 --> 00:37:31,240
就是0%不一樣

1029
00:37:31,240 --> 00:37:33,240
我們就用這個%數來做判斷好了

1030
00:37:33,240 --> 00:37:35,240
那我們就開放

1031
00:37:35,240 --> 00:37:37,240
30 50 70的選項

1032
00:37:37,240 --> 00:37:39,240
那大家認為

1033
00:37:39,240 --> 00:37:41,240
就是怎麼樣才是符合它這樣的特性呢

1034
00:37:41,240 --> 00:37:43,240
是說

1035
00:37:43,240 --> 00:37:45,240
覺得會有30%不一樣的舉手

1036
00:37:45,240 --> 00:37:47,240
就是說

1037
00:37:47,240 --> 00:37:49,240
改動

1038
00:37:49,240 --> 00:37:51,240
平均而言

1039
00:37:51,240 --> 00:37:53,240
我的input改動一個bit

1040
00:37:53,240 --> 00:37:55,240
那出來的output這兩種

1041
00:37:55,240 --> 00:37:57,240
會有30%的位元數不一樣

1042
00:37:57,240 --> 00:37:59,240
好沒有人

1043
00:37:59,240 --> 00:38:01,240
那50%的

1044
00:38:01,240 --> 00:38:03,240
快

1045
00:38:03,240 --> 00:38:05,240
快

1046
00:38:05,240 --> 00:38:11,240
好那

1047
00:38:11,240 --> 00:38:13,240
70%的

1048
00:38:13,240 --> 00:38:23,240
好

1049
00:38:23,240 --> 00:38:25,240
這邊容我解釋

1050
00:38:25,240 --> 00:38:27,240
實際上正確的答案應該是50%

1051
00:38:27,240 --> 00:38:29,240
我們期待

1052
00:38:29,240 --> 00:38:31,240
平均而言

1053
00:38:31,240 --> 00:38:33,240
你改動了一個bit

1054
00:38:33,240 --> 00:38:35,240
它的output會有50%不一樣

1055
00:38:35,240 --> 00:38:37,240
為什麼是50%

1056
00:38:37,240 --> 00:38:39,240
這樣講好

1057
00:38:39,240 --> 00:38:41,240
就是說

1058
00:38:41,240 --> 00:38:43,240
今天

1059
00:38:43,240 --> 00:38:45,240
假設我們就玩拆數字的遊戲

1060
00:38:45,240 --> 00:38:47,240
然後我說我有10個數字要拆

1061
00:38:47,240 --> 00:38:49,240
那我從

1062
00:38:49,240 --> 00:38:51,240
一組10個數字

1063
00:38:51,240 --> 00:38:53,240
我要拆下一組10個數字

1064
00:38:53,240 --> 00:38:57,240
我希望

1065
00:38:57,240 --> 00:38:59,240
他怎麼樣設計

1066
00:38:59,240 --> 00:39:01,240
難度才最高

1067
00:39:01,240 --> 00:39:03,240
其實他在問的是這件事情

1068
00:39:03,240 --> 00:39:05,240
我們希望他安全

1069
00:39:05,240 --> 00:39:07,240
所以這邊來講其實

1070
00:39:07,240 --> 00:39:09,240
我們要講的意思是說

1071
00:39:09,240 --> 00:39:11,240
他有50%不一樣的時候是最安全

1072
00:39:11,240 --> 00:39:15,240
70%不一樣的時候

1073
00:39:15,240 --> 00:39:17,240
剛剛的題目

1074
00:39:17,240 --> 00:39:19,240
剛剛我們拆10個的題目

1075
00:39:19,240 --> 00:39:21,240
我們再把它簡化

1076
00:39:21,240 --> 00:39:23,240
我們是講說10個binary bit

1077
00:39:23,240 --> 00:39:25,240
講到binary bit

1078
00:39:25,240 --> 00:39:27,240
我想大家可能比較容易可以理解

1079
00:39:27,240 --> 00:39:29,240
假設10個bit只有1跟0

1080
00:39:29,240 --> 00:39:31,240
那我從這1跟0

1081
00:39:31,240 --> 00:39:33,240
去拆下一組1跟0

1082
00:39:33,240 --> 00:39:35,240
的時候並且

1083
00:39:35,240 --> 00:39:37,240
如果他大部分都不一樣

1084
00:39:37,240 --> 00:39:39,240
那我就知道我要反著拆

1085
00:39:39,240 --> 00:39:41,240
如果他大部分都一樣

1086
00:39:41,240 --> 00:39:43,240
我就知道我不用什麼改

1087
00:39:43,240 --> 00:39:45,240
拆的會比較接近

1088
00:39:45,240 --> 00:39:47,240
但是只有在他一半一半不一樣的時候

1089
00:39:47,240 --> 00:39:49,240
是最難拆的

1090
00:39:49,240 --> 00:39:51,240
大家可以理解嗎

1091
00:39:51,240 --> 00:39:53,240
這個就是

1092
00:39:53,240 --> 00:39:55,240
這個其實跟我們講的

1093
00:39:55,240 --> 00:39:57,240
Path他有很好的

1094
00:39:57,240 --> 00:39:59,240
叫Uniqueness是一樣的事情

1095
00:39:59,240 --> 00:40:01,240
這個我們常常會用的

1096
00:40:01,240 --> 00:40:05,240
是叫做inter-hamming distance

1097
00:40:05,240 --> 00:40:08,240
就是說你今天一組128bit的Path

1098
00:40:08,240 --> 00:40:10,240
跟另外一組128bit的Path

1099
00:40:10,240 --> 00:40:12,240
他裡面的這個值

1100
00:40:12,240 --> 00:40:14,240
大概會有多少不一樣

1101
00:40:14,240 --> 00:40:16,240
其實他的大概你bit by bit去比的話

1102
00:40:16,240 --> 00:40:18,240
大概會是50%

1103
00:40:18,240 --> 00:40:20,240
這個是NeoPath的特性

1104
00:40:20,240 --> 00:40:23,240
但是這個在密碼學裡面

1105
00:40:23,240 --> 00:40:26,240
是非常常見也非常重要的一個性質

1106
00:40:26,240 --> 00:40:28,240
就是所謂這個改一個bit

1107
00:40:28,240 --> 00:40:30,240
就有50%不一樣的

1108
00:40:30,240 --> 00:40:32,240
這個是一個理想的密碼學上會用到的性質

1109
00:40:32,240 --> 00:40:34,240
然後這在密碼學裡面叫做雪崩效應

1110
00:40:34,240 --> 00:40:36,240
就是說你只要動了一點

1111
00:40:36,240 --> 00:40:37,240
牽一髮動全身

1112
00:40:37,240 --> 00:40:39,240
你的輸入有一點變化的時候

1113
00:40:39,240 --> 00:40:41,240
你的輸出會劇烈的改變

1114
00:40:41,240 --> 00:40:43,240
但是也不希望太劇烈

1115
00:40:43,240 --> 00:40:44,240
劇烈到完全變反

1116
00:40:44,240 --> 00:40:45,240
也就好拆

1117
00:40:45,240 --> 00:40:47,240
所以他其實變不一樣

1118
00:40:47,240 --> 00:40:49,240
是差不多50%不一樣

1119
00:40:49,240 --> 00:40:51,240
所以前面我們剛剛看到的各種

1120
00:40:51,240 --> 00:40:53,240
不管是ECC不管是RSA

1121
00:40:53,240 --> 00:40:54,240
不管是AES

1122
00:40:54,240 --> 00:40:56,240
也都會具備有這種的性質

1123
00:40:56,240 --> 00:40:58,240
因為這樣才會難破解

1124
00:40:58,240 --> 00:41:02,240
所以這邊是針對這樣的特性在做補充

1125
00:41:02,240 --> 00:41:05,240
就是說同樣的一個好的雜湊函數

1126
00:41:05,240 --> 00:41:07,240
他也勢必也會帶有這樣的

1127
00:41:07,240 --> 00:41:09,240
雪崩效應的這個性質

1128
00:41:09,240 --> 00:41:14,240
好那再來是第四個特性

1129
00:41:14,240 --> 00:41:16,240
第四個特性我們是講叫做

1130
00:41:16,240 --> 00:41:18,240
即便問題來了

1131
00:41:18,240 --> 00:41:21,240
即便你的這個輸入完全不一樣

1132
00:41:21,240 --> 00:41:26,240
但是你還是有可能得到

1133
00:41:26,240 --> 00:41:28,240
同樣的兩個輸出

1134
00:41:28,240 --> 00:41:30,240
兩個一樣的摘要

1135
00:41:30,240 --> 00:41:32,240
這個跟前面講的

1136
00:41:32,240 --> 00:41:34,240
前面講的這個

1137
00:41:34,240 --> 00:41:36,240
跟整個雜湊函數的目的

1138
00:41:36,240 --> 00:41:38,240
似乎有點衝突

1139
00:41:38,240 --> 00:41:44,240
那有沒有厲害的同仁

1140
00:41:44,240 --> 00:41:45,240
可以發表一下

1141
00:41:45,240 --> 00:41:47,240
覺得為什麼會是這樣

1142
00:41:49,240 --> 00:41:56,240
這邊我再描述的再仔細一點

1143
00:41:56,240 --> 00:41:58,240
就是說我們就假設

1144
00:41:58,240 --> 00:42:00,240
我們就假設這個

1145
00:42:00,240 --> 00:42:02,240
我們所使用的這一版果汁機

1146
00:42:02,240 --> 00:42:04,240
他能夠出來的摘要

1147
00:42:04,240 --> 00:42:07,240
我們就說是32bit

1148
00:42:07,240 --> 00:42:12,240
那為什麼有可能會發生

1149
00:42:12,240 --> 00:42:14,240
為什麼有可能會發生

1150
00:42:14,240 --> 00:42:16,240
這個不同的輸入

1151
00:42:16,240 --> 00:42:18,240
得到一樣的輸出的結果

1152
00:42:18,240 --> 00:42:21,240
請說

1153
00:42:21,240 --> 00:42:31,240
因為這個世界的東西

1154
00:42:31,240 --> 00:42:33,240
遠比那些摘要還要多

1155
00:42:33,240 --> 00:42:36,240
所以有可能不一樣的東西

1156
00:42:36,240 --> 00:42:39,240
進入這個雜湊函數以後

1157
00:42:39,240 --> 00:42:41,240
會得到相同的數字

1158
00:42:41,240 --> 00:42:43,240
是的是的

1159
00:42:43,240 --> 00:42:45,240
就是意思是

1160
00:42:45,240 --> 00:42:47,240
注意我們前面講到

1161
00:42:47,240 --> 00:42:49,240
任意長度的輸入

1162
00:42:49,240 --> 00:42:50,240
所以在你

1163
00:42:50,240 --> 00:42:52,240
基本上是在你輸出的長度

1164
00:42:52,240 --> 00:42:54,240
是固定的狀況下

1165
00:42:54,240 --> 00:42:56,240
一定一定會有機會

1166
00:42:56,240 --> 00:42:58,240
你的輸入的值率會超過

1167
00:42:58,240 --> 00:43:01,240
會超過輸出的值率

1168
00:43:01,240 --> 00:43:03,240
所以當然這個是

1169
00:43:03,240 --> 00:43:05,240
這個是必須會要發生的

1170
00:43:05,240 --> 00:43:07,240
因為你的設計就是讓

1171
00:43:07,240 --> 00:43:10,240
雜湊函數可以吃任意長度的輸入

1172
00:43:10,240 --> 00:43:12,240
所以這個是勢必會發生的

1173
00:43:12,240 --> 00:43:15,240
但是我們一般在密碼學上面

1174
00:43:15,240 --> 00:43:16,240
會用到的雜湊函數

1175
00:43:16,240 --> 00:43:18,240
我們希望這樣的發生機率

1176
00:43:18,240 --> 00:43:20,240
我們把這叫做碰撞

1177
00:43:20,240 --> 00:43:21,240
要碰撞

1178
00:43:21,240 --> 00:43:23,240
我們希望這個發生機率極低

1179
00:43:23,240 --> 00:43:25,240
而且不能被操控

1180
00:43:25,240 --> 00:43:27,240
不能我想要它碰撞它就碰撞

1181
00:43:27,240 --> 00:43:29,240
不能說

1182
00:43:29,240 --> 00:43:31,240
我看到一個摘要

1183
00:43:31,240 --> 00:43:33,240
我就知道什麼樣的輸入

1184
00:43:33,240 --> 00:43:35,240
可以得到這樣的摘要

1185
00:43:35,240 --> 00:43:38,240
不能輕易的被操作

1186
00:43:38,240 --> 00:43:40,240
所以碰撞是一定會發生

1187
00:43:40,240 --> 00:43:43,240
但是密碼學上面機率極低

1188
00:43:43,240 --> 00:43:47,240
然後並且也不容易被實現

1189
00:43:47,240 --> 00:43:48,240
好 謝謝

1190
00:43:48,240 --> 00:43:51,240
再來第五項特性的話

1191
00:43:51,240 --> 00:43:53,240
前面有講到就是說

1192
00:43:53,240 --> 00:43:55,240
它是不可逆的

1193
00:43:55,240 --> 00:43:56,240
它是單向的

1194
00:43:56,240 --> 00:43:58,240
單向的這個函數

1195
00:43:58,240 --> 00:44:01,240
那具體為什麼它是單向的

1196
00:44:01,240 --> 00:44:02,240
是因為多半

1197
00:44:02,240 --> 00:44:04,240
你就算是用哪一種的雜

1198
00:44:04,240 --> 00:44:06,240
不管是用哪一種的雜湊函數

1199
00:44:06,240 --> 00:44:08,240
它的流程裡面一定會包含到

1200
00:44:08,240 --> 00:44:10,240
多對一的mapping

1201
00:44:10,240 --> 00:44:12,240
那本來你在有輸入

1202
00:44:12,240 --> 00:44:14,240
多個輸入可能都可能會得到

1203
00:44:14,240 --> 00:44:16,240
同一個輸出的結果下

1204
00:44:16,240 --> 00:44:18,240
你當然不可能知道那個輸出

1205
00:44:18,240 --> 00:44:19,240
就返回去退回去輸入

1206
00:44:19,240 --> 00:44:21,240
你根本就不知道你要走哪一條路回去

1207
00:44:21,240 --> 00:44:23,240
這樣

1208
00:44:23,240 --> 00:44:25,240
那再來是第六個性質

1209
00:44:25,240 --> 00:44:27,240
這邊第六個性質指的是說

1210
00:44:27,240 --> 00:44:29,240
當然這樣的雜湊函數

1211
00:44:29,240 --> 00:44:30,240
會經過世代更迭

1212
00:44:30,240 --> 00:44:33,240
所以以前在用的這種叫MD4 MD5

1213
00:44:33,240 --> 00:44:34,240
這叫Message Digest

1214
00:44:34,240 --> 00:44:35,240
第四代第五代

1215
00:44:35,240 --> 00:44:36,240
這種都已經除役

1216
00:44:36,240 --> 00:44:38,240
那現在最常使用的是

1217
00:44:38,240 --> 00:44:41,240
這個紅色框框起來的叫做SHAR2

1218
00:44:41,240 --> 00:44:42,240
那SHAR2來講

1219
00:44:42,240 --> 00:44:45,240
它當然是有前面幾個的後代

1220
00:44:45,240 --> 00:44:47,240
就是從SHAR0開始

1221
00:44:47,240 --> 00:44:48,240
跟SHAR1

1222
00:44:48,240 --> 00:44:49,240
然後到現在來講

1223
00:44:49,240 --> 00:44:51,240
在使用的是SHAR2

1224
00:44:51,240 --> 00:44:54,240
那SHAR0跟SHAR1來講的話

1225
00:44:54,240 --> 00:44:57,240
SHAR0是本身它的演算法就有缺陷

1226
00:44:57,240 --> 00:44:58,240
那SHAR1的話

1227
00:44:58,240 --> 00:45:01,240
是它的運算已經可以開始被操弄

1228
00:45:01,240 --> 00:45:03,240
所以已經被除役

1229
00:45:03,240 --> 00:45:07,240
那現在所使用的SHAR2

1230
00:45:07,240 --> 00:45:08,240
它大概是這樣

