whisper-small

1
00:00:00,000 --> 00:00:02,000
我们就开始吧

2
00:00:02,000 --> 00:00:04,000
我们就开始吧

3
00:00:04,000 --> 00:00:06,000
我们就开始吧

4
00:00:06,000 --> 00:00:08,000
我们就开始吧

5
00:00:08,000 --> 00:00:10,000
我们就开始吧

6
00:00:10,000 --> 00:00:12,000
我们就开始吧

7
00:00:12,000 --> 00:00:14,000
我们就开始吧

8
00:00:14,000 --> 00:00:16,000
我们就开始吧

9
00:00:16,000 --> 00:00:18,000
我们就开始吧

10
00:00:18,000 --> 00:00:20,000
我们就开始吧

11
00:00:20,000 --> 00:00:22,000
我们就开始吧

12
00:00:22,000 --> 00:00:24,000
我们就开始吧

13
00:00:24,000 --> 00:00:26,000
我们就开始吧

14
00:00:26,000 --> 00:00:28,000
我们就开始吧

15
00:00:28,000 --> 00:00:30,000
以目前来讲的话

16
00:00:30,000 --> 00:00:32,000
我们就先把它当作是

17
00:00:32,000 --> 00:00:34,000
有一把保管好的Key

18
00:00:34,000 --> 00:00:36,000
所以这个Key外面有一个矿矿

19
00:00:36,000 --> 00:00:38,000
那再来的话

20
00:00:38,000 --> 00:00:40,000
第二个是叫AES

21
00:00:40,000 --> 00:00:42,000
AES图像上的话

22
00:00:42,000 --> 00:00:44,000
大家可以看到它是有一个蓝色的大写A

23
00:00:44,000 --> 00:00:46,000
然后经过了蓝色的箭头

24
00:00:46,000 --> 00:00:48,000
到这个AES的block里面

25
00:00:48,000 --> 00:00:50,000
然后并且有一把

26
00:00:50,000 --> 00:00:52,000
这个钥匙从上面加入

27
00:00:52,000 --> 00:00:54,000
然后最后得到的Output是

28
00:00:54,000 --> 00:00:56,000
大写的Aprime

29
00:00:56,000 --> 00:00:58,000
我们用这样的意象

30
00:00:58,000 --> 00:01:00,000
想要讲的是

31
00:01:00,000 --> 00:01:02,000
它是一个加密的过程

32
00:01:02,000 --> 00:01:04,000
就是从原本的形态A

33
00:01:04,000 --> 00:01:06,000
然后转成变成是Aprime

34
00:01:06,000 --> 00:01:08,000
同样的这个AES的block

35
00:01:08,000 --> 00:01:10,000
也能够支援的是说

36
00:01:10,000 --> 00:01:12,000
它能够返回来做

37
00:01:12,000 --> 00:01:14,000
把原本的Aprime的block

38
00:01:14,000 --> 00:01:16,000
然后一样是进到这个AES

39
00:01:16,000 --> 00:01:18,000
走绿色的箭头

40
00:01:18,000 --> 00:01:20,000
并且也加入了同样的一把黄色的Key

41
00:01:20,000 --> 00:01:22,000
然后它会得到的Output是

42
00:01:22,000 --> 00:01:24,000
还原能够还原回来

43
00:01:24,000 --> 00:01:26,000
所以它就能够返回来做

44
00:01:26,000 --> 00:01:28,000
它可以返回来做

45
00:01:28,000 --> 00:01:30,000
它可以返回来做

46
00:01:30,000 --> 00:01:32,000
它可以返回来做

47
00:01:32,000 --> 00:01:34,000
它可以返回来做

48
00:01:34,000 --> 00:01:36,000
它可以返回来做

49
00:01:36,000 --> 00:01:38,000
它可以返回来做

50
00:01:38,000 --> 00:01:40,000
它可以返回来做

51
00:01:40,000 --> 00:01:42,000
它可以返回来做

52
00:01:42,000 --> 00:01:44,000
它可以返回来做

53
00:01:44,000 --> 00:01:46,000
它可以返回来做

54
00:01:46,000 --> 00:01:48,000
它可以返回来做

55
00:01:48,000 --> 00:01:50,000
它可以返回来做

56
00:01:50,000 --> 00:01:52,000
它可以返回来做

57
00:01:52,000 --> 00:01:54,000
叫施药的这个写S的这一把

58
00:01:54,000 --> 00:01:56,000
进到这个EZC的block之后

59
00:01:56,000 --> 00:01:58,000
它能够出来的是一个

60
00:01:58,000 --> 00:02:00,000
黄色的Public Key这个公药

61
00:02:00,000 --> 00:02:02,000
并且这个动作

62
00:02:02,000 --> 00:02:04,000
它是无法还原的

63
00:02:04,000 --> 00:02:06,000
就是你从公药

64
00:02:06,000 --> 00:02:08,000
你知道公药是没有办法

65
00:02:08,000 --> 00:02:10,000
还原回施药的

66
00:02:10,000 --> 00:02:12,000
所以它的黄色箭头

67
00:02:12,000 --> 00:02:14,000
回来的箭头这边打了茶

68
00:02:14,000 --> 00:02:16,000
这个是还蛮重要的

69
00:02:16,000 --> 00:02:18,000
所以它基本上可以想成是

70
00:02:18,000 --> 00:02:20,000
由从一把施药

71
00:02:20,000 --> 00:02:22,000
另外一把公药的过程

72
00:02:22,000 --> 00:02:24,000
好,那再来是最下面的

73
00:02:24,000 --> 00:02:26,000
这个叫Hash,那这个Hash

74
00:02:26,000 --> 00:02:28,000
相信其实它不只在密码

75
00:02:28,000 --> 00:02:30,000
学里面会出现,在其他很多

76
00:02:30,000 --> 00:02:32,000
资讯科学里面也会用得到

77
00:02:32,000 --> 00:02:34,000
那这个的话我们给它的意向是说

78
00:02:34,000 --> 00:02:36,000
它是有一个大写A

79
00:02:36,000 --> 00:02:38,000
然后进到这个像果汁机的

80
00:02:38,000 --> 00:02:40,000
这个达到函数,就是这个东西

81
00:02:40,000 --> 00:02:42,000
然后它得到的Output是一个小写A

82
00:02:42,000 --> 00:02:44,000
在这边我们用小写

83
00:02:44,000 --> 00:02:46,000
主要是想要描述说

84
00:02:46,000 --> 00:02:48,000
它是类似一个压缩成一个摘药的这样的过程

85
00:02:48,000 --> 00:02:50,000
同时这个Hash这个果汁机