1231
00:45:08,240 --> 00:45:10,240
就是說SHAR2是一整個族

1232
00:45:10,240 --> 00:45:11,240
它這個族裡面

1233
00:45:11,240 --> 00:45:13,240
它有不同的版本

1234
00:45:13,240 --> 00:45:17,240
可以讓你得到不同長度的摘要的輸出

1235
00:45:17,240 --> 00:45:19,240
所以比方說這邊是224的

1236
00:45:19,240 --> 00:45:21,240
256的 384 512

1237
00:45:21,240 --> 00:45:24,240
跟它這邊寫有512/224

1238
00:45:24,240 --> 00:45:26,240
跟512/256

1239
00:45:26,240 --> 00:45:27,240
這個是什麼意思

1240
00:45:27,240 --> 00:45:28,240
這個是大家補充一下

1241
00:45:28,240 --> 00:45:31,240
就是說當然這幾個

1242
00:45:31,240 --> 00:45:32,240
這幾個224 256

1243
00:45:32,240 --> 00:45:34,240
這些函數的構造是不同的

1244
00:45:34,240 --> 00:45:37,240
但是只要是512開頭的

1245
00:45:37,240 --> 00:45:38,240
它都是相同的

1246
00:45:38,240 --> 00:45:40,240
但是它是用

1247
00:45:40,240 --> 00:45:43,240
類似這樣子512的這樣的函數的架構

1248
00:45:43,240 --> 00:45:46,240
它能夠去幫你轉出224

1249
00:45:46,240 --> 00:45:49,240
或是256bit的摘要的長度

1250
00:45:49,240 --> 00:45:52,240
它的這邊的/224或256是這個意思

1251
00:45:52,240 --> 00:45:54,240
那目前來講

1252
00:45:54,240 --> 00:45:57,240
針對SHAR2還並沒有有效的攻擊

1253
00:45:57,240 --> 00:45:59,240
那在這邊講這個

1254
00:45:59,240 --> 00:46:01,240
所謂沒有有效的攻擊

1255
00:46:01,240 --> 00:46:02,240
跟我們講說可能

1256
00:46:02,240 --> 00:46:04,240
為什麼我們講說夏林跟夏灣被破解

1257
00:46:04,240 --> 00:46:06,240
那這邊給大家一個觀念就是說

1258
00:46:06,240 --> 00:46:09,240
所謂被破解來講的話

1259
00:46:09,240 --> 00:46:11,240
絕對不是說你馬上一秒就能

1260
00:46:11,240 --> 00:46:14,240
短短的時間內就能變出答案

1261
00:46:14,240 --> 00:46:15,240
不是這個意思

1262
00:46:15,240 --> 00:46:17,240
而是說

1263
00:46:17,240 --> 00:46:20,240
先從這邊講的被破解來說的話

1264
00:46:20,240 --> 00:46:22,240
一般來講說被破解

1265
00:46:22,240 --> 00:46:23,240
或是說有有效的攻擊

1266
00:46:23,240 --> 00:46:24,240
我們指的是說

1267
00:46:24,240 --> 00:46:27,240
有比暴力破解更有效率的方法

1268
00:46:28,240 --> 00:46:31,240
可以降低它的運算的複雜度

1269
00:46:31,240 --> 00:46:33,240
這樣應該比較精確

1270
00:46:33,240 --> 00:46:34,240
只要能夠做到這樣的話

1271
00:46:34,240 --> 00:46:36,240
那大致上我們就

1272
00:46:36,240 --> 00:46:38,240
等於說這樣的演算法

1273
00:46:38,240 --> 00:46:40,240
它的安全性已經打折了

1274
00:46:40,240 --> 00:46:42,240
那打多少折其實不用管

1275
00:46:42,240 --> 00:46:43,240
很多時候當然

1276
00:46:43,240 --> 00:46:45,240
所謂宣稱被破解而言

1277
00:46:45,240 --> 00:46:47,240
它不過是運算的複雜度

1278
00:46:47,240 --> 00:46:48,240
降低了一點而已

1279
00:46:48,240 --> 00:46:50,240
降低了二的幾次方而已

1280
00:46:50,240 --> 00:46:52,240
那個不見得

1281
00:46:52,240 --> 00:46:54,240
所以其實說真的

1282
00:46:54,240 --> 00:46:55,240
雖然說不建議使用

1283
00:46:55,240 --> 00:46:57,240
但是很多時候

1284
00:46:57,240 --> 00:46:58,240
那些被除役的

1285
00:46:58,240 --> 00:46:59,240
被除役的做法來講

1286
00:46:59,240 --> 00:47:00,240
它其實也沒有

1287
00:47:00,240 --> 00:47:02,240
沒有馬上就能夠

1288
00:47:02,240 --> 00:47:04,240
沒有馬上就能夠破解

1289
00:47:04,240 --> 00:47:06,240
就破密這回事

1290
00:47:06,240 --> 00:47:08,240
並沒有

1291
00:47:08,240 --> 00:47:10,240
那

1292
00:47:10,240 --> 00:47:11,240
這邊就帶來另外一個問題

1293
00:47:11,240 --> 00:47:13,240
就是說剛剛已經講過說

1294
00:47:13,240 --> 00:47:15,240
剛剛已經講過說

1295
00:47:15,240 --> 00:47:17,240
所謂的被破解

1296
00:47:17,240 --> 00:47:19,240
或是說已經被除役的這種

1297
00:47:19,240 --> 00:47:20,240
指的是說

1298
00:47:20,240 --> 00:47:22,240
存在比暴力破解更有效的

1299
00:47:22,240 --> 00:47:23,240
更有效率的做法

1300
00:47:23,240 --> 00:47:25,240
那也有另外一種是

1301
00:47:25,240 --> 00:47:27,240
它的這個本身的

1302
00:47:27,240 --> 00:47:29,240
這個演算法的設計

1303
00:47:29,240 --> 00:47:31,240
是有問題的

1304
00:47:31,240 --> 00:47:33,240
它是有數學上面的缺陷的

1305
00:47:33,240 --> 00:47:35,240
但是特別是像

1306
00:47:35,240 --> 00:47:36,240
數學有缺陷這件事情

1307
00:47:36,240 --> 00:47:38,240
以現在的審查制度來講

1308
00:47:38,240 --> 00:47:39,240
現在這種都是

1309
00:47:39,240 --> 00:47:42,240
類似去投標去做競賽的

1310
00:47:42,240 --> 00:47:43,240
以這種狀況來講

1311
00:47:43,240 --> 00:47:45,240
現在有數學缺陷

1312
00:47:45,240 --> 00:47:47,240
還能夠通過成為正式標準的

1313
00:47:47,240 --> 00:47:48,240
會比較難

1314
00:47:48,240 --> 00:47:50,240
就一般比較不太會有這種狀況

1315
00:47:50,240 --> 00:47:51,240
以前可能會有

1316
00:47:51,240 --> 00:47:52,240
現在很少

1317
00:47:52,240 --> 00:47:54,240
那這邊來講

1318
00:47:54,240 --> 00:47:56,240
有另外一個事情要提的就是說

1319
00:47:56,240 --> 00:47:58,240
那所謂被破解

1320
00:47:58,240 --> 00:48:00,240
還有什麼樣的可能

1321
00:48:00,240 --> 00:48:02,240
其實一種是說

1322
00:48:02,240 --> 00:48:03,240
有一種簡單的情境

1323
00:48:03,240 --> 00:48:05,240
就是說我們希望

1324
00:48:05,240 --> 00:48:07,240
我們希望這個系統安全

1325
00:48:07,240 --> 00:48:09,240
除了它的演算法要健康之外

1326
00:48:09,240 --> 00:48:11,240
就是它不是

1327
00:48:11,240 --> 00:48:13,240
它不是被這個破解的演算法

1328
00:48:13,240 --> 00:48:15,240
另外一種

1329
00:48:15,240 --> 00:48:17,240
另外一種我們常常會用來

1330
00:48:17,240 --> 00:48:19,240
保護安全的一種東西

1331
00:48:19,240 --> 00:48:21,240
我們把它叫做協定

1332
00:48:21,240 --> 00:48:23,240
最簡單的說法就是說

1333
00:48:23,240 --> 00:48:25,240
假設

1334
00:48:25,240 --> 00:48:26,240
假設我今天

1335
00:48:26,240 --> 00:48:28,240
我所使用的加密演算法

1336
00:48:28,240 --> 00:48:32,240
它在100個microsecond

1337
00:48:32,240 --> 00:48:34,240
內會被破解

1338
00:48:34,240 --> 00:48:36,240
那很簡單

1339
00:48:36,240 --> 00:48:39,240
如果還是只能使用這個的話

1340
00:48:39,240 --> 00:48:40,240
也很簡單

1341
00:48:40,240 --> 00:48:42,240
我只要跟對方約定好說

1342
00:48:42,240 --> 00:48:44,240
我們10microsecond就換一次key

1343
00:48:44,240 --> 00:48:47,240
這樣會讓你沒有那個100microsecond去破解

1344
00:48:47,240 --> 00:48:50,240
這個就是所謂協定的意思

1345
00:48:50,240 --> 00:48:52,240
所以一般來講

1346
00:48:52,240 --> 00:48:53,240
協定跟演算法

1347
00:48:53,240 --> 00:48:55,240
這邊我們比較不會去討論協定

1348
00:48:55,240 --> 00:48:57,240
因為協定通常來講

1349
00:48:57,240 --> 00:48:59,240
更比較

1350
00:48:59,240 --> 00:49:01,240
比較大家會

1351
00:49:01,240 --> 00:49:03,240
都比較用這種公開的標準

1352
00:49:03,240 --> 00:49:05,240
比方說HTTPS這種東西

1353
00:49:05,240 --> 00:49:06,240
我們常常看到的

1354
00:49:06,240 --> 00:49:07,240
所以協定這邊的話

1355
00:49:07,240 --> 00:49:08,240
我們就不會再去多談

1356
00:49:08,240 --> 00:49:09,240
這邊的話

1357
00:49:09,240 --> 00:49:11,240
比較會多講一點點的是演算法

1358
00:49:11,240 --> 00:49:16,240
好那接下來

1359
00:49:16,240 --> 00:49:18,240
記得我們有四個大單權目標

1360
00:49:18,240 --> 00:49:20,240
有保密性

1361
00:49:20,240 --> 00:49:22,240
有資料完整性

1362
00:49:22,240 --> 00:49:23,240
然後有認證性

1363
00:49:23,240 --> 00:49:25,240
跟不可否認性

1364
00:49:25,240 --> 00:49:26,240
這四個

1365
00:49:26,240 --> 00:49:29,240
對應的有四種比較常用的做法

1366
00:49:29,240 --> 00:49:30,240
就加密

1367
00:49:30,240 --> 00:49:31,240
然後是雜種函數

1368
00:49:31,240 --> 00:49:33,240
或是認證

1369
00:49:33,240 --> 00:49:34,240
認證的機制

1370
00:49:34,240 --> 00:49:36,240
或者是現在要談的叫不可否認性

1371
00:49:36,240 --> 00:49:37,240
我們會用數位簽章

1372
00:49:37,240 --> 00:49:41,240
那注意這邊我們是先跳到第四項

1373
00:49:41,240 --> 00:49:43,240
先跳到不可否認性的簽章

1374
00:49:43,240 --> 00:49:46,240
因為主要的原因是因為認證

1375
00:49:46,240 --> 00:49:47,240
它稍微複雜一些

1376
00:49:47,240 --> 00:49:49,240
所以我們會比較後面才提

1377
00:49:49,240 --> 00:49:54,240
好那

1378
00:49:54,240 --> 00:49:56,240
不可否認性

1379
00:49:56,240 --> 00:49:57,240
就是說簽章這件事情

1380
00:49:57,240 --> 00:49:59,240
我們前面大概有提過

1381
00:49:59,240 --> 00:50:01,240
就好比借錢之所以要簽借據

1382
00:50:01,240 --> 00:50:03,240
就是因為怕口說無憑

1383
00:50:03,240 --> 00:50:05,240
那所以這種情況就是說

1384
00:50:05,240 --> 00:50:07,240
的確有可能

1385
00:50:07,240 --> 00:50:09,240
惡意的A傳送了一個訊息

1386
00:50:09,240 --> 00:50:11,240
然後過了一陣子之後

1387
00:50:11,240 --> 00:50:12,240
他說他否認說

1388
00:50:12,240 --> 00:50:15,240
否認說我從來沒有送過

1389
00:50:15,240 --> 00:50:17,240
那所以

1390
00:50:17,240 --> 00:50:19,240
為了要解決這個問題

1391
00:50:19,240 --> 00:50:21,240
我們會用類似叫簽章的方式

1392
00:50:21,240 --> 00:50:24,240
那用簽章的方式可以避免什麼

1393
00:50:24,240 --> 00:50:26,240
可以避免兩種情況

1394
00:50:26,240 --> 00:50:29,240
第一種是說

1395
00:50:29,240 --> 00:50:31,240
冒用身份的問題

1396
00:50:31,240 --> 00:50:33,240
我們會假定只有我們自己

1397
00:50:33,240 --> 00:50:35,240
才能簽出我們自己的簽名

1398
00:50:35,240 --> 00:50:37,240
別人沒有辦法偽造你的簽名

1399
00:50:37,240 --> 00:50:39,240
那再來就是說

1400
00:50:39,240 --> 00:50:41,240
也一樣跟前面提到說

1401
00:50:41,240 --> 00:50:43,240
有可能會偽造

1402
00:50:43,240 --> 00:50:45,240
有可能會偽造訊息

1403
00:50:45,240 --> 00:50:48,240
簽章能夠解決這兩個問題

1404
00:50:48,240 --> 00:50:50,240
那簽章

1405
00:50:50,240 --> 00:50:52,240
簽章它也同樣都是用

1406
00:50:52,240 --> 00:50:54,240
非對稱式的演算法來做

1407
00:50:54,240 --> 00:51:00,240
所以它的簡單的流程來講的話

1408
00:51:00,240 --> 00:51:02,240
簡單的概念大概會是說

1409
00:51:02,240 --> 00:51:04,240
同樣我每一個人

1410
00:51:04,240 --> 00:51:07,240
有自己的一對私藥和公藥

1411
00:51:07,240 --> 00:51:09,240
並且我很有可能是

1412
00:51:09,240 --> 00:51:12,240
通常都是從私藥開始去產生公藥

1413
00:51:12,240 --> 00:51:16,240
那這邊講的是說

1414
00:51:16,240 --> 00:51:18,240
為什麼會有簽章

1415
00:51:18,240 --> 00:51:20,240
簽章的安全基礎在哪裡

1416
00:51:20,240 --> 00:51:22,240
簽章的安全基礎是在於說

1417
00:51:22,240 --> 00:51:25,240
只有我自己擁有我自己的私藥

1418
00:51:25,240 --> 00:51:27,240
因為它絕對不外洩

1419
00:51:27,240 --> 00:51:28,240
只有我自己有

1420
00:51:28,240 --> 00:51:31,240
那並且我公藥四散在外

1421
00:51:31,240 --> 00:51:32,240
前面也講過

1422
00:51:32,240 --> 00:51:34,240
你單有公藥是推不回私藥的

1423
00:51:34,240 --> 00:51:35,240
它的數學基礎

1424
00:51:35,240 --> 00:51:38,240
這兩個前提之下呢

1425
00:51:38,240 --> 00:51:40,240
這兩個前提之下

1426
00:51:40,240 --> 00:51:43,240
要做這個簽章的人

1427
00:51:43,240 --> 00:51:45,240
要產生這個簽章的人

1428
00:51:45,240 --> 00:51:48,240
他會去用他自己的私藥去簽

1429
00:51:48,240 --> 00:51:50,240
去簽一個訊息

1430
00:51:50,240 --> 00:51:52,240
然後所有其他人

1431
00:51:52,240 --> 00:51:55,240
因為都可以取得這個人的公藥

1432
00:51:55,240 --> 00:51:57,240
所有其他人都可以用這個公

1433
00:51:57,240 --> 00:51:59,240
用這個簽訴方的公藥

1434
00:51:59,240 --> 00:52:03,240
來確認這個簽名是否有效

1435
00:52:03,240 --> 00:52:07,240
所以概念跟我們一般會用蠻類似

1436
00:52:07,240 --> 00:52:08,240
就是說假設你去

1437
00:52:08,240 --> 00:52:10,240
有去到什麼做什麼簽名鑑定這種

1438
00:52:10,240 --> 00:52:12,240
也是因為我們會認定

1439
00:52:12,240 --> 00:52:14,240
有人能夠驗得出你的簽名

1440
00:52:14,240 --> 00:52:16,240
是否由你所簽

1441
00:52:16,240 --> 00:52:17,240
並且我們會假定

1442
00:52:17,240 --> 00:52:19,240
只有你能簽出你自己的簽名

1443
00:52:19,240 --> 00:52:21,240
整個簽名這件事情的安全性

1444
00:52:21,240 --> 00:52:24,240
主要是建立在這裡

1445
00:52:24,240 --> 00:52:26,240
所以實用上的話

1446
00:52:26,240 --> 00:52:27,240
就會是類似說

1447
00:52:27,240 --> 00:52:32,240
我這個人他要做簽章的時候

1448
00:52:32,240 --> 00:52:33,240
對不同人

1449
00:52:33,240 --> 00:52:36,240
他都會用他同一把私藥去做簽訴

1450
00:52:36,240 --> 00:52:41,240
所有人都用這個人的公藥去確認

1451
00:52:41,240 --> 00:52:44,240
注意是確認這個簽名

1452
00:52:44,240 --> 00:52:47,240
這個方向跟我們前面提到過

1453
00:52:47,240 --> 00:52:50,240
用非對稱式演算法做加密是反過來的

1454
00:52:50,240 --> 00:52:51,240
前面我們在講

1455
00:52:51,240 --> 00:52:52,240
非對稱式的加密的時候

1456
00:52:52,240 --> 00:52:58,240
我們說傳送方用接收方的公藥加密

1457
00:52:58,240 --> 00:53:01,240
並且只有接收方自己擁有那把私藥

1458
00:53:01,240 --> 00:53:02,240
能夠去解密

1459
00:53:02,240 --> 00:53:04,240
這邊的方向是反過來的

1460
00:53:04,240 --> 00:53:08,240
我要issue一個簽章

1461
00:53:08,240 --> 00:53:11,240
是由我自己用我的私藥

1462
00:53:11,240 --> 00:53:13,240
才能證明我的身份去簽

1463
00:53:13,240 --> 00:53:17,240
所有人都可以用我的公藥

1464
00:53:17,240 --> 00:53:23,240
去確認這個簽名

1465
00:53:23,240 --> 00:53:25,240
再來我們再看一下

1466
00:53:25,240 --> 00:53:27,240
比較簡易的流程

1467
00:53:27,240 --> 00:53:29,240
通常會怎麼做

1468
00:53:29,240 --> 00:53:31,240
通常我們第一步

1469
00:53:31,240 --> 00:53:36,240
會把我們所要簽的訊息

1470
00:53:36,240 --> 00:53:41,240
我們先經過hash得到摘要

1471
00:53:41,240 --> 00:53:44,240
再來我們會用這個私藥

1472
00:53:44,240 --> 00:53:45,240
我說的A藥做簽名

1473
00:53:45,240 --> 00:53:48,240
A會把A的私藥拿來

1474
00:53:48,240 --> 00:53:52,240
然後對這個訊息做簽章

1475
00:53:52,240 --> 00:53:53,240
但是這邊我們講

1476
00:53:53,240 --> 00:53:56,240
好比是用私藥去做加密

1477
00:53:56,240 --> 00:53:59,240
所以這邊的加密我放了quote on quote

1478
00:53:59,240 --> 00:54:04,240
當然為什麼我們要經過一個hash

1479
00:54:04,240 --> 00:54:05,240
很簡單

1480
00:54:05,240 --> 00:54:08,240
因為非對稱式的演算法運算複雜

1481
00:54:08,240 --> 00:54:11,240
我們不希望它過大量的input

1482
00:54:11,240 --> 00:54:16,240
所以因為我們沒有要去確認

1483
00:54:16,240 --> 00:54:22,240
簽章來講它並沒有要帶有訊息

1484
00:54:22,240 --> 00:54:24,240
訊息是分開傳的

1485
00:54:24,240 --> 00:54:26,240
訊息夾帶簽章

1486
00:54:26,240 --> 00:54:29,240
所以你不用去管訊息一不一樣

1487
00:54:29,240 --> 00:54:33,240
簽章裡面只要包含成分就可以

1488
00:54:33,240 --> 00:54:36,240
所以它會用hash

1489
00:54:36,240 --> 00:54:41,240
再來它有了這個簽名做好了之後

1490
00:54:41,240 --> 00:54:46,240
它會把訊息也傳送給B

1491
00:54:46,240 --> 00:54:48,240
然後簽章也傳送給B

1492
00:54:48,240 --> 00:54:51,240
所以剛剛講的訊息跟附件

1493
00:54:51,240 --> 00:54:52,240
這邊為了簡化

1494
00:54:52,240 --> 00:54:54,240
我們不去討論訊息的加密

1495
00:54:54,240 --> 00:54:56,240
我們就假設不管它有沒有加密

1496
00:54:56,240 --> 00:54:58,240
總之這個訊息接收方

1497
00:54:58,240 --> 00:55:02,240
它得到了訊息和這個簽章

1498
00:55:02,240 --> 00:55:03,240
最後會做什麼事

1499
00:55:03,240 --> 00:55:07,240
最後我們這個接收方B

1500
00:55:07,240 --> 00:55:08,240
它會用一樣的過程

1501
00:55:08,240 --> 00:55:12,240
把收到的這個訊息經過hash

1502
00:55:12,240 --> 00:55:14,240
也得到摘要

1503
00:55:14,240 --> 00:55:16,240
然後把它收到的這個簽章

1504
00:55:16,240 --> 00:55:21,240
好比是用A的公鑰去做解密

1505
00:55:21,240 --> 00:55:23,240
好比是解密

1506
00:55:23,240 --> 00:55:25,240
但是實際上我們就要確認

1507
00:55:25,240 --> 00:55:27,240
做一個確認的函數

1508
00:55:27,240 --> 00:55:28,240
verification的函數

1509
00:55:28,240 --> 00:55:30,240
然後最後再來比對

1510
00:55:30,240 --> 00:55:34,240
比對這兩個hash值是否相同

1511
00:55:34,240 --> 00:55:40,240
它大概是過這樣的過程

1512
00:55:40,240 --> 00:55:48,240
所以到這邊為止有問題嗎

1513
00:55:48,240 --> 00:55:53,240
好 我想我們先休息十分鐘

1514
00:55:53,240 --> 00:55:54,240
十分鐘好了

1515
00:55:54,240 --> 00:55:55,240
那我們回來的時候

1516
00:55:55,240 --> 00:55:58,240
會再接著講第四個authentication

1517
00:55:58,240 --> 00:56:01,240
我想時間差不多我們就繼續

1518
00:56:01,240 --> 00:56:02,240
所以到剛剛為止

1519
00:56:02,240 --> 00:56:05,240
我們大概看了四個安全目標

1520
00:56:05,240 --> 00:56:06,240
其中三種

1521
00:56:06,240 --> 00:56:08,240
保密性 資料完整性

1522
00:56:08,240 --> 00:56:10,240
跟不可否認性

1523
00:56:10,240 --> 00:56:12,240
接下來我們要看的是叫認證

1524
00:56:12,240 --> 00:56:14,240
為什麼認證放在最後講

1525
00:56:14,240 --> 00:56:17,240
是因為它其實要考量的細節比較多

1526
00:56:17,240 --> 00:56:19,240
然後它的做法也比較複雜

1527
00:56:19,240 --> 00:56:21,240
它算是一個複合型的功能

1528
00:56:21,240 --> 00:56:23,240
所以我們把它擺在最後

1529
00:56:23,240 --> 00:56:30,240
基本上就像加密一樣

1530
00:56:30,240 --> 00:56:34,240
認證其實也可以簡單的分為

1531
00:56:34,240 --> 00:56:36,240
對稱式或是非對稱式的做法

1532
00:56:36,240 --> 00:56:38,240
這邊兩種我們會各舉一個例子

1533
00:56:38,240 --> 00:56:41,240
首先要看到的是對稱式的

1534
00:56:41,240 --> 00:56:43,240
對稱式的認證

1535
00:56:43,240 --> 00:56:45,240
我們常常會使用的一種方法

1536
00:56:45,240 --> 00:56:47,240
叫做訊息驗證碼

1537
00:56:47,240 --> 00:56:48,240
或我們叫MAC

1538
00:56:48,240 --> 00:56:50,240
訊息驗證碼

1539
00:56:50,240 --> 00:56:54,240
它的基本原理就是會去

1540
00:56:54,240 --> 00:56:58,240
把我們要加密的密文

1541
00:56:58,240 --> 00:57:04,240
跟一個專門用來做訊息驗證碼用的key

1542
00:57:04,240 --> 00:57:06,240
然後經過這個hash

1543
00:57:06,240 --> 00:57:08,240
得到這個摘要

1544
00:57:08,240 --> 00:57:11,240
或是在這邊我們叫做訊息驗證碼

1545
00:57:11,240 --> 00:57:13,240
在這它的基本原理是

1546
00:57:13,240 --> 00:57:19,240
它會把密文跟一把專門用來做MAC的key

1547
00:57:19,240 --> 00:57:21,240
然後進到這個hash

1548
00:57:21,240 --> 00:57:23,240
然後得到一個摘要

1549
00:57:23,240 --> 00:57:25,240
或是在這邊叫做訊息驗證碼

1550
00:57:25,240 --> 00:57:29,240
那它的最主要的目的呢

1551
00:57:29,240 --> 00:57:31,240
是說除了能夠確認身份之外

1552
00:57:31,240 --> 00:57:33,240
也能夠確認訊息有沒有被竄改

1553
00:57:33,240 --> 00:57:37,240
所以我們再簡單的過一下這個流程的話呢

1554
00:57:37,240 --> 00:57:39,240
首先我們假設

1555
00:57:39,240 --> 00:57:42,240
可能用我們前面所提過的這些方法呢

1556
00:57:42,240 --> 00:57:45,240
我們可以把一把藍色的這把MAC key

1557
00:57:45,240 --> 00:57:49,240
安全的傳送給接收方B

1558
00:57:49,240 --> 00:57:52,240
所以這邊這個禁要的傳送

1559
00:57:52,240 --> 00:57:54,240
我們就先不考慮

1560
00:57:54,240 --> 00:57:56,240
兩邊都有這把藍色的key

1561
00:57:56,240 --> 00:57:59,240
並且他們有加密過的訊息

1562
00:57:59,240 --> 00:58:00,240
加密過的訊息呢

1563
00:58:00,240 --> 00:58:04,240
我們在這邊假設是用另外一把黃色的key來做的

1564
00:58:04,240 --> 00:58:06,240
簡單來說就是要區分

1565
00:58:06,240 --> 00:58:10,240
就是要多加一重保險的意思

1566
00:58:10,240 --> 00:58:13,240
加密訊息用的這把黃色的key

1567
00:58:13,240 --> 00:58:16,240
跟用來做MAC的MAC key可以是不一樣的

1568
00:58:16,240 --> 00:58:25,240
所以它的原理上就是說

1569
00:58:25,240 --> 00:58:27,240
我們看步驟好了

1570
00:58:27,240 --> 00:58:30,240
首先它是把用黃色的這把key

1571
00:58:30,240 --> 00:58:33,240
來加密它所要傳送的明文

1572
00:58:33,240 --> 00:58:35,240
然後把它變成密文之後

1573
00:58:35,240 --> 00:58:39,240
再來安全的傳送過了這把藍色的MAC key

1574
00:58:39,240 --> 00:58:42,240
再來就可以像我們剛剛講的流程一樣

1575
00:58:42,240 --> 00:58:44,240
去把這個訊息驗證碼做出來

1576
00:58:44,240 --> 00:58:47,240
它會把密文加上這把MAC key

1577
00:58:47,240 --> 00:58:53,240
經過hash得到訊息驗證碼MAC

1578
00:58:53,240 --> 00:58:55,240
再來下一步的話呢

1579
00:58:55,240 --> 00:58:57,240
我們傳送過去的會是兩個東西

1580
00:58:57,240 --> 00:59:01,240
一樣是加密的密文跟它附帶的一個附件

1581
00:59:01,240 --> 00:59:02,240
就是訊息驗證碼

1582
00:59:02,240 --> 00:59:04,240
等於說我們把它attach在後面

1583
00:59:04,240 --> 00:59:07,240
接收到的人會做什麼事

1584
00:59:07,240 --> 00:59:08,240
他會去做驗證

1585
00:59:08,240 --> 00:59:11,240
驗證這個訊息驗證碼

1586
00:59:11,240 --> 00:59:13,240
首先呢是正確的情境

1587
00:59:13,240 --> 00:59:15,240
是說它如果是正確的話

1588
00:59:15,240 --> 00:59:16,240
它會收到

1589
00:59:16,240 --> 00:59:18,240
它會把一樣收到這個密文

1590
00:59:18,240 --> 00:59:20,240
加上它有的MAC key

1591
00:59:20,240 --> 00:59:22,240
去做一樣的訊息驗證碼

1592
00:59:22,240 --> 00:59:26,240
並且因為這個是健康的情境

1593
00:59:26,240 --> 00:59:27,240
所以它得到的訊息驗證碼

1594
00:59:27,240 --> 00:59:28,240
會是一模一樣的

1595
00:59:28,240 --> 00:59:29,240
前面我們提過

1596
00:59:29,240 --> 00:59:31,240
你進到hash來講

1597
00:59:31,240 --> 00:59:33,240
你只要輸入一樣

1598
00:59:33,240 --> 00:59:35,240
你的輸出一定會一樣

1599
00:59:35,240 --> 00:59:40,240
那如果有出問題的話呢

1600
00:59:40,240 --> 00:59:43,240
一個可能是你的訊息被篡改

1601
00:59:43,240 --> 00:59:46,240
那就算你持有相同的key

1602
00:59:46,240 --> 00:59:50,240
但是你得不出一樣的這個MAC

1603
00:59:50,240 --> 00:59:52,240
所以在這邊的話

1604
00:59:52,240 --> 00:59:54,240
B就知道說

1605
00:59:54,240 --> 00:59:56,240
這個訊息總之這個訊息

1606
00:59:56,240 --> 00:59:57,240
我需要ignore

1607
00:59:57,240 --> 01:00:00,240
因為它有可能錯在兩種環節

1608
01:00:00,240 --> 01:00:04,240
它錯的可能性就是兩個input

1609
01:00:04,240 --> 01:00:06,240
它有可能是密文錯了

1610
01:00:06,240 --> 01:00:08,240
像這邊畫的是密文錯了

1611
01:00:08,240 --> 01:00:11,240
或者是它的MAC key是錯的

1612
01:00:11,240 --> 01:00:12,240
對吧

1613
01:00:12,240 --> 01:00:14,240
就是它只要輸入的兩個

1614
01:00:14,240 --> 01:00:15,240
裡面有一個不一樣

1615
01:00:15,240 --> 01:00:17,240
它的結果就會差很多

1616
01:00:17,240 --> 01:00:19,240
剛我們提過

1617
01:00:19,240 --> 01:00:22,240
所以以這種例子而言的話

1618
01:00:22,240 --> 01:00:24,240
你如果是惡意的第三方

1619
01:00:24,240 --> 01:00:26,240
駭客X去篡改這個密文的話

1620
01:00:26,240 --> 01:00:28,240
那它得到的MAC會是錯的

1621
01:00:28,240 --> 01:00:31,240
或者是你本來就不是

1622
01:00:31,240 --> 01:00:34,240
合法的接收方B

1623
01:00:34,240 --> 01:00:37,240
然後你就不會有這一把

1624
01:00:37,240 --> 01:00:40,240
要用來做訊息驗證用的這個MAC key

1625
01:00:40,240 --> 01:00:43,240
那你當然就得不出正確的MAC

1626
01:00:43,240 --> 01:00:47,240
所以大概的情況會有這兩種

1627
01:00:47,240 --> 01:00:51,240
那這個來講就相對來講是單純的

1628
01:00:51,240 --> 01:00:55,240
就是跟對稱式加密的概念很像

1629
01:00:55,240 --> 01:00:57,240
它就建立在說

1630
01:00:57,240 --> 01:00:59,240
你有一把加密用的key

1631
01:00:59,240 --> 01:01:01,240