86
00:02:50,000 --> 00:02:52,000
我们都知道打成果汁之中

87
00:02:52,000 --> 00:02:54,000
也是没有办法还原回水果的

88
00:02:54,000 --> 00:02:56,000
所以它在这边是一个单向的

89
00:02:56,000 --> 00:02:58,000
一个函数,然后并且无法

90
00:02:58,000 --> 00:03:00,000
从Output倒回Input这样

91
00:03:00,000 --> 00:03:04,000
所以这边这一些简单的定义

92
00:03:04,000 --> 00:03:06,000
就是希望大家能够先有一个

93
00:03:06,000 --> 00:03:08,000
印象就好,那

94
00:03:08,000 --> 00:03:10,000
接下来的内容也会跟这些

95
00:03:10,000 --> 00:03:14,000
慢慢会知道说这些定义

96
00:03:14,000 --> 00:03:16,000
跟接下来的内容有什么样的相关

97
00:03:18,000 --> 00:03:20,000
好,那在这边的话

98
00:03:20,000 --> 00:03:23,000
我们今天要谈的是密码学这件事情

99
00:03:23,000 --> 00:03:25,000
密码学这件事情的话

100
00:03:25,000 --> 00:03:27,000
简单的来分类的话

101
00:03:27,000 --> 00:03:30,000
它大概其实是几种不同的目标

102
00:03:30,000 --> 00:03:32,000
那这边的话,其实总共列了

103
00:03:32,000 --> 00:03:35,000
有五个黄色的格子,可是它其实只有四种

104
00:03:35,000 --> 00:03:37,000
那一种一种开始讲的话

105
00:03:37,000 --> 00:03:38,000
那第一个我们会看到是

106
00:03:38,000 --> 00:03:40,000
左边A这边它有

107
00:03:40,000 --> 00:03:42,000
它这边有叫Confidentiality

108
00:03:42,000 --> 00:03:44,000
叫保密性,并且它这边

109
00:03:44,000 --> 00:03:46,000
是画了一个图是说它有

110
00:03:46,000 --> 00:03:48,000
资料存在身上

111
00:03:48,000 --> 00:03:50,000
那当然我们希望资料保密

112
00:03:50,000 --> 00:03:52,000
但是这个保密它其实会分

113
00:03:52,000 --> 00:03:54,000
两种情境,一种是说

114
00:03:54,000 --> 00:03:56,000
资料在静态除存的时候

115
00:03:56,000 --> 00:03:58,000
我们希望它不会被投走

116
00:03:58,000 --> 00:04:00,000
希望不会有别人知道这个内容

117
00:04:00,000 --> 00:04:02,000
那另外一种是说

118
00:04:02,000 --> 00:04:04,000
在传输的过程中

119
00:04:04,000 --> 00:04:06,000
我们希望它也能够保持隐秘

120
00:04:06,000 --> 00:04:08,000
就是不会有我们

121
00:04:08,000 --> 00:04:11,000
不想要的接收方去收到

122
00:04:11,000 --> 00:04:14,000
这样,所以它大概是说

123
00:04:14,000 --> 00:04:16,000
如果你今天在

124
00:04:16,000 --> 00:04:18,000
传输讯息的过程中

125
00:04:18,000 --> 00:04:20,000
你传的是一个叫做Plain Text

126
00:04:20,000 --> 00:04:22,000
名文这样的形式的话

127
00:04:22,000 --> 00:04:24,000
那当然很容易

128
00:04:24,000 --> 00:04:26,000
这个communication的通道

129
00:04:26,000 --> 00:04:28,000
就会被切停或者被切取

130
00:04:28,000 --> 00:04:31,000
所以这个是保密性的这件事情

131
00:04:31,000 --> 00:04:32,000
这个目标

132
00:04:32,000 --> 00:04:34,000
那第二个我们看到的是

133
00:04:34,000 --> 00:04:36,000
这边写的叫做Data Integrity

134
00:04:36,000 --> 00:04:37,000
叫做资料完整性

135
00:04:37,000 --> 00:04:39,000
这个资料完整性的话

136
00:04:39,000 --> 00:04:40,000
简单的讲是说

137
00:04:40,000 --> 00:04:42,000
我要如何确定

138
00:04:42,000 --> 00:04:44,000
我要如何确定我的讯息

139
00:04:44,000 --> 00:04:46,000
或是资料没有被篡改

140
00:04:46,000 --> 00:04:47,000
那没有被篡改

141
00:04:47,000 --> 00:04:49,000
就表示它保持完整原样

142
00:04:49,000 --> 00:04:51,000
那这个的话

143
00:04:51,000 --> 00:04:54,000
一个很简单的例子是说

144
00:04:54,000 --> 00:04:56,000
假设我们现在把我们

145
00:04:56,000 --> 00:04:58,000
自己电脑里面的资料

146
00:04:58,000 --> 00:04:59,000
然后去上传到

147
00:04:59,000 --> 00:05:00,000
比方说云段硬碟

148
00:05:00,000 --> 00:05:02,000
那我们上传

149
00:05:02,000 --> 00:05:03,000
我们上传一段时间之后

150
00:05:03,000 --> 00:05:04,000
过一阵子

151
00:05:04,000 --> 00:05:06,000
我们要再把它拿下来

152
00:05:06,000 --> 00:05:08,000
那我们如何能够知道说

153
00:05:08,000 --> 00:05:10,000
我们拿下来的资料是正确的

154
00:05:10,000 --> 00:05:11,000
没有被改过的

155
00:05:11,000 --> 00:05:13,000
这个是资料完整性的意思

156
00:05:13,000 --> 00:05:16,000
那它所面临的威胁就是说

157
00:05:16,000 --> 00:05:19,000
有可能在传输的过程中

158
00:05:19,000 --> 00:05:21,000
然后有恶意的这个第三方

159
00:05:21,000 --> 00:05:22,000
会去伪造

160
00:05:22,000 --> 00:05:24,000
或者是篡改这样的讯息

161
00:05:24,000 --> 00:05:26,000
第三个讲到这边是叫做

162
00:05:26,000 --> 00:05:28,000
Authority叫做认证

163
00:05:28,000 --> 00:05:29,000
认证性

164
00:05:29,000 --> 00:05:32,000
那这个的话比较单纯

165
00:05:32,000 --> 00:05:33,000
就是说

166
00:05:33,000 --> 00:05:34,000
我们想要知道说

167
00:05:34,000 --> 00:05:36,000
这个沟通里面会有讯息的

168
00:05:36,000 --> 00:05:38,000