可以來確保說我們溝通

1632
01:01:01,240 --> 01:01:03,240
只有我們兩個人可以看得到內容

1633
01:01:03,240 --> 01:01:05,240
並且你有另外一個MAC key

1634
01:01:05,240 --> 01:01:09,240
是用來做類似是身份的信物

1635
01:01:09,240 --> 01:01:11,240
是說只要我有這把MAC key

1636
01:01:11,240 --> 01:01:14,240
我就是合法的接收方或傳送方

1637
01:01:14,240 --> 01:01:17,240
它的概念上大概是這樣

1638
01:01:17,240 --> 01:01:19,240
接下來要看到的這個是

1639
01:01:19,240 --> 01:01:21,240
就是開始是非對稱式的做法

1640
01:01:21,240 --> 01:01:23,240
這個叫做我們一般講的憑證

1641
01:01:23,240 --> 01:01:26,240
那憑證這邊一個很簡單的示意圖

1642
01:01:26,240 --> 01:01:30,240
就是說我有一個人A

1643
01:01:30,240 --> 01:01:32,240
他去把他的個人的一些資訊

1644
01:01:32,240 --> 01:01:35,240
跟他的公要交給這個我們叫CA

1645
01:01:35,240 --> 01:01:37,240
叫做Certificate of Authority

1646
01:01:37,240 --> 01:01:39,240
叫憑證機構機關

1647
01:01:39,240 --> 01:01:42,240
那他會頒發一個憑證過來

1648
01:01:42,240 --> 01:01:45,240
類似於我們去像戶政事務所

1649
01:01:45,240 --> 01:01:48,240
或是怎麼樣的地方去辦身份證的感覺

1650
01:01:48,240 --> 01:01:51,240
我們得到了一個身份的憑證

1651
01:01:51,240 --> 01:01:54,240
那為什麼要有這個東西

1652
01:01:54,240 --> 01:01:56,240
我們前面講過

1653
01:01:56,240 --> 01:01:58,240
在公開金鑰密碼學

1654
01:01:58,240 --> 01:02:01,240
或是叫非對稱式密碼學的世界裡面

1655
01:02:01,240 --> 01:02:03,240
公要可以釋散在外

1656
01:02:03,240 --> 01:02:05,240
私要只能自己持有

1657
01:02:05,240 --> 01:02:07,240
絕對不外洩

1658
01:02:07,240 --> 01:02:09,240
公要可以釋散在外代表什麼事情

1659
01:02:09,240 --> 01:02:11,240
就是說任何人都可以去access

1660
01:02:11,240 --> 01:02:14,240
或者是去派發公要

1661
01:02:14,240 --> 01:02:15,240
但是問題在於說

1662
01:02:15,240 --> 01:02:17,240
你怎麼知道這個公要是誰的

1663
01:02:17,240 --> 01:02:21,240
所以這邊我們舉一個例子

1664
01:02:21,240 --> 01:02:26,240
所以這邊有一個惡意的駭客X

1665
01:02:26,240 --> 01:02:30,240
他首先他就聲稱自己是B

1666
01:02:30,240 --> 01:02:34,240
把他的公要PX交給A

1667
01:02:34,240 --> 01:02:35,240
A不知道

1668
01:02:35,240 --> 01:02:40,240
他以為這個公要是屬於B的

1669
01:02:40,240 --> 01:02:43,240
他用這個公要去加密訊息

1670
01:02:43,240 --> 01:02:45,240
傳給駭客X

1671
01:02:45,240 --> 01:02:48,240
駭客X有他自己的私有

1672
01:02:48,240 --> 01:02:51,240
他當然可以解讀這個訊息

1673
01:02:51,240 --> 01:02:53,240
這個是我們前面講的非對稱式的加密

1674
01:02:53,240 --> 01:02:55,240
各位應該還記得

1675
01:02:55,240 --> 01:02:57,240
所以他可以解讀這個訊息

1676
01:02:57,240 --> 01:03:01,240
假設他拿到的是正確的這個PX的話

1677
01:03:01,240 --> 01:03:04,240
他可以隨心所欲的改這個訊息

1678
01:03:04,240 --> 01:03:05,240
交給B

1679
01:03:05,240 --> 01:03:07,240
因為他有拿到B的公要

1680
01:03:07,240 --> 01:03:10,240
並且B會依照駭客X所設定的

1681
01:03:10,240 --> 01:03:12,240
用他的私要去做解密

1682
01:03:12,240 --> 01:03:14,240
然後得到一個假的訊息

1683
01:03:14,240 --> 01:03:16,240
這個是有可能發生的一種狀況

1684
01:03:16,240 --> 01:03:19,240
那大家可以想更恐怖的狀況

1685
01:03:19,240 --> 01:03:20,240
會是說

1686
01:03:20,240 --> 01:03:24,240
他可以自己解讀這個訊息之外

1687
01:03:24,240 --> 01:03:27,240
他甚至可以把正確的訊息傳給B

1688
01:03:27,240 --> 01:03:28,240
他可以

1689
01:03:28,240 --> 01:03:32,240
並且A、B以為溝通暢通無阻

1690
01:03:32,240 --> 01:03:36,240
可是不知道有人完全的竊聽了這整個通訊

1691
01:03:36,240 --> 01:03:37,240
各位應該可以想像

1692
01:03:37,240 --> 01:03:39,240
就是這兩種都是有可能發生的

1693
01:03:39,240 --> 01:03:41,240
所以我們現在要來講的

1694
01:03:41,240 --> 01:03:42,240
大家應該可以想像

1695
01:03:42,240 --> 01:03:44,240
就是這兩種都是有可能發生的

1696
01:03:44,240 --> 01:03:46,240
所以這樣的關鍵的

1697
01:03:46,240 --> 01:03:48,240
這樣的事發的原因是在於說

1698
01:03:48,240 --> 01:03:51,240
因為認錯了這一把公要

1699
01:03:51,240 --> 01:03:53,240
以為他是合法的

1700
01:03:53,240 --> 01:03:54,240
以為他是合法的

1701
01:03:54,240 --> 01:03:55,240
接收方B的公要

1702
01:03:55,240 --> 01:03:58,240
但其實他是駭客X的公要

1703
01:03:58,240 --> 01:04:00,240
因為我們前面講過公要事實上在外

1704
01:04:00,240 --> 01:04:04,240
但是你不知道如何去證明這個公要的身份

1705
01:04:04,240 --> 01:04:10,240
所以像前面講的

1706
01:04:10,240 --> 01:04:13,240
A有這個憑證

1707
01:04:13,240 --> 01:04:18,240
事先A就先把他的憑證交給B

1708
01:04:18,240 --> 01:04:20,240
我們再回頭看一下憑證的內容

1709
01:04:20,240 --> 01:04:22,240
憑證的內容有什麼呢

1710
01:04:22,240 --> 01:04:24,240
憑證的內容有A的身份

1711
01:04:24,240 --> 01:04:26,240
要知道這個是誰

1712
01:04:26,240 --> 01:04:28,240
綁定了他的公要

1713
01:04:28,240 --> 01:04:31,240
這樣就把身份跟公要綁定在一起了

1714
01:04:31,240 --> 01:04:33,240
再來他會有一個

1715
01:04:33,240 --> 01:04:35,240
這邊有一個CA在這裡

1716
01:04:35,240 --> 01:04:39,240
這個憑證是由CA所頒發

1717
01:04:39,240 --> 01:04:42,240
並且有CA的簽名

1718
01:04:42,240 --> 01:04:45,240
換回我們具體一點的例子來講

1719
01:04:45,240 --> 01:04:47,240
我們的身份證會有什麼

1720
01:04:47,240 --> 01:04:49,240
就是我們的身份證會有

1721
01:04:49,240 --> 01:04:51,240
會有這個我們的到底是誰

1722
01:04:51,240 --> 01:04:53,240
我們的一些個人的資訊

1723
01:04:53,240 --> 01:04:54,240
父母配偶什麼的

1724
01:04:54,240 --> 01:04:56,240
並且有我們最重要的那一個

1725
01:04:56,240 --> 01:04:58,240
用來證明身份用的那一個

1726
01:04:58,240 --> 01:05:00,240
我們可能叫做身份證字號

1727
01:05:00,240 --> 01:05:02,240
那同時呢

1728
01:05:02,240 --> 01:05:04,240
他會告訴你說

1729
01:05:04,240 --> 01:05:06,240
這個到底是什麼證

1730
01:05:06,240 --> 01:05:07,240
為什麼他是身份證

1731
01:05:07,240 --> 01:05:09,240
是因為他的規定是這樣

1732
01:05:09,240 --> 01:05:11,240
他是由什麼機構所頒發

1733
01:05:11,240 --> 01:05:13,240
然後怎麼做成這樣身份證

1734
01:05:13,240 --> 01:05:16,240
然後跟一些你絕對不可能去

1735
01:05:16,240 --> 01:05:19,240
輕易去篡改的一些加工

1736
01:05:19,240 --> 01:05:22,240
大概的概念是類似這樣子

1737
01:05:22,240 --> 01:05:27,240
所以只要今天A有先把這個憑證交給B

1738
01:05:27,240 --> 01:05:30,240
這個憑證上面會載明A到底是誰

1739
01:05:30,240 --> 01:05:32,240
公要到底是什麼

1740
01:05:32,240 --> 01:05:34,240
那再來

1741
01:05:34,240 --> 01:05:37,240
駭客X要去冒充成A的時候

1742
01:05:37,240 --> 01:05:39,240
他就會遇到問題

1743
01:05:39,240 --> 01:05:41,240
因為他沒有辦法提出

1744
01:05:41,240 --> 01:05:43,240
他沒有辦法提出正確的公要

1745
01:05:43,240 --> 01:05:45,240
加上他的

1746
01:05:45,240 --> 01:05:47,240
他沒有辦法提出一個偽造的證書

1747
01:05:47,240 --> 01:05:50,240
沒有辦法把他的公要PX

1748
01:05:50,240 --> 01:05:52,240
跟A的身份綁在一起

1749
01:05:52,240 --> 01:05:56,240
因為A的身份已經跟A的公要綁在一起了

1750
01:05:56,240 --> 01:05:58,240
他的大概的概念是這樣子

1751
01:06:00,240 --> 01:06:03,240
好,那我們這邊會先看一個簡圖

1752
01:06:03,240 --> 01:06:06,240
是說到底這個證書是怎麼樣

1753
01:06:06,240 --> 01:06:09,240
憑證是怎麼樣做出來的

1754
01:06:09,240 --> 01:06:11,240
所以前面講過了

1755
01:06:11,240 --> 01:06:13,240
這裡面我們講的是

1756
01:06:13,240 --> 01:06:16,240
我們要去證明我們要做一張給Bob的憑證

1757
01:06:16,240 --> 01:06:19,240
那我們分為左半邊是

1758
01:06:19,240 --> 01:06:23,240
就是左半邊是建立這個憑證的過程

1759
01:06:23,240 --> 01:06:27,240
右半邊是確認這個憑證的過程

1760
01:06:27,240 --> 01:06:30,240
左半邊來講我們先從他的成份來

1761
01:06:30,240 --> 01:06:32,240
他會包含Bob的ID

1762
01:06:32,240 --> 01:06:34,240
就是他的個人的一些資訊

1763
01:06:34,240 --> 01:06:37,240
跟最重要的Bob的公要

1764
01:06:37,240 --> 01:06:39,240
然後再來

1765
01:06:39,240 --> 01:06:42,240
這一張憑證是由誰所簽發的

1766
01:06:42,240 --> 01:06:45,240
然後最後下面再配合一段簽章

1767
01:06:45,240 --> 01:06:48,240
那他怎麼做的

1768
01:06:48,240 --> 01:06:50,240
他會把前面這三個

1769
01:06:50,240 --> 01:06:52,240
上面這三個成份

1770
01:06:52,240 --> 01:06:54,240
過一個Hash

1771
01:06:54,240 --> 01:06:57,240
然後得到一個短的摘要

1772
01:06:57,240 --> 01:07:00,240
再來就是用簽章

1773
01:07:00,240 --> 01:07:02,240
我們剛剛講說簽章是類似於

1774
01:07:02,240 --> 01:07:05,240
你用私藥去做加密

1775
01:07:05,240 --> 01:07:09,240
這邊的話這個簽章是由CA來做的

1776
01:07:09,240 --> 01:07:13,240
由這個國家單位或是憑證機構

1777
01:07:13,240 --> 01:07:15,240
來幫你的公要背書

1778
01:07:15,240 --> 01:07:17,240
他用他的私藥去簽

1779
01:07:17,240 --> 01:07:19,240
得到了這個簽章

1780
01:07:19,240 --> 01:07:23,240
所以把這三個資訊欄

1781
01:07:23,240 --> 01:07:26,240
跟這一個簽章的附件

1782
01:07:26,240 --> 01:07:29,240
組合起來這就是一張完整的憑證

1783
01:07:29,240 --> 01:07:31,240
那這樣的憑證

1784
01:07:31,240 --> 01:07:32,240
收到的人會做什麼事

1785
01:07:32,240 --> 01:07:34,240
收到的人會一樣

1786
01:07:34,240 --> 01:07:36,240
把這三個資訊過Hash

1787
01:07:36,240 --> 01:07:37,240
然後並且

1788
01:07:37,240 --> 01:07:40,240
也就是去verify這個signature

1789
01:07:40,240 --> 01:07:41,240
去確認這個簽名

1790
01:07:41,240 --> 01:07:44,240
他們會用CA的公要

1791
01:07:44,240 --> 01:07:48,240
來去類似於去對這個簽章做解密

1792
01:07:48,240 --> 01:07:50,240
或是我們叫做確認簽名

1793
01:07:50,240 --> 01:07:51,240
得出來的是

1794
01:07:51,240 --> 01:07:55,240
這個Hash能夠做比對

1795
01:07:55,240 --> 01:08:00,240
這個會太複雜嗎

1796
01:08:00,240 --> 01:08:03,240
所以整體來說

1797
01:08:03,240 --> 01:08:06,240
這樣的就包含了說

1798
01:08:06,240 --> 01:08:09,240
應該說整件事情的關鍵在於

1799
01:08:09,240 --> 01:08:11,240
我們如何解決公要

1800
01:08:11,240 --> 01:08:13,240
事實上在外不可信的問題

1801
01:08:13,240 --> 01:08:16,240
他的解法其實非常的單純

1802
01:08:16,240 --> 01:08:18,240
我們就是找人幫我們背書

1803
01:08:18,240 --> 01:08:19,240
找人幫我們背書

1804
01:08:19,240 --> 01:08:22,240
誰有資格幫我們背書

1805
01:08:22,240 --> 01:08:23,240
誰有資格幫我們背書

1806
01:08:23,240 --> 01:08:24,240
我們

1807
01:08:24,240 --> 01:08:25,240
誰有資格幫我們背書的話

1808
01:08:25,240 --> 01:08:26,240
那個答案會是說

1809
01:08:26,240 --> 01:08:31,240
我們不會去懷疑他的公要

1810
01:08:31,240 --> 01:08:33,240
普通人的公要我們不信

1811
01:08:33,240 --> 01:08:35,240
有力人士的公要我們相信

1812
01:08:35,240 --> 01:08:36,240
關鍵就在這裡

1813
01:08:36,240 --> 01:08:41,240
他的解法就是這麼樣的單純

1814
01:08:41,240 --> 01:08:42,240
所以等於說再回來看到

1815
01:08:42,240 --> 01:08:43,240
這邊的關鍵是什麼

1816
01:08:43,240 --> 01:08:46,240
你明明就已經要證明公要

1817
01:08:46,240 --> 01:08:47,240
公要跟身份的關係了

1818
01:08:47,240 --> 01:08:49,240
為什麼你這邊可以用一個CA的公要

1819
01:08:49,240 --> 01:08:51,240
去確認這個簽名

1820
01:08:51,240 --> 01:08:52,240
原因很單純

1821
01:08:52,240 --> 01:08:53,240
因為CA是有力人士

1822
01:08:53,240 --> 01:08:55,240
我們不會去懷疑他的公要

1823
01:08:55,240 --> 01:08:58,240
就這樣而已

1824
01:08:58,240 --> 01:08:59,240
那當然來講

1825
01:08:59,240 --> 01:09:02,240
這樣的CA就會慢慢的構成

1826
01:09:02,240 --> 01:09:04,240
一個類似樹狀的結構

1827
01:09:04,240 --> 01:09:08,240
你可能有普通等級的有力人士

1828
01:09:08,240 --> 01:09:10,240
可能到什麼地方代表

1829
01:09:10,240 --> 01:09:12,240
往上一路到政府之類的

1830
01:09:12,240 --> 01:09:13,240
這樣子的情況

1831
01:09:13,240 --> 01:09:16,240
那可能就會最後停在一個

1832
01:09:16,240 --> 01:09:18,240
root CA這樣的一個機構

1833
01:09:18,240 --> 01:09:22,240
並且他的憑證是由自己來簽自己

1834
01:09:22,240 --> 01:09:27,240
因為他是最有力的人士

1835
01:09:27,240 --> 01:09:30,240
所以剛剛提的是比較簡化的情境

1836
01:09:30,240 --> 01:09:33,240
就是說我們剛剛所提到的憑證

1837
01:09:33,240 --> 01:09:37,240
大概是包含這幾個基本的資訊

1838
01:09:37,240 --> 01:09:38,240
實務上來講的話

1839
01:09:38,240 --> 01:09:42,240
現在流通比較常使用的憑證系統

1840
01:09:42,240 --> 01:09:45,240
都是叫做X.509這一套的憑證

1841
01:09:45,240 --> 01:09:48,240
那他現在是在第七版

1842
01:09:48,240 --> 01:09:50,240
簡單的講他的內容的話

1843
01:09:50,240 --> 01:09:54,240
左邊這個是他完整的憑證的資料結構

1844
01:09:54,240 --> 01:09:56,240
那他裡面會包含

1845
01:09:56,240 --> 01:09:57,240
很快的帶過

1846
01:09:57,240 --> 01:10:00,240
就是包含除了剛剛提到的那些簡易的話

1847
01:10:00,240 --> 01:10:01,240
包含他的版本號

1848
01:10:01,240 --> 01:10:03,240
然後可能他的證書號

1849
01:10:03,240 --> 01:10:05,240
或者是說他用哪些演算法

1850
01:10:05,240 --> 01:10:07,240
他是用哪些演算法做的憑證

1851
01:10:07,240 --> 01:10:09,240
因為有不同的演算法可以做

1852
01:10:09,240 --> 01:10:11,240
或者說他用哪一個演算法

1853
01:10:11,240 --> 01:10:13,240
跟哪一些參數等等的這些資訊

1854
01:10:13,240 --> 01:10:16,240
總之意思跟前面我們看到的製作憑證

1855
01:10:16,240 --> 01:10:19,240
確認憑證的那一套是類似的

1856
01:10:19,240 --> 01:10:22,240
那並且他也會有另外一個是叫做

1857
01:10:22,240 --> 01:10:24,240
叫做Revocation List

1858
01:10:24,240 --> 01:10:26,240
就是說你憑證會有效期

1859
01:10:26,240 --> 01:10:29,240
當然我們希望你過一陣子之後再去更新你的憑證

1860
01:10:29,240 --> 01:10:33,240
所以他會有一個憑證撤回的時候

1861
01:10:33,240 --> 01:10:35,240
他也需要留存做記錄

1862
01:10:35,240 --> 01:10:37,240
然後以後可以做集合

1863
01:10:37,240 --> 01:10:40,240
所以這樣的提這件事情的重點

1864
01:10:40,240 --> 01:10:42,240
是跟大家講說

1865
01:10:42,240 --> 01:10:44,240
現在來講最常使用的

1866
01:10:44,240 --> 01:10:46,240
不管是在怎麼樣的

1867
01:10:46,240 --> 01:10:49,240
Cloud的結構都會用這種叫做

1868
01:10:49,240 --> 01:10:51,240
公開基要基礎建設

1869
01:10:51,240 --> 01:10:53,240
叫做Infrastructure

1870
01:10:53,240 --> 01:10:54,240
或叫做Public Key Infrastructure

1871
01:10:54,240 --> 01:10:56,240
就是PKI這種東西

1872
01:10:56,240 --> 01:10:57,240
那這個東西的重點是什麼

1873
01:10:57,240 --> 01:10:59,240
我們這邊提供一個簡單的定義

1874
01:10:59,240 --> 01:11:01,240
就是說他可能是有硬體

1875
01:11:01,240 --> 01:11:04,240
有軟體、有人、有政策、有流程

1876
01:11:04,240 --> 01:11:06,240
但是他來做什麼呢

1877
01:11:06,240 --> 01:11:10,240
他會去建立、管理、儲存、派發

1878
01:11:10,240 --> 01:11:12,240
或者是去撤回憑證

1879
01:11:12,240 --> 01:11:14,240
這邊的重點是在於說

1880
01:11:14,240 --> 01:11:15,240
他整件事情

1881
01:11:15,240 --> 01:11:16,240
整個Public Key Infrastructure

1882
01:11:16,240 --> 01:11:19,240
他能夠去做認證的基礎

1883
01:11:19,240 --> 01:11:21,240
都建立在憑證上面

1884
01:11:21,240 --> 01:11:24,240
那下面這邊就是

1885
01:11:24,240 --> 01:11:26,240
下面這邊就是再多一些

1886
01:11:26,240 --> 01:11:28,240
包含說他的這個PKI裡面

1887
01:11:28,240 --> 01:11:29,240
有什麼樣的成員

1888
01:11:29,240 --> 01:11:34,240
成員可能就會有各個中端的實體

1889
01:11:34,240 --> 01:11:35,240
比方說像Bob

1890
01:11:35,240 --> 01:11:37,240
可能是系統裡面的成員

1891
01:11:37,240 --> 01:11:40,240
然後或是也會有我們剛剛講到的CA

1892
01:11:40,240 --> 01:11:42,240
那有CA之外呢

1893
01:11:42,240 --> 01:11:43,240
也有可能會有RA

1894
01:11:43,240 --> 01:11:45,240
RA是專門做註冊的

1895
01:11:45,240 --> 01:11:49,240
就是說剛剛在我們舉的例子裡面

1896
01:11:49,240 --> 01:11:51,240
我們人去譬如說戶政事務所辦

1897
01:11:51,240 --> 01:11:52,240
然後拿到那個身分證

1898
01:11:52,240 --> 01:11:56,240
之所以我們以後能夠用身分證暢行無阻

1899
01:11:56,240 --> 01:11:58,240
是因為我們在去辦的時候

1900
01:11:58,240 --> 01:11:59,240
他經過了嚴格的確認

1901
01:11:59,240 --> 01:12:01,240
確認你是正確的人

1902
01:12:01,240 --> 01:12:02,240
才頒發給你你的身分證

1903
01:12:02,240 --> 01:12:05,240
所以註冊的時候也是非常重要的一步

1904
01:12:05,240 --> 01:12:08,240
你當然不會希望說註冊的時候

1905
01:12:08,240 --> 01:12:11,240
可以輕易的把駭客X的身分

1906
01:12:11,240 --> 01:12:13,240
跟A的公要綁在一起

1907
01:12:13,240 --> 01:12:16,240
所以註冊也是另外一個難題

1908
01:12:16,240 --> 01:12:17,240
所以註冊有可能是會分開

1909
01:12:17,240 --> 01:12:19,240
另外一個RA來做

1910
01:12:19,240 --> 01:12:21,240
然後並且也會有憑證撤回

1911
01:12:21,240 --> 01:12:25,240
叫revocation list的管理

1912
01:12:25,240 --> 01:12:28,240
跟最後就是storage

1913
01:12:28,240 --> 01:12:32,240
那所以整個PKI大概會有類似這樣的架構

1914
01:12:32,240 --> 01:12:34,240
跟他的目的是在這裡

1915
01:12:34,240 --> 01:12:39,240
所以重點還是回到說

1916
01:12:39,240 --> 01:12:41,240
現在來講最常用的這些

1917
01:12:41,240 --> 01:12:42,240
特別是認證的手段

1918
01:12:42,240 --> 01:12:45,240
大部分都圍繞在這個憑證上面

1919
01:12:45,240 --> 01:12:51,240
好那所以到剛剛為止

1920
01:12:51,240 --> 01:12:55,240
到剛剛為止大概講了這個

1921
01:12:55,240 --> 01:12:59,240
我們大概是已經完成了四個安全的目標

1922
01:12:59,240 --> 01:13:04,240
那剛剛才講完的認證

1923
01:13:04,240 --> 01:13:06,240
我們有講了所謂有對稱式的

1924
01:13:06,240 --> 01:13:07,240
跟非對稱式的認證

1925
01:13:07,240 --> 01:13:10,240
再來的話我們要提的是

1926
01:13:10,240 --> 01:13:14,240
這邊先幫大家整理了我們前面所提過的

1927
01:13:14,240 --> 01:13:18,240
下面有四個我們前面提到的安全的目標

1928
01:13:18,240 --> 01:13:19,240
跟對應的做法

1929
01:13:19,240 --> 01:13:23,240
在保密性而言我們會利用加密

1930
01:13:23,240 --> 01:13:26,240
那可能包含了對稱跟非對稱式的加密

1931
01:13:26,240 --> 01:13:28,240
那資料完整性的話我們用雜湊函數

1932
01:13:28,240 --> 01:13:30,240
用來比對摘要是否一樣

1933
01:13:30,240 --> 01:13:31,240
來確認資料完整性

1934
01:13:31,240 --> 01:13:34,240
那這個認證的話

1935
01:13:34,240 --> 01:13:35,240
剛剛最後提的比較難一點

1936
01:13:35,240 --> 01:13:37,240
那我們會用對稱式的

1937
01:13:37,240 --> 01:13:39,240
我們會用這個訊息認證碼

1938
01:13:39,240 --> 01:13:41,240
或者是用非對稱式的時候

1939
01:13:41,240 --> 01:13:43,240
我們會用這個憑證來做

1940
01:13:43,240 --> 01:13:46,240
那不可否認性的話呢

1941
01:13:46,240 --> 01:13:48,240
就通常是依靠數位簽章

1942
01:13:48,240 --> 01:13:51,240
那值得注意的是說

1943
01:13:51,240 --> 01:13:53,240
這裡面大部分都會有牽涉到key

1944
01:13:53,240 --> 01:13:55,240
所以其實在我們在講

1945
01:13:55,240 --> 01:13:57,240
整套要去做密碼學的時候

1946
01:13:57,240 --> 01:14:00,240
也有一個種類的算法

1947
01:14:00,240 --> 01:14:01,240
是很常會被用到的

1948
01:14:01,240 --> 01:14:03,240
它都是跟金鑰有關

1949
01:14:03,240 --> 01:14:05,240
那我們這邊放叫key schemes

1950
01:14:05,240 --> 01:14:07,240
那接下來要講的就是其中一個

1951
01:14:07,240 --> 01:14:09,240
叫做share secret

1952
01:14:09,240 --> 01:14:13,240
所以在講share secret之前

1953
01:14:13,240 --> 01:14:15,240
我們要回顧一下前面所提到的

1954
01:14:15,240 --> 01:14:16,240
金鑰傳遞的問題

1955
01:14:16,240 --> 01:14:17,240
再一次呢

1956
01:14:17,240 --> 01:14:19,240
這個金鑰的傳遞問題是來自於說

1957
01:14:19,240 --> 01:14:22,240
你在要做正常的加密傳輸訊息的時候

1958
01:14:22,240 --> 01:14:25,240
我們會推薦使用對稱式的加密算法

1959
01:14:25,240 --> 01:14:27,240
比較快也很安全

1960
01:14:27,240 --> 01:14:29,240
但是它的致命的缺陷是在於說

1961
01:14:29,240 --> 01:14:31,240
你會需要有包含有金鑰的傳遞

1962
01:14:31,240 --> 01:14:34,240
所以前面講過了兩種解決

1963
01:14:34,240 --> 01:14:36,240
這個金鑰傳遞問題的方法

1964
01:14:36,240 --> 01:14:39,240
第一種是說你就單純的直接使用

1965
01:14:39,240 --> 01:14:41,240
非對稱式金鑰來做

1966
01:14:41,240 --> 01:14:43,240
那這個比較不推薦

1967
01:14:43,240 --> 01:14:44,240
因為你會變成

1968
01:14:44,240 --> 01:14:45,240
你會用複雜的算法

1969
01:14:45,240 --> 01:14:47,240
去算到大量的這個資料

1970
01:14:47,240 --> 01:14:49,240
那第二種我們提的是說

1971
01:14:49,240 --> 01:14:50,240
我們簡化一些

1972
01:14:50,240 --> 01:14:53,240
我們先用這個非對稱式的加密

1973
01:14:53,240 --> 01:14:55,240
來把鑰匙做加密

1974
01:14:55,240 --> 01:14:57,240
之後我們就用那把鑰匙

1975
01:14:57,240 --> 01:14:58,240
來做對稱式的溝通

1976
01:14:58,240 --> 01:15:01,240
那現在要講的這一種叫做

1977
01:15:01,240 --> 01:15:02,240
用金鑰交換的協定

1978
01:15:02,240 --> 01:15:05,240
那這個是其實是一種更快的做法

1979
01:15:05,240 --> 01:15:07,240
你只要有公司鑰就可以做

1980
01:15:07,240 --> 01:15:09,240
那大部分的

1981
01:15:09,240 --> 01:15:11,240
我們大部分的這種金鑰交換的協定

1982
01:15:11,240 --> 01:15:13,240
前面有提過

1983
01:15:13,240 --> 01:15:16,240
都是根源於一種叫Diffie-Hellman

1984
01:15:16,240 --> 01:15:19,240
是整套非對稱式密碼系統的始祖

1985
01:15:19,240 --> 01:15:22,240
所以我們這邊看的就是

1986
01:15:22,240 --> 01:15:23,240
Diffie-Hellman的結構

1987
01:15:23,240 --> 01:15:25,240
那大致上很簡單

1988
01:15:25,240 --> 01:15:26,240
它就是呢

1989
01:15:26,240 --> 01:15:28,240
A跟B各自有他們的公司鑰對

1990
01:15:28,240 --> 01:15:30,240
私鑰跟公鑰是成對的

1991
01:15:30,240 --> 01:15:33,240
所以A會有Secret Key of A

1992
01:15:33,240 --> 01:15:34,240
跟Public Key of A

1993
01:15:34,240 --> 01:15:35,240
這邊是SA跟PA

1994
01:15:35,240 --> 01:15:38,240
同樣的B會有SB跟PB

1995
01:15:38,240 --> 01:15:40,240
那按照道理

1996
01:15:40,240 --> 01:15:41,240
我們前面講過了

1997
01:15:41,240 --> 01:15:43,240
就是私鑰是絕對不會外洩

1998
01:15:43,240 --> 01:15:45,240
公鑰可以釋散在外

1999
01:15:45,240 --> 01:15:47,240
所以這邊的話呢

2000
01:15:47,240 --> 01:15:49,240
我們把PA交給B

2001
01:15:49,240 --> 01:15:51,240
把PB交給A

2002
01:15:51,240 --> 01:15:52,240
也只有這種選項了

2003
01:15:52,240 --> 01:15:55,240
就是你不會把私鑰系列的都交出去

2004
01:15:55,240 --> 01:15:57,240
所以你只會交公鑰

2005
01:15:57,240 --> 01:15:59,240
交了以後發生什麼事情呢

2006
01:15:59,240 --> 01:16:01,240
那A這邊這時候有SA跟PB

2007
01:16:01,240 --> 01:16:02,240
B這邊有SB跟PA

2008
01:16:02,240 --> 01:16:05,240
就是他們各自的私鑰

2009
01:16:05,240 --> 01:16:06,240
都保留得好好的

2010
01:16:06,240 --> 01:16:08,240
跟對方的公鑰

2011
01:16:08,240 --> 01:16:10,240
因為公鑰可以隨意取用

2012
01:16:10,240 --> 01:16:12,240
那很神奇的

2013
01:16:12,240 --> 01:16:14,240
因為數學上的設計的原因呢

2014
01:16:14,240 --> 01:16:17,240
你的SA去跟PB做Operation

2015
01:16:17,240 --> 01:16:18,240
得到的這一把G

2016
01:16:18,240 --> 01:16:22,240
會跟SB跟PAOperation

2017
01:16:22,240 --> 01:16:24,240
做出來的這一把G一模一樣

2018
01:16:24,240 --> 01:16:26,240
就很神奇的數學原因

2019
01:16:26,240 --> 01:16:29,240
造成了這一把得到的G是一樣的

2020
01:16:29,240 --> 01:16:30,240
也就是說

2021
01:16:30,240 --> 01:16:31,240
你只要有這樣子的成分

2022
01:16:31,240 --> 01:16:34,240
這兩個人就相當於有一把

2023
01:16:34,240 --> 01:16:35,240
一模一樣的Key