传送方跟接收方

169
00:05:38,000 --> 00:05:40,000
那传送方要能够知道

170
00:05:40,000 --> 00:05:42,000
收到讯息的是正确的接收方

171
00:05:42,000 --> 00:05:43,000
那反之易染

172
00:05:43,000 --> 00:05:44,000
就是说这个

173
00:05:44,000 --> 00:05:46,000
认证往往是一个双向的过程

174
00:05:46,000 --> 00:05:48,000
我传讯息的人要知道

175
00:05:48,000 --> 00:05:49,000
收讯息的人是对的

176
00:05:49,000 --> 00:05:51,000
那收讯息的人也要知道

177
00:05:51,000 --> 00:05:52,000
传讯息的人是对的

178
00:05:52,000 --> 00:05:53,000
这样

179
00:05:53,000 --> 00:05:55,000
那第四个

180
00:05:55,000 --> 00:05:57,000
第四个讲的叫做不可否认性

181
00:05:57,000 --> 00:06:00,000
它指向的一种问题是

182
00:06:00,000 --> 00:06:02,000
所谓像delight或者是否认

183
00:06:02,000 --> 00:06:04,000
那具体来说的话是说

184
00:06:04,000 --> 00:06:06,000
简单来说比方说

185
00:06:06,000 --> 00:06:09,000
有可能A跟B说

186
00:06:09,000 --> 00:06:10,000
要借钱

187
00:06:10,000 --> 00:06:12,000
那过一阵子

188
00:06:12,000 --> 00:06:14,000
然后A跟B说我没有说过

189
00:06:14,000 --> 00:06:15,000
我没有说过要跟你借钱

190
00:06:15,000 --> 00:06:17,000
那这种情况下

191
00:06:17,000 --> 00:06:18,000
以借钱这个例子的话

192
00:06:18,000 --> 00:06:20,000
很容易联想到说

193
00:06:20,000 --> 00:06:21,000
我们要怎么样解决这个问题

194
00:06:21,000 --> 00:06:23,000
其实就是要人家去压签名

195
00:06:23,000 --> 00:06:25,000
那在密码学里面

196
00:06:25,000 --> 00:06:28,000
这样也是类似这样的做法

197
00:06:28,000 --> 00:06:30,000
那就是会用一种叫数位签帐的方式

198
00:06:30,000 --> 00:06:32,000
那基本上就是能够确保

199
00:06:32,000 --> 00:06:34,000
确保来源之外

200
00:06:34,000 --> 00:06:36,000
那也要能够确保

201
00:06:36,000 --> 00:06:38,000
就是曾经说过什么或做过什么

202
00:06:38,000 --> 00:06:40,000
所以其实在这边不可否认性的话

203
00:06:40,000 --> 00:06:42,000
可以把它想成类似

204
00:06:42,000 --> 00:06:44,000
既符合认证性

205
00:06:44,000 --> 00:06:46,000
那也符合资料完整性

206
00:06:46,000 --> 00:06:48,000
这两个都必须要具备

207
00:06:48,000 --> 00:06:51,000
所以简单的情境来讲

208
00:06:51,000 --> 00:06:52,000
大概是这样子

209
00:06:52,000 --> 00:06:54,000
那接下来的话我们会

210
00:06:54,000 --> 00:06:57,000
再从各个里面去

211
00:06:57,000 --> 00:07:01,000
细节去看说大概有什么样的做法

212
00:07:01,000 --> 00:07:04,000
所以到目前到这边有任何疑问吗

213
00:07:04,000 --> 00:07:11,000
好 那首先我们要

214
00:07:11,000 --> 00:07:12,000
首先我们

215
00:07:12,000 --> 00:07:14,000
接下来我们就要看的是各个安全目标

216
00:07:14,000 --> 00:07:16,000
首先我们要看到的是保密性

217
00:07:16,000 --> 00:07:17,000
那保密性来讲

218
00:07:17,000 --> 00:07:20,000
刚刚就提过说我们不想要让

219
00:07:20,000 --> 00:07:22,000
讯息不想要让资料泄漏出去

220
00:07:22,000 --> 00:07:24,000
所以最直觉的做法

221
00:07:24,000 --> 00:07:26,000
最直觉的做法就是我们要去做假密

222
00:07:29,000 --> 00:07:33,000
好 那所以以一个简单的情境来讲的话

223
00:07:33,000 --> 00:07:35,000
那这个沟通往往是

224
00:07:35,000 --> 00:07:37,000
AA传送讯息

225
00:07:37,000 --> 00:07:39,000
经过一个通讯网路道B这边

226
00:07:39,000 --> 00:07:44,000
这个我们首先要介绍的是对称式的假密

227
00:07:44,000 --> 00:07:46,000
对称式的假密跟我们在

228
00:07:46,000 --> 00:07:48,000
一开始提过的定义里面

229
00:07:48,000 --> 00:07:50,000
它跟那个AES的block还蛮像

230
00:07:50,000 --> 00:07:52,000
就是说它的重点是

231
00:07:52,000 --> 00:07:54,000
它是用同一把key来做假密

232
00:07:54,000 --> 00:07:56,000
同一把key所以叫对称

233
00:07:56,000 --> 00:07:58,000
那这边简单的看一下它的流程

234
00:07:58,000 --> 00:08:00,000
它的流程大概会是说

235
00:08:00,000 --> 00:08:02,000
A把本来要传的我们叫明文的

236
00:08:02,000 --> 00:08:03,000
这个Plain Text

237
00:08:03,000 --> 00:08:04,000
然后经过一个钥匙

238
00:08:04,000 --> 00:08:06,000
然后假密变成这一个

239
00:08:06,000 --> 00:08:08,000
有带有锁跟问号的方块

240
00:08:08,000 --> 00:08:10,000
我们叫它密文

241
00:08:10,000 --> 00:08:12,000
那这个密文会传过来到

242
00:08:12,000 --> 00:08:13,000
就经过通讯网路

243
00:08:13,000 --> 00:08:15,000
然后传到B手上

244
00:08:15,000 --> 00:08:17,000
那B呢因为它拥有

245
00:08:17,000 --> 00:08:19,000
它拥有这把同样的黄色钥匙

246
00:08:19,000 --> 00:08:22,000
所以它可以把它还原回

247
00:08:22,000 --> 00:08:24,000
原本的这个明文

248
00:08:24,000 --> 00:08:26,000
那至于2E的第三方X

249
00:08:26,000 --> 00:08:28,000
它手上没有这把钥匙的时候

250
00:08:28,000 --> 00:08:31,000
它就没有办法去解开这个密文

251