2024
01:16:35,240 --> 01:16:37,240
因此就可以開始做對稱式的

2025
01:16:37,240 --> 01:16:39,240
加密的傳輸

2026
01:16:39,240 --> 01:16:42,240
所以這邊再舉個例子

2027
01:16:42,240 --> 01:16:44,240
就是說這邊開始會有一些些

2028
01:16:44,240 --> 01:16:46,240
數學細節我們不會去提

2029
01:16:46,240 --> 01:16:47,240
但是最重要的是

2030
01:16:47,240 --> 01:16:48,240
希望大家可以藉由

2031
01:16:48,240 --> 01:16:49,240
類似圖像記憶的方式

2032
01:16:49,240 --> 01:16:51,240
只要知道結構就好

2033
01:16:51,240 --> 01:16:52,240
結構會是說

2034
01:16:52,240 --> 01:16:55,240
各自這個A跟B雙方

2035
01:16:55,240 --> 01:16:57,240
會有一些需要的演算法

2036
01:16:57,240 --> 01:16:59,240
需要的公開的參數

2037
01:16:59,240 --> 01:17:01,240
那A跟B

2038
01:17:01,240 --> 01:17:04,240
先會有產生他們的私鑰

2039
01:17:04,240 --> 01:17:05,240
在這裡SA跟XB

2040
01:17:05,240 --> 01:17:07,240
就相當於圖裡面的SA跟XB

2041
01:17:07,240 --> 01:17:11,240
藉由這個私鑰去產生公鑰

2042
01:17:11,240 --> 01:17:13,240
這邊用的是一個指數

2043
01:17:13,240 --> 01:17:15,240
然後再取Mode的這個做法

2044
01:17:15,240 --> 01:17:17,240
所以A跟B兩方都是

2045
01:17:17,240 --> 01:17:18,240
由SA產生PA

2046
01:17:18,240 --> 01:17:20,240
由XB產生PB

2047
01:17:20,240 --> 01:17:22,240
做好之後把公鑰交換

2048
01:17:22,240 --> 01:17:23,240
我們剛剛提過了

2049
01:17:23,240 --> 01:17:25,240
因為私鑰絕對不會交出去

2050
01:17:25,240 --> 01:17:27,240
所以你能交換的只有公鑰

2051
01:17:27,240 --> 01:17:28,240
把公鑰交換了之後

2052
01:17:28,240 --> 01:17:30,240
得到A得到B的公鑰

2053
01:17:30,240 --> 01:17:31,240
B得到A的公鑰

2054
01:17:31,240 --> 01:17:33,240
再來就是下一步我們講

2055
01:17:33,240 --> 01:17:35,240
就是因為神奇的數學的原因

2056
01:17:35,240 --> 01:17:37,240
所以會造成他們

2057
01:17:37,240 --> 01:17:38,240
做同樣的運算

2058
01:17:38,240 --> 01:17:41,240
所得到的這一把金鑰

2059
01:17:41,240 --> 01:17:42,240
是相同的

2060
01:17:42,240 --> 01:17:44,240
一模一樣的

2061
01:17:44,240 --> 01:17:47,240
這個數學大部分都是離散數學

2062
01:17:47,240 --> 01:17:49,240
大部分都是離散數學

2063
01:17:49,240 --> 01:17:52,240
像這一種就是

2064
01:17:52,240 --> 01:17:54,240
前面也講過說

2065
01:17:54,240 --> 01:17:56,240
大部分的非對稱式的演算法

2066
01:17:56,240 --> 01:17:58,240
都是有這樣子的Backbone在

2067
01:17:58,240 --> 01:18:00,240
就是基本都能做金鑰交換的協定

2068
01:18:00,240 --> 01:18:03,240
並且我們也提過

2069
01:18:03,240 --> 01:18:05,240
它的重點是在於說

2070
01:18:05,240 --> 01:18:07,240
你有公鑰的時候

2071
01:18:07,240 --> 01:18:10,240
基本是沒有辦法推回私鑰

2072
01:18:11,240 --> 01:18:13,240
那之所以為什麼沒有辦法

2073
01:18:13,240 --> 01:18:15,240
推回私鑰的原因是在於說

2074
01:18:15,240 --> 01:18:20,240
它一定是用到了某個數學難題

2075
01:18:20,240 --> 01:18:23,240
所以以離散對數而言

2076
01:18:23,240 --> 01:18:25,240
以Diffie-Hellman而言

2077
01:18:25,240 --> 01:18:28,240
它所用到的這個難題叫做

2078
01:18:28,240 --> 01:18:30,240
叫做離散對數

2079
01:18:30,240 --> 01:18:32,240
那它的具體來講是怎麼樣呢

2080
01:18:32,240 --> 01:18:34,240
就是說我們這邊看很簡單的數字裡

2081
01:18:34,240 --> 01:18:35,240
我們用很小的數字

2082
01:18:35,240 --> 01:18:36,240
我們用一個質數

2083
01:18:36,240 --> 01:18:38,240
有一個質數353

2084
01:18:38,240 --> 01:18:40,240
有一個質數的原根

2085
01:18:40,240 --> 01:18:44,240
這個是離散數學裡面會有

2086
01:18:44,240 --> 01:18:46,240
那簡單的來講就是

2087
01:18:46,240 --> 01:18:48,240
我們如果把

2088
01:18:48,240 --> 01:18:50,240
我們現在有一個原根3

2089
01:18:50,240 --> 01:18:52,240
我們把3的一次方

2090
01:18:52,240 --> 01:18:53,240
兩次方三次方

2091
01:18:53,240 --> 01:18:56,240
一路到353次方

2092
01:18:56,240 --> 01:19:00,240
3的一次方到353次方

2093
01:19:00,240 --> 01:19:03,240
然後都去Mod 353

2094
01:19:03,240 --> 01:19:06,240
它會以某種排列

2095
01:19:06,240 --> 01:19:09,240
完成1到353這個數字

2096
01:19:09,240 --> 01:19:13,240
並且只會各出現一次

2097
01:19:13,240 --> 01:19:15,240
用比較簡單的例子

2098
01:19:15,240 --> 01:19:17,240
假設有一個質數11

2099
01:19:17,240 --> 01:19:19,240
它有一個原根2

2100
01:19:19,240 --> 01:19:22,240
2的一次方Mod 11

2101
01:19:22,240 --> 01:19:24,240
然後2的二次方Mod 11

2102
01:19:24,240 --> 01:19:26,240
那一路這樣往上疊加到

2103
01:19:26,240 --> 01:19:30,240
2的11次方Mod 11

2104
01:19:30,240 --> 01:19:31,240
你得到的那個數字

2105
01:19:31,240 --> 01:19:35,240
它會以某種排列完成1到11

2106
01:19:35,240 --> 01:19:37,240
這就是原根

2107
01:19:37,240 --> 01:19:39,240
所以它的整個難題是建立在說

2108
01:19:39,240 --> 01:19:41,240
接下來我們看

2109
01:19:41,240 --> 01:19:44,240
A選了私藥97

2110
01:19:44,240 --> 01:19:46,240
B選了私藥233

2111
01:19:46,240 --> 01:19:49,240
這都是在合法的範圍裡面

2112
01:19:49,240 --> 01:19:50,240
因為要小於Q

2113
01:19:50,240 --> 01:19:51,240
小於353

2114
01:19:51,240 --> 01:19:54,240
那再來就是做公藥的這個過程

2115
01:19:54,240 --> 01:19:56,240
他們分別去取次方

2116
01:19:56,240 --> 01:19:57,240
像我們剛剛提的

2117
01:19:57,240 --> 01:19:59,240
把3的取97次方之後

2118
01:19:59,240 --> 01:20:02,240
Mod 353得到40

2119
01:20:02,240 --> 01:20:04,240
那B也去做它的公藥

2120
01:20:04,240 --> 01:20:07,240
它把算計算233次方之後

2121
01:20:07,240 --> 01:20:10,240
去Mod 353得到248

2122
01:20:10,240 --> 01:20:12,240
然後最後一步很神奇的

2123
01:20:12,240 --> 01:20:14,240
因為數學的原因

2124
01:20:14,240 --> 01:20:17,240
你把公藥再乘上私藥的次方

2125
01:20:17,240 --> 01:20:18,240
再去做Mod

2126
01:20:18,240 --> 01:20:20,240
這兩個會是完全一樣的

2127
01:20:20,240 --> 01:20:22,240
得到的會是160

2128
01:20:22,240 --> 01:20:24,240
這個事情的困難的點是在於說

2129
01:20:24,240 --> 01:20:26,240
我們要從私藥去計算公藥

2130
01:20:26,240 --> 01:20:29,240
相對很容易

2131
01:20:29,240 --> 01:20:32,240
我們這次是單純的把算術算完

2132
01:20:32,240 --> 01:20:33,240
然後去做Mod而已

2133
01:20:33,240 --> 01:20:34,240
這個容易

2134
01:20:34,240 --> 01:20:35,240
但是難是難在說

2135
01:20:35,240 --> 01:20:37,240
我今天告訴你40

2136
01:20:37,240 --> 01:20:39,240
你要怎麼樣能夠知道

2137
01:20:39,240 --> 01:20:41,240
是3的97次方Mod 353的

2138
01:20:41,240 --> 01:20:43,240
這個非常非常的困難

2139
01:20:43,240 --> 01:20:45,240
所以這是離散對數的難題

2140
01:20:45,240 --> 01:20:47,240
是類似這樣的意思

2141
01:20:47,240 --> 01:20:50,240
那大概有個感覺就可以了

2142
01:20:50,240 --> 01:20:51,240
那另外來講的話

2143
01:20:51,240 --> 01:20:53,240
這邊是橢圓曲線的版本

2144
01:20:53,240 --> 01:20:54,240
我們前面講過橢圓曲線

2145
01:20:54,240 --> 01:20:56,240
它也能夠做加解密

2146
01:20:56,240 --> 01:20:57,240
也能夠做千張

2147
01:20:57,240 --> 01:20:59,240
那也能夠做經驗交換

2148
01:20:59,240 --> 01:21:00,240
這邊就是

2149
01:21:00,240 --> 01:21:02,240
Elliptic Curve版的Diffie-Hellman

2150
01:21:02,240 --> 01:21:04,240
那它的細節也不用管

2151
01:21:04,240 --> 01:21:05,240
它的結構一樣

2152
01:21:05,240 --> 01:21:06,240
我會有公開的參數

2153
01:21:06,240 --> 01:21:10,240
A跟B先有他們的各自的私藥

2154
01:21:10,240 --> 01:21:12,240
從私藥生出公藥

2155
01:21:12,240 --> 01:21:13,240
然後把公藥做交換

2156
01:21:13,240 --> 01:21:15,240
最後神奇的數學得到他們

2157
01:21:15,240 --> 01:21:17,240
有一把共同的金鑰

2158
01:21:17,240 --> 01:21:21,240
一樣的

2159
01:21:21,240 --> 01:21:24,240
那所以有想要知道細節的話

2160
01:21:24,240 --> 01:21:25,240
或者是也可以

2161
01:21:25,240 --> 01:21:26,240
有很多資料可以查詢

2162
01:21:26,240 --> 01:21:28,240
或是要討論也都可以

2163
01:21:28,240 --> 01:21:32,240
那在關於這個Share Secret的部分

2164
01:21:32,240 --> 01:21:34,240
我們先暫時就談到這

2165
01:21:34,240 --> 01:21:35,240
那接下來的話

2166
01:21:35,240 --> 01:21:37,240
要進到的是Case Study

2167
01:21:37,240 --> 01:21:39,240
就是基本上是幫大家能夠複習一下

2168
01:21:39,240 --> 01:21:41,240
我們今天所提的所有東西

2169
01:21:41,240 --> 01:21:43,240
我們這邊用一個簡單的

2170
01:21:43,240 --> 01:21:45,240
簡單的生活中的範例

2171
01:21:45,240 --> 01:21:46,240
我們假設呢

2172
01:21:46,240 --> 01:21:50,240
假設今天我們手機的iOS要更新

2173
01:21:50,240 --> 01:21:52,240
那所以我們手機的iOS

2174
01:21:52,240 --> 01:21:53,240
要更新的時候呢

2175
01:21:53,240 --> 01:21:54,240
是從我們那是

2176
01:21:54,240 --> 01:21:56,240
由Apple送這個File來

2177
01:21:56,240 --> 01:21:58,240
所以這邊呢

2178
01:21:58,240 --> 01:22:00,240
我們要先做幾點假設

2179
01:22:00,240 --> 01:22:01,240
就是說第一個

2180
01:22:01,240 --> 01:22:02,240
我們認定呢

2181
01:22:02,240 --> 01:22:04,240
我們認定Apple不希望iOS File

2182
01:22:04,240 --> 01:22:06,240
輕易的外洩

2183
01:22:06,240 --> 01:22:08,240
它是指的是保密性

2184
01:22:08,240 --> 01:22:10,240
那我們這邊隱含的就是說

2185
01:22:10,240 --> 01:22:12,240
我們假定它是有加密過的File

2186
01:22:12,240 --> 01:22:14,240
加密過的iOS File傳過來

2187
01:22:14,240 --> 01:22:16,240
那當然呢

2188
01:22:16,240 --> 01:22:18,240
iOS File我們知道它的檔案

2189
01:22:18,240 --> 01:22:19,240
非常的龐大

2190
01:22:19,240 --> 01:22:21,240
所以就像我們一直在講的呢

2191
01:22:21,240 --> 01:22:22,240
只要是這種加密的傳輸呢

2192
01:22:22,240 --> 01:22:24,240
我們推薦使用的是對稱式的

2193
01:22:24,240 --> 01:22:26,240
這個加密的演算法

2194
01:22:26,240 --> 01:22:27,240
比較不會吃力

2195
01:22:27,240 --> 01:22:30,240
那所以為了你要能夠用對稱式的

2196
01:22:30,240 --> 01:22:31,240
加密演算法

2197
01:22:31,240 --> 01:22:33,240
那你就會需要有

2198
01:22:33,240 --> 01:22:35,240
你就會需要有那把對稱的Key

2199
01:22:35,240 --> 01:22:37,240
所以沒有一開始

2200
01:22:37,240 --> 01:22:39,240
當然我們跟Apple可能沒有對稱的

2201
01:22:39,240 --> 01:22:40,240
那把Key的時候

2202
01:22:40,240 --> 01:22:41,240
我們會做什麼

2203
01:22:41,240 --> 01:22:42,240
我們就可能可以用

2204
01:22:42,240 --> 01:22:43,240
剛剛所提到的Share Secret

2205
01:22:43,240 --> 01:22:45,240
去做一把Share Key出來

2206
01:22:45,240 --> 01:22:49,240
所以剛剛怎麼樣提到做Share Key呢

2207
01:22:49,240 --> 01:22:51,240
我們都是交換Public Key

2208
01:22:51,240 --> 01:22:53,240
我們這樣一路倒著回去

2209
01:22:53,240 --> 01:22:54,240
我們要做Share Key

2210
01:22:54,240 --> 01:22:56,240
我們必須要交換Public Key

2211
01:22:56,240 --> 01:22:57,240
就是表示我們各自有

2212
01:22:57,240 --> 01:22:58,240
我們各自的公要跟私要

2213
01:22:58,240 --> 01:23:01,240
並且我們拿公要出去跟別人交換

2214
01:23:01,240 --> 01:23:03,240
然後再經過神奇的數學運算

2215
01:23:03,240 --> 01:23:05,240
得到同樣一把共同的金鑰

2216
01:23:05,240 --> 01:23:06,240
問題又來了

2217
01:23:06,240 --> 01:23:07,240
這一把公要

2218
01:23:07,240 --> 01:23:09,240
怎麼樣知道能夠信

2219
01:23:09,240 --> 01:23:12,240
所以我們需要有那一把公要

2220
01:23:12,240 --> 01:23:15,240
跟那個公要持有人的身份

2221
01:23:15,240 --> 01:23:17,240
我們需要把這件事情綁定在一起

2222
01:23:17,240 --> 01:23:18,240
那就是我們照我們剛剛講的

2223
01:23:18,240 --> 01:23:20,240
用憑證

2224