00:08:31,000 --> 00:08:33,000
它的基本的概念是这样

252
00:08:33,000 --> 00:08:36,000
所以光从刚刚的叙述

253
00:08:36,000 --> 00:08:37,000
应该已经可以知道说

254
00:08:37,000 --> 00:08:39,000
这整件事情的这个安全性

255
00:08:39,000 --> 00:08:42,000
最主要是建立在说

256
00:08:42,000 --> 00:08:44,000
你只要没有这把黄色的钥匙

257
00:08:44,000 --> 00:08:46,000
你就没有办法解读这个讯息

258
00:08:46,000 --> 00:08:49,000
它的安全性是建立在这个机制上面

259
00:08:49,000 --> 00:08:53,000
那对称式的这种加密的方法

260
00:08:53,000 --> 00:08:55,000
它一般来讲有几项特性

261
00:08:55,000 --> 00:08:57,000
我们讲的比较模糊一点的话

262
00:08:57,000 --> 00:09:00,000
就是它算它速度很快

263
00:09:00,000 --> 00:09:02,000
然后安全性也很高

264
00:09:02,000 --> 00:09:04,000
但是它有一个致命的缺陷

265
00:09:04,000 --> 00:09:07,000
是它需要这个精要传递

266
00:09:07,000 --> 00:09:08,000
那精要传递的问题

267
00:09:08,000 --> 00:09:10,000
我们稍后会再提

268
00:09:10,000 --> 00:09:15,000
那这边我们用一个

269
00:09:15,000 --> 00:09:17,000
就是很简单的例子来看

270
00:09:17,000 --> 00:09:19,000
对称式加密这件事情

271
00:09:19,000 --> 00:09:22,000
那首先我们看到左边

272
00:09:22,000 --> 00:09:23,000
在做加密的时候

273
00:09:23,000 --> 00:09:25,000
我们有讯息钥匙跟密文

274
00:09:25,000 --> 00:09:27,000
那这边我们把它都用4个bit

275
00:09:27,000 --> 00:09:28,000
然后用exclusive for

276
00:09:28,000 --> 00:09:29,000
那exclusive for来讲

277
00:09:29,000 --> 00:09:31,000
我们在这边就是我们的加密的函数

278
00:09:31,000 --> 00:09:33,000
那我想这大家应该蛮熟悉的

279
00:09:33,000 --> 00:09:35,000
就是说这边有它的针指表

280
00:09:35,000 --> 00:09:38,000
然后跟我们要怎么样用这个exclusive for

281
00:09:38,000 --> 00:09:40,000
来做加密跟解密

282
00:09:40,000 --> 00:09:42,000
那它的原理主要是说

283
00:09:42,000 --> 00:09:45,000
我今天就它有交换率跟

284
00:09:45,000 --> 00:09:47,000
结合率的关系

285
00:09:47,000 --> 00:09:49,000
所以我今天把一个明文

286
00:09:49,000 --> 00:09:50,000
然后加密过这一把

287
00:09:50,000 --> 00:09:52,000
经过这把钥匙

288
00:09:52,000 --> 00:09:54,000
然后去做operate之后

289
00:09:54,000 --> 00:09:56,000
得到了这个密文1001

290
00:09:56,000 --> 00:09:58,000
那在解密的时候我一样

291
00:09:58,000 --> 00:10:00,000
我把这个1001再次

292
00:10:00,000 --> 00:10:03,000
对这个经要做exclusive for的运算

293
00:10:03,000 --> 00:10:06,000
之后得回来的会是原本的明文

294
00:10:06,000 --> 00:10:07,000
它是一个简单的概念

295
00:10:07,000 --> 00:10:09,000
所以在这里面的重点是说

296
00:10:09,000 --> 00:10:11,000
第一个它用的这个加密的方法

297
00:10:11,000 --> 00:10:13,000
是exclusive for

298
00:10:13,000 --> 00:10:15,000
那另外就是它是依靠这个

299
00:10:15,000 --> 00:10:16,000
同一把经要

300
00:10:16,000 --> 00:10:17,000
所以你没有这把经要

301
00:10:17,000 --> 00:10:20,000
你是没有办法解回讯息的

302
00:10:20,000 --> 00:10:22,000
这是一个简单的范例

303
00:10:22,000 --> 00:10:23,000
就是对称是演算法

304
00:10:23,000 --> 00:10:25,000
大概是怎么样做的

305
00:10:25,000 --> 00:10:30,000
好 那

306
00:10:30,000 --> 00:10:32,000
再来会补充一点

307
00:10:32,000 --> 00:10:34,000
就是对称是演算法

308
00:10:34,000 --> 00:10:37,000
对称是加密它的一些性质

309
00:10:37,000 --> 00:10:39,000
像刚刚我们看到的exclusive for

310
00:10:39,000 --> 00:10:40,000
来讲的话

311
00:10:40,000 --> 00:10:41,000
它其实

312
00:10:41,000 --> 00:10:42,000
大家应该可以想象

313
00:10:42,000 --> 00:10:43,000
它的安全强度

314
00:10:43,000 --> 00:10:44,000
相对算是蛮低的

315
00:10:44,000 --> 00:10:46,000
因为还蛮容易破解的

316
00:10:46,000 --> 00:10:47,000
那它之所以容易破解的

317
00:10:47,000 --> 00:10:49,000
其中一个主要的理由是在于说

318
00:10:49,000 --> 00:10:52,000
它的运算来讲是比较是线性的

319
00:10:52,000 --> 00:10:55,000
那所以一般而言

320
00:10:55,000 --> 00:10:56,000
一般而言这种

321
00:10:56,000 --> 00:10:57,000
现在常用

322
00:10:57,000 --> 00:10:59,000
就是合规定

323
00:10:59,000 --> 00:11:01,000
够安全的这种对称是演算法来讲

324
00:11:01,000 --> 00:11:03,000
它通常会带有几种运算

325
00:11:03,000 --> 00:11:07,000
像它会带的是这种

326
00:11:07,000 --> 00:11:09,000
置换substitution

327
00:11:09,000 --> 00:11:11,000
然后跟排列的这种运算

328
00:11:11,000 --> 00:11:12,000
那排列

329
00:11:12,000 --> 00:11:15,000
置换我想应该蛮容易理解

330
00:11:15,000 --> 00:11:16,000
它其实完全就是一个

331
00:11:16,000 --> 00:11:17,000
非线性的

332
00:11:17,000 --> 00:11:18,000
那排列的话

333