01:23:20,240 --> 01:23:21,240
有憑證的機構

2225
01:23:21,240 --> 01:23:24,240
可以來幫我們做這件事情

2226
01:23:24,240 --> 01:23:26,240
所以這裡面至少會需要什麼呢

2227
01:23:26,240 --> 01:23:27,240
至少會需要說

2228
01:23:27,240 --> 01:23:30,240
Apple有一個由CA

2229
01:23:30,240 --> 01:23:34,240
由憑證機構所簽發的憑證

2230
01:23:34,240 --> 01:23:36,240
那我們要更新的User

2231
01:23:36,240 --> 01:23:40,240
我們可以用CA的公要

2232
01:23:40,240 --> 01:23:41,240
去Verify

2233
01:23:41,240 --> 01:23:44,240
去確認這個憑證

2234
01:23:44,240 --> 01:23:47,240
以得到正確的Apple的Public Key

2235
01:23:47,240 --> 01:23:48,240
得到Apple的Public Key

2236
01:23:48,240 --> 01:23:50,240
我們的Public Key之後

2237
01:23:50,240 --> 01:23:51,240
就可以做金鑰交換

2238
01:23:51,240 --> 01:23:53,240
就可以得到

2239
01:23:53,240 --> 01:23:55,240
就可以得到共同的一把金鑰

2240
01:23:55,240 --> 01:23:57,240
再來用這把共同的金鑰做加密

2241
01:23:57,240 --> 01:24:01,240
所以這樣一路倒著回去是這樣

2242
01:24:01,240 --> 01:24:02,240
那再來是到

2243
01:24:02,240 --> 01:24:04,240
收到了之後會需要什麼

2244
01:24:04,240 --> 01:24:05,240
收到了之後呢

2245
01:24:05,240 --> 01:24:07,240
我們會想要知道幾件事情

2246
01:24:07,240 --> 01:24:09,240
我們想要知道說

2247
01:24:09,240 --> 01:24:11,240
這個File是Apple送過來的

2248
01:24:11,240 --> 01:24:14,240
而且不是由別人所送過來的

2249
01:24:14,240 --> 01:24:15,240
並且呢

2250
01:24:15,240 --> 01:24:17,240
並且這個

2251
01:24:17,240 --> 01:24:19,240
我們收到的File的內容

2252
01:24:19,240 --> 01:24:20,240
經過竄改

2253
01:24:20,240 --> 01:24:22,240
跟Apple原本想傳的那個東西是一樣的

2254
01:24:22,240 --> 01:24:24,240
所以有這兩個條件呢

2255
01:24:24,240 --> 01:24:27,240
我們會要用到的是數位簽章

2256
01:24:27,240 --> 01:24:28,240
數位簽章能夠幫我們確認

2257
01:24:28,240 --> 01:24:31,240
只有擁有那個私鑰的人能夠簽

2258
01:24:31,240 --> 01:24:33,240
大家都可以確認

2259
01:24:33,240 --> 01:24:35,240
那並且因為你簽的東西

2260
01:24:35,240 --> 01:24:38,240
也包含了這個內容的摘要

2261
01:24:38,240 --> 01:24:40,240
所以內容經過竄改的時候

2262
01:24:40,240 --> 01:24:46,240
簽名就會變得不一樣

2263
01:24:46,240 --> 01:24:48,240
好那

2264
01:24:48,240 --> 01:24:49,240
再來的話

2265
01:24:49,240 --> 01:24:51,240
再來的話我們就畫幾個簡單的圖

2266
01:24:51,240 --> 01:24:54,240
所以剛剛講了這麼多呢

2267
01:24:54,240 --> 01:24:55,240
我們把整件事情

2268
01:24:55,240 --> 01:24:57,240
整個要完成iOS的更新

2269
01:24:57,240 --> 01:24:58,240
我們把它分成三個步驟

2270
01:24:58,240 --> 01:24:59,240
我們前面提過

2271
01:24:59,240 --> 01:25:02,240
我們需要得到正確的Apple的Public Key

2272
01:25:02,240 --> 01:25:04,240
這個怎麼做

2273
01:25:04,240 --> 01:25:05,240
我們會用到憑證

2274
01:25:05,240 --> 01:25:07,240
跟我們要想辦法

2275
01:25:07,240 --> 01:25:08,240
得到這個Apple的Public Key

2276
01:25:08,240 --> 01:25:09,240
正確的Public Key之後

2277
01:25:09,240 --> 01:25:11,240
我們就可以跑這個

2278
01:25:11,240 --> 01:25:12,240
金鑰交換的協定

2279
01:25:12,240 --> 01:25:14,240
得到一把共同的金鑰

2280
01:25:14,240 --> 01:25:16,240
再來是

2281
01:25:16,240 --> 01:25:17,240
再來是收到了

2282
01:25:17,240 --> 01:25:19,240
收到了加密過後的這個File之後

2283
01:25:19,240 --> 01:25:20,240
我們要確認它的來源

2284
01:25:20,240 --> 01:25:23,240
跟確認它的內容有沒有經過竄改

2285
01:25:23,240 --> 01:25:24,240
會用數位簽章

2286
01:25:24,240 --> 01:25:26,240
所以

2287
01:25:26,240 --> 01:25:28,240
所以首先是第一步

2288
01:25:28,240 --> 01:25:30,240
是要取得正確的Public Key

2289
01:25:30,240 --> 01:25:31,240
我會做什麼事情呢

2290
01:25:31,240 --> 01:25:32,240
大概會是這樣

2291
01:25:32,240 --> 01:25:34,240
A 把它的Public Key

2292
01:25:34,240 --> 01:25:38,240
它自己拿去找這個CA去做註冊

2293
01:25:38,240 --> 01:25:41,240
那註冊通過CA確認你是Apple

2294
01:25:41,240 --> 01:25:43,240
那你的Public Key也對了

2295
01:25:43,240 --> 01:25:45,240
它就頒發證書給你

2296
01:25:45,240 --> 01:25:46,240
這個證書就會有

2297
01:25:46,240 --> 01:25:48,240
這個Apple的ID

2298
01:25:48,240 --> 01:25:50,240
跟Apple的Public Key

2299
01:25:50,240 --> 01:25:52,240
然後並且是由

2300
01:25:52,240 --> 01:25:55,240
是由這個CA的私鑰所簽發的

2301
01:25:55,240 --> 01:25:57,240
那得到了

2302
01:25:57,240 --> 01:25:59,240
得到了這個憑證之後呢

2303
01:25:59,240 --> 01:26:02,240
Apple也就可以把這個憑證交給Bob

2304
01:26:02,240 --> 01:26:04,240
那Bob可以去確認這個憑證

2305
01:26:04,240 --> 01:26:07,240
他可以用這個CA的公鑰

2306
01:26:07,240 --> 01:26:09,240
因為我們不會懷疑它的公鑰

2307
01:26:09,240 --> 01:26:10,240
然後去對這個

2308
01:26:10,240 --> 01:26:11,240
去確認這個憑證

2309
01:26:11,240 --> 01:26:13,240
我們就得到正確的Apple ID

2310
01:26:13,240 --> 01:26:14,240
跟Public Key

2311
01:26:14,240 --> 01:26:16,240
我們就得到正確的Public Key

2312
01:26:16,240 --> 01:26:19,240
那下一步的話

2313
01:26:19,240 --> 01:26:22,240
再來就是一樣用這個金鑰交換協定

2314
01:26:22,240 --> 01:26:24,240
就是很神奇的呢

2315
01:26:24,240 --> 01:26:27,240
我們就有SAP、SB、PB之後

2316
01:26:27,240 --> 01:26:28,240
把PA跟PB交換

2317
01:26:28,240 --> 01:26:30,240
就得到了一把對稱的

2318
01:26:30,240 --> 01:26:32,240
然後並且是一樣的這個

2319
01:26:32,240 --> 01:26:34,240
完全一模一樣的這一把

2320
01:26:34,240 --> 01:26:36,240
共同金鑰機

2321
01:26:36,240 --> 01:26:37,240
前面再補充一點

2322
01:26:37,240 --> 01:26:38,240
就是說這邊指的是

2323
01:26:38,240 --> 01:26:41,240
這邊指的是取得了正確的

2324
01:26:41,240 --> 01:26:42,240
Apple的Public Key

2325
01:26:42,240 --> 01:26:43,240
但是等於說反過來

2326
01:26:43,240 --> 01:26:44,240
Bob也可以做這件事

2327
01:26:44,240 --> 01:26:47,240
也可以去得到他的這個憑證

2328
01:26:47,240 --> 01:26:49,240
然後把他的公鑰跟憑證

2329
01:26:49,240 --> 01:26:51,240
也一併交給Apple

2330
01:26:51,240 --> 01:26:53,240
所以這是雙向

2331
01:26:53,240 --> 01:26:55,240
那所以到這邊已經有了一把

2332
01:26:55,240 --> 01:26:56,240
共同的金鑰機

2333
01:26:56,240 --> 01:26:59,240
可以用來做對稱式的加密

2334
01:26:59,240 --> 01:27:01,240
加密了過後

2335
01:27:01,240 --> 01:27:03,240
我們把iOS File經過加密之後

2336
01:27:03,240 --> 01:27:05,240
變成這個問號的框框

2337
01:27:05,240 --> 01:27:08,240
我們把這個Sign過的這一個

2338
01:27:08,240 --> 01:27:11,240
我們要做Sign這一段

2339
01:27:11,240 --> 01:27:13,240
我們把加密過的這個File

2340
01:27:13,240 --> 01:27:15,240
進Hash得到摘要

2341
01:27:15,240 --> 01:27:18,240
然後我們用這個私鑰

2342
01:27:18,240 --> 01:27:20,240
用Apple用他自己的私鑰

2343
01:27:20,240 --> 01:27:23,240
去對這個Hash的Digest

2344
01:27:23,240 --> 01:27:24,240
去做簽章

2345
01:27:24,240 --> 01:27:28,240
那把這個簽章跟這個File

2346
01:27:28,240 --> 01:27:30,240
都傳到Bob手上的時候

2347
01:27:30,240 --> 01:27:32,240
那Bob也可以把這個

2348
01:27:32,240 --> 01:27:33,240
加密過的問號的框框

2349
01:27:33,240 --> 01:27:34,240
進到Hash

2350
01:27:34,240 --> 01:27:37,240
然後再來用Apple的公鑰

2351
01:27:37,240 --> 01:27:38,240
因為他有正確的公鑰

2352
01:27:38,240 --> 01:27:40,240
然後去Verify

2353
01:27:40,240 --> 01:27:41,240
Verify這個Signature

2354
01:27:41,240 --> 01:27:44,240
然後得到比對是不是一樣的

2355
01:27:44,240 --> 01:27:45,240
是的話就表示

2356
01:27:45,240 --> 01:27:47,240
這個File確實是正確的

2357
01:27:47,240 --> 01:27:48,240
沒有被修改

2358
01:27:48,240 --> 01:27:50,240
並且這個簽章是由Apple的

2359
01:27:50,240 --> 01:27:52,240
這個Private Key所簽的

2360
01:27:52,240 --> 01:27:58,240
好,到這邊這樣的流程有問題嗎

2361
01:27:58,240 --> 01:28:00,240
這樣基本上我們就跑完了

2362
01:28:00,240 --> 01:28:02,240
剛剛我們前面講到的情境

2363
01:28:02,240 --> 01:28:03,240
跟假設

2364
01:28:03,240 --> 01:28:09,240
好,那很快的就在最後

2365
01:28:09,240 --> 01:28:10,240
再帶一下結論

2366
01:28:10,240 --> 01:28:14,240
那整個要講這堂課的目的來講

2367
01:28:14,240 --> 01:28:17,240
最主要還是希望大家能夠了解

2368
01:28:17,240 --> 01:28:19,240
了解說到底Security在做什麼

2369
01:28:19,240 --> 01:28:23,240
那首先要再來回過頭來講的是

2370
01:28:23,240 --> 01:28:25,240
我們剛剛有一張表

2371
01:28:25,240 --> 01:28:28,240
看到的是有我們今天學過的

2372
01:28:28,240 --> 01:28:31,240
今天學過的四個安全的目標

2373
01:28:31,240 --> 01:28:33,240
然後再配上一個Key Scheme

2374
01:28:33,240 --> 01:28:35,240
那張圖如果各位還有印象的話

2375
01:28:35,240 --> 01:28:38,240
那現在這張表是一個更完整的補充

2376
01:28:38,240 --> 01:28:40,240
就是說到底總共來講

2377
01:28:40,240 --> 01:28:42,240
有哪一些這個密碼學相關的功能

2378
01:28:42,240 --> 01:28:45,240
所以前面有所謂的Block Cipher

2379
01:28:45,240 --> 01:28:46,240
跟Block Cipher Mode

2380
01:28:46,240 --> 01:28:47,240
這個其實都講的是加密

2381
01:28:47,240 --> 01:28:49,240
虛塊的加密

2382
01:28:49,240 --> 01:28:52,240
就是說以固定的長度為單位去做加密

2383
01:28:52,240 --> 01:28:54,240
以128-bit為單位

2384
01:28:54,240 --> 01:28:56,240
或以256-bit為單位去做加密

2385
01:28:56,240 --> 01:28:59,240
跟加密的不同的這個工作模式

2386
01:28:59,240 --> 01:29:01,240
這個有需要的話再補充就好

2387
01:29:01,240 --> 01:29:03,240
那並且也有做數位簽章

2388
01:29:03,240 --> 01:29:06,240
那再來是跟Key有關的

2389
01:29:06,240 --> 01:29:08,240
有像是KDF是說

2390
01:29:08,240 --> 01:29:11,240
如何用一把Key衍生出多個Key

2391
01:29:11,240 --> 01:29:12,240
這個很重要

2392
01:29:12,240 --> 01:29:15,240
因為我們不希望一把Key太常被重複利用

2393
01:29:15,240 --> 01:29:17,240
它的安全性自然就會降低

2394
01:29:17,240 --> 01:29:18,240
所以如何用一把Key

2395
01:29:18,240 --> 01:29:21,240
健康的去生出很多把也可以使用的Key

2396
01:29:21,240 --> 01:29:23,240
這是KDF在做的事情

2397
01:29:23,240 --> 01:29:25,240
那也會包含像Key Management的一個

2398
01:29:25,240 --> 01:29:28,240
這個演算法來講比較像是組合技

2399
01:29:28,240 --> 01:29:32,240
就是說它包含有像生成交換儲存使用等等

2400
01:29:32,240 --> 01:29:34,240
這樣一整套

2401
01:29:34,240 --> 01:29:37,240
那另外也有我們前面提過的

2402
01:29:37,240 --> 01:29:38,240
這個Message Authentication

2403
01:29:38,240 --> 01:29:40,240
就是訊息認證碼這種的

2404
01:29:40,240 --> 01:29:42,240
那或者是

2405
01:29:42,240 --> 01:29:45,240
我們也講過非常重要的

2406
01:29:45,240 --> 01:29:48,240
叫做亂數產生

2407
01:29:48,240 --> 01:29:50,240
那注意這邊講的這個亂數產生

2408
01:29:50,240 --> 01:29:53,240
指的都是用函數產生的那一種

2409
01:29:53,240 --> 01:29:55,240
就是叫Pseudo Random

2410
01:29:55,240 --> 01:29:56,240
或是在這邊

2411
01:29:56,240 --> 01:29:59,240
這個DRBG叫做Deterministic Random Bit Generator

2412
01:29:59,240 --> 01:30:01,240
就是說它是

2413
01:30:01,240 --> 01:30:03,240
基本上來講它就是可以重現的

2414
01:30:03,240 --> 01:30:04,240
它並不是真隨機的

2415
01:30:04,240 --> 01:30:05,240
就是我們

2416
01:30:05,240 --> 01:30:07,240
就像我們寫程式的時候會用的那種

2417
01:30:07,240 --> 01:30:09,240
比方說我們要Call一個Random的Function

2418
01:30:09,240 --> 01:30:11,240
然後我們去給它一個Seed