00:11:18,000 --> 00:11:19,000
不管你是怎么样排

334
00:11:19,000 --> 00:11:21,000
你是重新排列

335
00:11:21,000 --> 00:11:23,000
或是你是transpose

336
00:11:23,000 --> 00:11:24,000
或是做怎么样的

337
00:11:24,000 --> 00:11:25,000
这种transposition

338
00:11:25,000 --> 00:11:27,000
或是去做mapping来讲

339
00:11:27,000 --> 00:11:29,000
它其实某种程度上都

340
00:11:29,000 --> 00:11:31,000
只要是它是属于排列的这种的行为

341
00:11:31,000 --> 00:11:33,000
它都算是线性的

342
00:11:33,000 --> 00:11:35,000
那线性的以运算来讲

343
00:11:35,000 --> 00:11:37,000
就等于说容易推倒

344
00:11:37,000 --> 00:11:38,000
所以现在的

345
00:11:38,000 --> 00:11:39,000
现在

346
00:11:39,000 --> 00:11:41,000
普遍会在使用的

347
00:11:41,000 --> 00:11:44,000
对称是加密的演算法来讲

348
00:11:44,000 --> 00:11:45,000
它的演算法的结构

349
00:11:45,000 --> 00:11:47,000
通常都一定会带有

350
00:11:47,000 --> 00:11:49,000
至少一个非线性的运算

351
00:11:49,000 --> 00:11:51,000
比方说以现在来讲

352
00:11:51,000 --> 00:11:54,000
最常用的是下面列的AES

353
00:11:54,000 --> 00:11:56,000
AES的话

354
00:11:56,000 --> 00:11:57,000
熟的可能会知道说

355
00:11:57,000 --> 00:11:58,000
它大概

356
00:11:58,000 --> 00:11:59,000
大致上算是有

357
00:11:59,000 --> 00:12:01,000
四个transformation在做

358
00:12:01,000 --> 00:12:04,000
那其中只有一个是

359
00:12:04,000 --> 00:12:05,000
其中只有一个叫

360
00:12:05,000 --> 00:12:06,000
subbite的步骤

361
00:12:06,000 --> 00:12:08,000
是在做substitution

362
00:12:08,000 --> 00:12:10,000
它是用类似查表的方式

363
00:12:10,000 --> 00:12:12,000
然后去把值换掉

364
00:12:12,000 --> 00:12:14,000
那其余的都算是线性的运算

365
00:12:14,000 --> 00:12:16,000
都是shift

366
00:12:16,000 --> 00:12:18,000
或者是去做矩阵的惩罚

367
00:12:18,000 --> 00:12:19,000
这种类似是比较是

368
00:12:19,000 --> 00:12:21,000
线性的运算这样

369
00:12:21,000 --> 00:12:23,000
而且一般来讲

370
00:12:23,000 --> 00:12:25,000
为了就是也同样符合效率

371
00:12:25,000 --> 00:12:27,000
所以其实只要有

372
00:12:27,000 --> 00:12:28,000
一个非线性的运算

373
00:12:28,000 --> 00:12:30,000
它就算是足够安全

374
00:12:30,000 --> 00:12:32,000
那也因为非线性的运算

375
00:12:32,000 --> 00:12:34,000
它需要资源的关系

376
00:12:34,000 --> 00:12:36,000
所以其实通常

377
00:12:36,000 --> 00:12:37,000
在这个对称式的

378
00:12:37,000 --> 00:12:38,000
加密演算法里面

379
00:12:38,000 --> 00:12:40,000
非对称式的运算

380
00:12:40,000 --> 00:12:42,000
也就只有那么一个

381
00:12:42,000 --> 00:12:45,000
其他都会是线性的排列

382
00:12:45,000 --> 00:12:47,000
那下面这张表的话

383
00:12:47,000 --> 00:12:48,000
是列出说目前

384
00:12:48,000 --> 00:12:50,000
目前最主要有在使用的哪一些

385
00:12:50,000 --> 00:12:52,000
那你这边可以看到的话

386
00:12:52,000 --> 00:12:56,000
以前的大概在1997年以前

387
00:12:56,000 --> 00:12:58,000
在用的都是一种叫做

388
00:12:58,000 --> 00:12:59,000
DES

389
00:12:59,000 --> 00:13:01,000
叫做data encryption standard

390
00:13:01,000 --> 00:13:03,000
一种就型的加密演算法

391
00:13:03,000 --> 00:13:06,000
那到接近1997年的时候

392
00:13:06,000 --> 00:13:08,000
因为它的安全性已经开始下降

393
00:13:08,000 --> 00:13:11,000
所以那个时候有去做

394
00:13:11,000 --> 00:13:14,000
比方说把它变成triple death

395
00:13:14,000 --> 00:13:15,000
就是把它叠三次

396
00:13:15,000 --> 00:13:16,000
然后可能中间用

397
00:13:16,000 --> 00:13:17,000
两把不同的key

398
00:13:17,000 --> 00:13:19,000
或是用三把不同的key这样

399
00:13:19,000 --> 00:13:20,000
那这些来讲

400
00:13:20,000 --> 00:13:22,000
到现在都已经非常勉强了

401
00:13:22,000 --> 00:13:24,000
所以才会有开始

402
00:13:24,000 --> 00:13:25,000
从1997年开始有

403
00:13:25,000 --> 00:13:27,000
现在的叫做AES

404
00:13:27,000 --> 00:13:30,000
那DES叫做data encryption standard

405
00:13:30,000 --> 00:13:32,000
那AES的那个A叫advanced

406
00:13:32,000 --> 00:13:33,000
就是进阶加密标准

407
00:13:33,000 --> 00:13:34,000
如果去查那个AES的话

408
00:13:34,000 --> 00:13:37,000
通常会查到这样的翻译

409
00:13:37,000 --> 00:13:39,000
那所以这边列的

410
00:13:39,000 --> 00:13:41,000
主要的另外一个可以补充的是说

411
00:13:41,000 --> 00:13:42,000
这边可以看到是

412
00:13:42,000 --> 00:13:46,000
在triple death的使用情境里面

413
00:13:46,000 --> 00:13:48,000
它已经不被允许做加密

414
00:13:48,000 --> 00:13:51,000
但是可以在Legacyuse的

415
00:13:51,000 --> 00:13:52,000
场合下去做解密

416
00:13:52,000 --> 00:13:54,000
那这个就跟

417
00:13:54,000 --> 00:13:56,000
我们一般很常会遇到的状况一样

418
00:13:56,000 --> 00:13:58,000
就是说你可能以前出的产品

419
00:13:58,000 --> 00:14:00,000
已经在已经deployed到field里面

420
00:14:00,000 --> 00:14:02,000
那你后面在出的时候

421
00:14:02,000 --> 00:14:04,000
它必须至少要能够解读

422
00:14:04,000 --> 00:14:06,000
当初前一代产品

423
00:14:06,000 --> 00:14:09,000
用triple death做加密的讯息

424
00:14:09,000 --> 00:14:11,000
它至少要能够解读

425
00:14:11,000 --> 00:14:13,000
但是因为安全性的问题

426
00:14:13,000 --> 00:14:14,000
它已经不再容许

427
00:14:14,000 --> 00:14:16,000
用同样旧的方法去做加密

428
00:14:16,000 --> 00:14:19,000
好 这个大概的概念是

429
00:14:19,000 --> 00:14:21,000
大概的概念是这样

430
00:14:21,000 --> 00:14:23,000
那所以现在来讲

431
00:14:23,000 --> 00:14:24,000
最流行

432
00:14:24,000 --> 00:14:25,000
然后最常被使用的

433
00:14:25,000 --> 00:14:28,000
是这边列的最下面这一列

434
00:14:28,000 --> 00:14:30,000
就是AES的128

435
00:14:30,000 --> 00:14:32,000
或是192 或是256

436
00:14:32,000 --> 00:14:33,000
那这个数字的话

437
00:14:33,000 --> 00:14:36,000
可能大家大概有个印象就好

438
00:14:36,000 --> 00:14:38,000
就是说它是以一个区块

439
00:14:38,000 --> 00:14:39,000
一个区块来做加密的

440
00:14:39,000 --> 00:14:41,000
所以你不管你的输入多长

441
00:14:41,000 --> 00:14:43,000
它都是照这样的数字去切分它

442
00:14:43,000 --> 00:14:45,000
一个block一个block来做加密

443
00:14:45,000 --> 00:14:46,000
这样

444
00:14:46,000 --> 00:14:50,000
那到这边有任何问题吗

445
00:14:50,000 --> 00:14:57,000
好

446
00:14:57,000 --> 00:15:01,000
好 那再来继续讲到的是

447
00:15:01,000 --> 00:15:04,000
在我们讲到加密的时候

448
00:15:04,000 --> 00:15:05,000
它是有另外一种做法

449
00:15:05,000 --> 00:15:07,000
叫做有对称就有非对称

450
00:15:07,000 --> 00:15:08,000
这边讲的是

451
00:15:08,000 --> 00:15:10,000
非对称式的加密的做法

452
00:15:10,000 --> 00:15:13,000
它的流程大概跟

453
00:15:13,000 --> 00:15:14,000
我们前面有看过

454
00:15:14,000 --> 00:15:17,000
有两种不同的钥匙的情境

455
00:15:17,000 --> 00:15:19,000
有私钥跟公钥的情境

456
00:15:19,000 --> 00:15:22,000
那我们先简单的提一下它的流程

457
00:15:22,000 --> 00:15:23,000
它的流程大概会是这样

458
00:15:23,000 --> 00:15:24,000
就是说

459
00:15:24,000 --> 00:15:27,000
今天A要传送讯息给B的时候

460
00:15:27,000 --> 00:15:30,000
特别要注意

461
00:15:30,000 --> 00:15:31,000
有这两把钥匙

462
00:15:31,000 --> 00:15:33,000
这边列的p跟s

463
00:15:33,000 --> 00:15:35,000
一把是私钥

464
00:15:35,000 --> 00:15:36,000
一把是公钥

465
00:15:36,000 --> 00:15:38,000
这两把钥匙都是

466
00:15:38,000 --> 00:15:40,000
讯息接收方B的

467
00:15:40,000 --> 00:15:42,000
这个很重要

468
00:15:42,000 --> 00:15:44,000
好 那所以

469
00:15:44,000 --> 00:15:46,000
有了这两把钥匙

470
00:15:46,000 --> 00:15:49,000
然后怎么做加密的沟通

471
00:15:49,000 --> 00:15:51,000
讯息传送方A

472
00:15:51,000 --> 00:15:54,000
它会把这个plantex

473
00:15:54,000 --> 00:15:56,000
它会把它要传送的讯息 明文

474
00:15:56,000 --> 00:15:59,000
然后用讯息接收方B

475
00:15:59,000 --> 00:16:01,000
这个人的公钥

476
00:16:01,000 --> 00:16:02,000
做加密

477
00:16:02,000 --> 00:16:05,000
然后传送这个密文过来

478
00:16:05,000 --> 00:16:07,000
那收到这个讯息

479
00:16:07,000 --> 00:16:09,000
收到这个密文的接收方B

480
00:16:09,000 --> 00:16:11,000
它会去用它自己

481
00:16:11,000 --> 00:16:13,000
同样是B这个人的私钥

482
00:16:13,000 --> 00:16:14,000
去做解密

483
00:16:14,000 --> 00:16:16,000
把它还原回这个原本的讯息

484
00:16:16,000 --> 00:16:19,000
好

485
00:16:19,000 --> 00:16:20,000
所以这个蛮重要的

486
00:16:20,000 --> 00:16:21,000
就是说

487
00:16:21,000 --> 00:16:23,000
在这样的情境里面

488
00:16:23,000 --> 00:16:25,000
在这样沟通的情境里面

489
00:16:25,000 --> 00:16:27,000
这两把key都是属于

490
00:16:27,000 --> 00:16:29,000
都是属于讯息接收方B的

491
00:16:29,000 --> 00:16:33,000
那为什么A有这把key可以用

492
00:16:33,000 --> 00:16:35,000
因为顾名思义的

493
00:16:35,000 --> 00:16:36,000
它叫公钥

494
00:16:36,000 --> 00:16:38,000
我们是希望它是能够公开的

495
00:16:38,000 --> 00:16:40,000
那但是反过来讲的话

496
00:16:40,000 --> 00:16:42,000
这把私钥是绝对不会出去

497
00:16:42,000 --> 00:16:44,000
是只有B才有的

498
00:16:44,000 --> 00:16:45,000
非对称识的

499
00:16:45,000 --> 00:16:48,000