2419
01:30:11,240 --> 01:30:13,240
那這種Random的函數

2420
01:30:13,240 --> 01:30:15,240
都會是偽隨機的函數

2421
01:30:15,240 --> 01:30:18,240
那再來的話還有像Hashing

2422
01:30:18,240 --> 01:30:19,240
Secure Hashing

2423
01:30:19,240 --> 01:30:21,240
那我們前面提過的

2424
01:30:21,240 --> 01:30:23,240
就是如何確保資料完整性

2425
01:30:23,240 --> 01:30:25,240
我們會用Hash Function

2426
01:30:25,240 --> 01:30:26,240
主要使用Shark

2427
01:30:26,240 --> 01:30:28,240
那再來也是其他的組合技

2428
01:30:28,240 --> 01:30:29,240
包含說你

2429
01:30:29,240 --> 01:30:30,240
因為你的這個

2430
01:30:30,240 --> 01:30:31,240
橢圓曲線的密碼學

2431
01:30:31,240 --> 01:30:33,240
它能夠負擔很多功能

2432
01:30:33,240 --> 01:30:35,240
所以通常在Implement的時候

2433
01:30:35,240 --> 01:30:37,240
我們會真正會做到的事情

2434
01:30:37,240 --> 01:30:38,240
是比較像是去

2435
01:30:38,240 --> 01:30:39,240
做一個

2436
01:30:39,240 --> 01:30:41,240
專門來運算橢圓曲線的

2437
01:30:41,240 --> 01:30:43,240
數學的一個加速器

2438
01:30:43,240 --> 01:30:44,240
那至於說

2439
01:30:44,240 --> 01:30:46,240
你有那個橢圓曲線的算法

2440
01:30:46,240 --> 01:30:47,240
你有可以去

2441
01:30:47,240 --> 01:30:49,240
算這個橢圓曲線的點相乘

2442
01:30:49,240 --> 01:30:51,240
點相加這種的

2443
01:30:51,240 --> 01:30:53,240
那再來要怎麼樣做到像是

2444
01:30:53,240 --> 01:30:54,240
橢圓曲線千張

2445
01:30:54,240 --> 01:30:56,240
或是橢圓曲線的金鑰交換

2446
01:30:56,240 --> 01:30:58,240
那就是再把它組合起來

2447
01:30:58,240 --> 01:31:00,240
所以也會有個別的組件

2448
01:31:00,240 --> 01:31:01,240
這樣子

2449
01:31:01,240 --> 01:31:03,240
所以這樣子的表格

2450
01:31:03,240 --> 01:31:05,240
大概就是實際上

2451
01:31:05,240 --> 01:31:07,240
在演算法認證的時候

2452
01:31:07,240 --> 01:31:09,240
會要去做的事情

2453
01:31:09,240 --> 01:31:11,240
那

2454
01:31:11,240 --> 01:31:13,240
對,所以

2455
01:31:13,240 --> 01:31:15,240
快要總結了

2456
01:31:15,240 --> 01:31:17,240
那

2457
01:31:17,240 --> 01:31:19,240
所以到底Path

2458
01:31:19,240 --> 01:31:20,240
或是Leewang跟Samba

2459
01:31:20,240 --> 01:31:22,240
到底跟這個有什麼樣的關係

2460
01:31:22,240 --> 01:31:24,240
所以這邊我們回顧一下

2461
01:31:24,240 --> 01:31:25,240
用一張很簡單的圖

2462
01:31:25,240 --> 01:31:27,240
回顧一下今天所提的內容

2463
01:31:27,240 --> 01:31:28,240
我們就有提到說

2464
01:31:28,240 --> 01:31:29,240
有不同的這個

2465
01:31:29,240 --> 01:31:30,240
不同的安全的目標嘛

2466
01:31:30,240 --> 01:31:32,240
然後跟有各式各樣的做法

2467
01:31:32,240 --> 01:31:34,240
那可以從這張圖上面

2468
01:31:34,240 --> 01:31:35,240
看到的是說

2469
01:31:35,240 --> 01:31:37,240
大部分我們要

2470
01:31:37,240 --> 01:31:39,240
為了要達到安全的目標

2471
01:31:39,240 --> 01:31:41,240
我們都會需要用到

2472
01:31:41,240 --> 01:31:43,240
我們都會需要用到的是有

2473
01:31:43,240 --> 01:31:45,240
有這個算法

2474
01:31:45,240 --> 01:31:47,240
就是密碼學的運算

2475
01:31:47,240 --> 01:31:49,240
跟金鑰

2476
01:31:49,240 --> 01:31:50,240
那前面我們也

2477
01:31:50,240 --> 01:31:52,240
很多次提到就是說

2478
01:31:52,240 --> 01:31:53,240
整個系統的安全

2479
01:31:53,240 --> 01:31:55,240
會建立在金鑰上面

2480
01:31:55,240 --> 01:31:56,240
金鑰是我們假設

2481
01:31:56,240 --> 01:31:58,240
絕對不能外洩的

2482
01:31:58,240 --> 01:31:59,240
那

2483
01:31:59,240 --> 01:32:00,240
再來呢

2484
01:32:00,240 --> 01:32:01,240
再來

2485
01:32:01,240 --> 01:32:02,240
所以因為

2486
01:32:02,240 --> 01:32:03,240
因為這些運算

2487
01:32:03,240 --> 01:32:04,240
或運作裡面

2488
01:32:04,240 --> 01:32:05,240
安全的運作裡面

2489
01:32:05,240 --> 01:32:07,240
大部分都會牽涉到

2490
01:32:07,240 --> 01:32:09,240
演算法或是金鑰

2491
01:32:09,240 --> 01:32:10,240
那並且

2492
01:32:10,240 --> 01:32:13,240
並且安全性是建立在金鑰上面

2493
01:32:13,240 --> 01:32:15,240
而並非演算法

2494
01:32:15,240 --> 01:32:17,240
我這邊指的並非演算法的意思是說

2495
01:32:17,240 --> 01:32:18,240
因為我們要能夠

2496
01:32:18,240 --> 01:32:19,240
互相做溝通的時候

2497
01:32:19,240 --> 01:32:20,240
我們用的演算法

2498
01:32:20,240 --> 01:32:21,240
會是統一的規格

2499
01:32:21,240 --> 01:32:23,240
或是會是某一種

2500
01:32:23,240 --> 01:32:25,240
大家都可以接受的標準

2501
01:32:25,240 --> 01:32:26,240
才能夠互相溝通

2502
01:32:26,240 --> 01:32:27,240
這應該可以理解

2503
01:32:27,240 --> 01:32:28,240
也因此

2504
01:32:28,240 --> 01:32:29,240
我們必須要能夠

2505
01:32:29,240 --> 01:32:31,240
我們必須要假設

2506
01:32:31,240 --> 01:32:32,240
攻擊你的這些駭客

2507
01:32:32,240 --> 01:32:34,240
他也相當的熟悉你的系統

2508
01:32:34,240 --> 01:32:35,240
熟悉你的演算法

2509
01:32:35,240 --> 01:32:37,240
唯一不知道的只有金鑰

2510
01:32:37,240 --> 01:32:39,240
這個大家可以接受嗎

2511
01:32:39,240 --> 01:32:40,240
可以

2512
01:32:40,240 --> 01:32:41,240
那

2513
01:32:41,240 --> 01:32:42,240
那

2514
01:32:42,240 --> 01:32:43,240
所以接下來呢

2515
01:32:43,240 --> 01:32:44,240
就是說

2516
01:32:44,240 --> 01:32:45,240
整個整個

2517
01:32:45,240 --> 01:32:47,240
既然整個安全性都建立在金鑰上面

2518
01:32:47,240 --> 01:32:49,240
那保護這把金鑰

2519
01:32:49,240 --> 01:32:50,240
當然相當的重要

2520
01:32:50,240 --> 01:32:52,240
所以我們把剛剛的流程

2521
01:32:52,240 --> 01:32:53,240
再經過簡化

2522
01:32:53,240 --> 01:32:55,240
剛剛的我們大概都只看到

2523
01:32:55,240 --> 01:32:56,240
有Data

2524
01:32:56,240 --> 01:32:57,240
然後有Crypto Engine

2525
01:32:57,240 --> 01:32:59,240
就是像AES或是ECC

2526
01:32:59,240 --> 01:33:00,240
這種這種block

2527
01:33:00,240 --> 01:33:01,240
這種operation

2528
01:33:01,240 --> 01:33:03,240
然後得到了Cypher

2529
01:33:03,240 --> 01:33:04,240
或是得到密文

2530
01:33:04,240 --> 01:33:05,240
或是他的output

2531
01:33:05,240 --> 01:33:07,240
剛剛我們大概都只在看這一段

2532
01:33:07,240 --> 01:33:09,240
那現在因為有Key加入了

2533
01:33:09,240 --> 01:33:11,240
那我們我們前面也會包含

2534
01:33:11,240 --> 01:33:13,240
有Key的產生

2535
01:33:13,240 --> 01:33:14,240
跟Key的儲存

2536
01:33:14,240 --> 01:33:15,240
這個很自然

2537
01:33:15,240 --> 01:33:17,240
我們先產生了一把Key

2538
01:33:17,240 --> 01:33:18,240
然後存

2539
01:33:18,240 --> 01:33:20,240
把它妥善的存好

2540
01:33:20,240 --> 01:33:21,240
需要的時候

2541
01:33:21,240 --> 01:33:23,240
需要的時候把它叫來使用

2542
01:33:23,240 --> 01:33:24,240
在Crypto Engine裡面

2543
01:33:24,240 --> 01:33:26,240
然後就可以把這個Data

2544
01:33:26,240 --> 01:33:27,240
進到Crypto Engine

2545
01:33:27,240 --> 01:33:28,240
得到Cypher

2546
01:33:28,240 --> 01:33:29,240
那

2547
01:33:29,240 --> 01:33:31,240
所以當然跟Key最重要的

2548
01:33:31,240 --> 01:33:33,240
就是這三步了

2549
01:33:33,240 --> 01:33:35,240
那我們這三步等於說是

2550
01:33:35,240 --> 01:33:37,240
基本上是錨定整個裝置

2551
01:33:37,240 --> 01:33:39,240
或是整個晶片的安全

2552
01:33:39,240 --> 01:33:41,240
所以我們把一般把這樣子的

2553
01:33:41,240 --> 01:33:42,240
這樣子的

2554
01:33:42,240 --> 01:33:44,240
負責這樣子的功能的

2555
01:33:44,240 --> 01:33:46,240
這個Unit

2556
01:33:46,240 --> 01:33:47,240
叫做Rule of Trust

2557
01:33:47,240 --> 01:33:48,240
叫做信任根

2558
01:33:48,240 --> 01:33:51,240
到這邊可以接受的話

2559
01:33:51,240 --> 01:33:52,240
那接下來

2560
01:33:52,240 --> 01:33:54,240
剩下的問題就很簡單了

2561
01:33:54,240 --> 01:33:56,240
就像前面看到的

2562
01:33:56,240 --> 01:33:57,240
第一二三

2563
01:33:57,240 --> 01:33:59,240
我們現在就是問這三個問題說

2564
01:33:59,240 --> 01:34:02,240
怎麼樣能夠產生Secret Key

2565
01:34:02,240 --> 01:34:04,240
第二個是怎麼樣能夠儲存Secret Key

2566
01:34:04,240 --> 01:34:06,240
第三個是怎麼樣

2567
01:34:06,240 --> 01:34:08,240
怎麼樣安全的使用這些Key

2568
01:34:08,240 --> 01:34:10,240
用來做密碼學的運算

2569
01:34:10,240 --> 01:34:12,240
那這三個問題

2570
01:34:12,240 --> 01:34:13,240
分別都有它的簡答

2571
01:34:13,240 --> 01:34:15,240
就是說怎麼樣產生Key

2572
01:34:15,240 --> 01:34:16,240
我們用自成變異

2573
01:34:16,240 --> 01:34:18,240
我們常常講的晶片指紋

2574
01:34:18,240 --> 01:34:20,240
到這邊大家應該可以開始感受到

2575
01:34:20,240 --> 01:34:21,240
接下來要說什麼

2576
01:34:21,240 --> 01:34:23,240
那我們要怎麼樣能夠安全的儲存Key

2577
01:34:23,240 --> 01:34:25,240
我們把這個Rule of Trust

2578
01:34:25,240 --> 01:34:26,240
讓它配備有

2579
01:34:26,240 --> 01:34:29,240
配備有靜態跟動態的Entropy

2580
01:34:29,240 --> 01:34:32,240
就是配備有靜態跟動態的商源

2581
01:34:32,240 --> 01:34:34,240
那再來最後一個是

2582
01:34:34,240 --> 01:34:35,240
我們要怎麼樣

2583
01:34:35,240 --> 01:34:36,240
我們要怎麼樣

2584
01:34:36,240 --> 01:34:38,240
能夠安全的讓Key

2585
01:34:38,240 --> 01:34:40,240
用在這個密碼學的運作裡面

2586
01:34:41,240 --> 01:34:44,240
那就是我們把這個Rule of Trust的單元

2587
01:34:44,240 --> 01:34:45,240
我們再給它配備

2588
01:34:45,240 --> 01:34:47,240
密碼學演算法

2589
01:34:47,240 --> 01:34:49,240
的目的在於說

2590
01:34:49,240 --> 01:34:51,240
如果今天所有安全功能

2591
01:34:51,240 --> 01:34:53,240
都執行在一個固定的邊界裡面

2592
01:34:53,240 --> 01:34:56,240
它就不會有比方說

2593
01:34:56,240 --> 01:34:59,240
Key或是未加密的重要資料

2594
01:34:59,240 --> 01:35:01,240
在Bus上面流傳

2595
01:35:01,240 --> 01:35:02,240
這樣子的狀況

2596
01:35:02,240 --> 01:35:05,240
它可以安全的鎖在一個邊界裡面

2597
01:35:05,240 --> 01:35:08,240
那這三個問題的答案

2598
01:35:08,240 --> 01:35:09,240
對應過來就是

2599
01:35:09,240 --> 01:35:11,240
怎麼樣產生Key NeoPub

2600
01:35:11,240 --> 01:35:13,240
怎麼樣安全的儲存Key用PubRT

2601
01:35:13,240 --> 01:35:14,240
我們前面講過PubRT

2602
01:35:14,240 --> 01:35:17,240
有Dynamic跟Static的Entropy

2603
01:35:17,240 --> 01:35:19,240
就是說你這邊有Secure的OTP

2604
01:35:19,240 --> 01:35:21,240
跟你另外有TRNG

2605
01:35:21,240 --> 01:35:23,240
可以產生真隨機的亂數給你使用

2606
01:35:23,240 --> 01:35:25,240
怎麼樣安全的用Key

2607
01:35:25,240 --> 01:35:27,240
在這個密碼學的運作裡面

2608
01:35:27,240 --> 01:35:29,240
我們把這個PubRT的單元

2609
01:35:29,240 --> 01:35:32,240
外面再掛上其他的演算法

2610
01:35:32,240 --> 01:35:33,240
所有安全功能

2611
01:35:33,240 --> 01:35:35,240
都會執行在這個邊界裡面

2612
01:35:35,240 --> 01:35:36,240
然後你這個邊界

2613
01:35:36,240 --> 01:35:38,240
它另外採集到Bus上面去

2614
01:35:38,240 --> 01:35:41,240
所以不會有任何禁藥

2615
01:35:41,240 --> 01:35:44,240
什麼資料在外面流通這樣的問題

2616
01:35:44,240 --> 01:35:46,240
所以三個問題對應三個答案

2617
01:35:46,240 --> 01:35:47,240
這個我想

2618
01:35:47,240 --> 01:35:49,240
今天如果大家能夠帶走這個

2619
01:35:49,240 --> 01:35:50,240
多少會有點幫助

2620
01:35:50,240 --> 01:35:52,240
今天的內容大概就到這邊

2621
01:35:52,240 --> 01:35:53,240
謝謝大家

2622
01:35:53,240 --> 01:35:54,240
謝謝大家