或者说公开经药密码学的

500
00:16:48,000 --> 00:16:49,000
这两是一样东西

501
00:16:49,000 --> 00:16:51,000
公开经药密码学的基础

502
00:16:51,000 --> 00:16:52,000
是建立在此

503
00:16:52,000 --> 00:16:54,000
公钥可以示善在外

504
00:16:54,000 --> 00:16:56,000
可是私钥绝对只有自己有

505
00:16:56,000 --> 00:16:59,000
那

506
00:16:59,000 --> 00:17:00,000
所以可以看到的是

507
00:17:00,000 --> 00:17:02,000
因为公钥可以示善在外

508
00:17:02,000 --> 00:17:05,000
所以这样的做法来讲的话

509
00:17:05,000 --> 00:17:07,000
它的特性是说

510
00:17:07,000 --> 00:17:10,000
它不需要有一把

511
00:17:10,000 --> 00:17:12,000
事先就有一把注册好的

512
00:17:12,000 --> 00:17:14,000
两个人都一样对称的经药

513
00:17:14,000 --> 00:17:16,000
你只要需要沟通的时候

514
00:17:16,000 --> 00:17:18,000
然后比方说我要传讯息

515
00:17:18,000 --> 00:17:19,000
给别人的时候

516
00:17:19,000 --> 00:17:22,000
我只要能够随意的取得他的公钥

517
00:17:22,000 --> 00:17:24,000
这个是合法的

518
00:17:24,000 --> 00:17:26,000
那我就能传送讯息给人家

519
00:17:26,000 --> 00:17:27,000
但是只有他

520
00:17:27,000 --> 00:17:29,000
因为他拥有他自己的私钥

521
00:17:29,000 --> 00:17:31,000
所以他可以用他自己的私钥

522
00:17:31,000 --> 00:17:33,000
去解读我传给他的

523
00:17:33,000 --> 00:17:35,000
加密过的讯息

524
00:17:35,000 --> 00:17:37,000
那所以他的特性是说

525
00:17:37,000 --> 00:17:38,000
他不需要有一把

526
00:17:38,000 --> 00:17:40,000
事先注册好的钥匙

527
00:17:40,000 --> 00:17:43,000
那他安全性也相对高

528
00:17:43,000 --> 00:17:45,000
但是他

529
00:17:45,000 --> 00:17:47,000
因为他用到的数学比较难

530
00:17:47,000 --> 00:17:48,000
所以一般来讲

531
00:17:48,000 --> 00:17:49,000
耗费的资源会比较多

532
00:17:49,000 --> 00:17:51,000
运算速度会比较慢

533
00:17:51,000 --> 00:17:55,000
那这边的话就在

534
00:17:55,000 --> 00:17:57,000
比较具体的补充

535
00:17:57,000 --> 00:17:58,000
刚刚讲到的例子

536
00:17:58,000 --> 00:17:59,000
那

537
00:17:59,000 --> 00:18:01,000
所以在

538
00:18:01,000 --> 00:18:03,000
开始做这个沟通之前

539
00:18:03,000 --> 00:18:04,000
那会像我们前面的

540
00:18:04,000 --> 00:18:06,000
定义的那一页里面有提到的

541
00:18:06,000 --> 00:18:07,000
会先经过这个

542
00:18:07,000 --> 00:18:10,000
由私钥去产生公钥的过程

543
00:18:10,000 --> 00:18:12,000
那并且这个私钥

544
00:18:12,000 --> 00:18:13,000
一旦产生了这个公钥之后

545
00:18:13,000 --> 00:18:15,000
他们两个就是成对的

546
00:18:15,000 --> 00:18:17,000
就是每个人会有

547
00:18:17,000 --> 00:18:18,000
每个人会有一对

548
00:18:18,000 --> 00:18:20,000
自己的这个私钥跟公钥

549
00:18:20,000 --> 00:18:22,000
所以一样

550
00:18:22,000 --> 00:18:23,000
这个图画的是说

551
00:18:23,000 --> 00:18:25,000
不同的人要传讯息

552
00:18:25,000 --> 00:18:26,000
给同一个接收方

553
00:18:26,000 --> 00:18:27,000
他们所用来

554
00:18:27,000 --> 00:18:29,000
加密讯息的这一把

555
00:18:29,000 --> 00:18:30,000
这一把key

556
00:18:30,000 --> 00:18:31,000
通通都是同一把

557
00:18:31,000 --> 00:18:32,000
因为他们用的是

558
00:18:32,000 --> 00:18:34,000
讯息接收方的公钥

559
00:18:34,000 --> 00:18:36,000
那所以

560
00:18:36,000 --> 00:18:37,000
每个人要传讯息

561
00:18:37,000 --> 00:18:38,000
给这个接收方的时候

562
00:18:38,000 --> 00:18:39,000
他们都用讯息接收方的

563
00:18:39,000 --> 00:18:41,000
这个公钥来做加密

564
00:18:41,000 --> 00:18:43,000
但是只有

565
00:18:43,000 --> 00:18:44,000
只有接收方

566
00:18:44,000 --> 00:18:45,000
他自己拥有这个

567
00:18:45,000 --> 00:18:46,000
secret key的时候

568
00:18:46,000 --> 00:18:47,000
才可以去做解密

569
00:18:47,000 --> 00:18:49,000
这个是他的

570
00:18:49,000 --> 00:18:51,000
他的运作是这样子运作

571
00:18:51,000 --> 00:18:54,000
那比较好理解的一种方式是

572
00:18:54,000 --> 00:18:55,000
可以把

573
00:18:55,000 --> 00:18:57,000
可以把这个公钥

574
00:18:57,000 --> 00:18:58,000
公钥这个事情

575
00:18:58,000 --> 00:18:59,000
想成是地址

576
00:18:59,000 --> 00:19:00,000
或是信箱

577
00:19:00,000 --> 00:19:01,000
或是

578
00:19:01,000 --> 00:19:02,000
可能会在家里前面那种

579
00:19:02,000 --> 00:19:04,000
那个投信的那种邮箱

580
00:19:04,000 --> 00:19:05,000
那

581
00:19:05,000 --> 00:19:07,000
任何人都可以

582
00:19:07,000 --> 00:19:09,000
知道要怎么样传讯息

583
00:19:09,000 --> 00:19:11,000
给这个邮箱的主人

584
00:19:11,000 --> 00:19:13,000
但是邮箱你投进去

585
00:19:13,000 --> 00:19:14,000
但是你打不开

586
00:19:14,000 --> 00:19:15,000
除非你有钥匙

587
00:19:15,000 --> 00:19:16,000
只有

588
00:19:16,000 --> 00:19:18,000
只有这个邮箱的主人

589
00:19:18,000 --> 00:19:19,000
他有办法打开这个邮箱

590
00:19:19,000 --> 00:19:20,000
去看里面的信

591
00:19:20,000 --> 00:19:22,000
看里面的讯息

592
00:19:22,000 --> 00:19:24,000
私钥跟公钥的

593
00:19:24,000 --> 00:19:25,000
概念大概就是这样

594
00:19:25,000 --> 00:19:26,000
公钥就像是一个

595
00:19:26,000 --> 00:19:27,000
像是一个地址

596
00:19:27,000 --> 00:19:28,000
或是一个

597
00:19:28,000 --> 00:19:30,000
或是一个邮箱这样子

598
00:19:30,000 --> 00:19:31,000
那

599
00:19:31,000 --> 00:19:32,000
更具体来说的话

600
00:19:32,000 --> 00:19:33,000
现在常常在用的

601
00:19:33,000 --> 00:19:35,000
像是比特币这种东西

602
00:19:35,000 --> 00:19:36,000
比特币他的账号

603
00:19:36,000 --> 00:19:37,000
他其实就是

604
00:19:37,000 --> 00:19:39,000
他其实就是公钥

605
00:19:39,000 --> 00:19:41,000
所以也蛮符合

606
00:19:41,000 --> 00:19:42,000
就是刚刚所谓

607
00:19:42,000 --> 00:19:43,000
公钥就像是地址

608
00:19:43,000 --> 00:19:45,000
任何人都可以传过去

609
00:19:45,000 --> 00:19:46,000
但是以比特币来讲

610
00:19:46,000 --> 00:19:47,000
任何人都可以传钱

611
00:19:47,000 --> 00:19:48,000
到你的地址

612
00:19:48,000 --> 00:19:50,000
可是你要动里面的钱

613
00:19:50,000 --> 00:19:51,000
只有你有

614
00:19:51,000 --> 00:19:52,000
自己的那把钥匙

615
00:19:52,000 --> 00:19:53,000
才能去动

616
00:19:53,000 --> 00:19:55,000
对 他的概念大概是这样

617
00:19:55,000 --> 00:19:59,000
好 那

618
00:19:59,000 --> 00:20:00,000
所以再来是谈

619
00:20:00,000 --> 00:20:02,000
这个非对称式的加密

620
00:20:02,000 --> 00:20:04,000
非对称式密码学

621
00:20:04,000 --> 00:20:06,000
的一些性质

622
00:20:06,000 --> 00:20:09,000
那首先要再釐清的是说

623
00:20:09,000 --> 00:20:10,000
非对称式的这种

624
00:20:10,000 --> 00:20:12,000
就是有私钥

625
00:20:12,000 --> 00:20:14,000
也有公钥的这种数学来讲

626
00:20:14,000 --> 00:20:15,000
他能够做到的事情

627
00:20:15,000 --> 00:20:17,000
其实非常多种

628
00:20:17,000 --> 00:20:19,000
绝对不只有

629
00:20:19,000 --> 00:20:21,000
做加密这件事情

630
00:20:21,000 --> 00:20:22,000
所以这边大概列了

631
00:20:22,000 --> 00:20:23,000
就是说他能够去做什么

632
00:20:23,000 --> 00:20:25,000
他能够去做加密解密

633
00:20:25,000 --> 00:20:26,000
我们刚刚提的

634
00:20:26,000 --> 00:20:28,000
他能够去做数位千张

635
00:20:28,000 --> 00:20:30,000
那也能够去做精药交换

636
00:20:30,000 --> 00:20:32,000
下面两个

637
00:20:32,000 --> 00:20:33,000
后面会提

638
00:20:33,000 --> 00:20:35,000
那这边来讲的话

639
00:20:35,000 --> 00:20:38,000
主要是要先跟大家补充说

640
00:20:38,000 --> 00:20:40,000
这种非对称式的数学

641
00:20:40,000 --> 00:20:42,000
他都是用一种叫做

642
00:20:42,000 --> 00:20:44,000
他都是用一种叫做

643
00:20:44,000 --> 00:20:45,000
trapdoor one-way function

644
00:20:45,000 --> 00:20:48,000
这个算是陷阱门的这种函数

645
00:20:48,000 --> 00:20:50,000
陷阱门什么意思

646
00:20:50,000 --> 00:20:52,000
就是说我们今天要做陷阱的时候

647
00:20:52,000 --> 00:20:54,000
我们会希望人家容易掉入这个陷阱

648
00:20:54,000 --> 00:20:56,000
但是一掉进去之后

649
00:20:56,000 --> 00:20:58,000
是没有办法反折出来的

650
00:20:58,000 --> 00:21:00,000
这样的概念

651
00:21:00,000 --> 00:21:02,000
精神希望大家可以理解

652
00:21:02,000 --> 00:21:04,000
他的具体来说

653
00:21:04,000 --> 00:21:05,000
就是说

654
00:21:05,000 --> 00:21:07,000
今天我们有这个

655
00:21:07,000 --> 00:21:10,000
要用非对称式的密码学的时候

656
00:21:10,000 --> 00:21:12,000
我们都会有先从私钥

657
00:21:12,000 --> 00:21:14,000
去产生公钥

658
00:21:14,000 --> 00:21:16,000
那同时

659
00:21:16,000 --> 00:21:17,000
我们刚刚也讲过

660
00:21:17,000 --> 00:21:19,000
公钥是可以示善在外的

661
00:21:19,000 --> 00:21:21,000
为什么他可以示善在外

662
00:21:21,000 --> 00:21:23,000
是因为我们有信心

663
00:21:23,000 --> 00:21:25,000
依照他数学的原理

664
00:21:25,000 --> 00:21:26,000
你今天有公钥

665
00:21:26,000 --> 00:21:29,000
是没有办法推理去私钥的

666
00:21:29,000 --> 00:21:32,000
他的安全性完全就建立在这个基础之上

667
00:21:32,000 --> 00:21:34,000
好 那

668
00:21:34,000 --> 00:21:37,000
所以这边介绍的是

669
00:21:37,000 --> 00:21:39,000
他几种不同功能的用法

670
00:21:39,000 --> 00:21:41,000
以加解密而言的话

671
00:21:41,000 --> 00:21:42,000
我们刚刚提过了

672
00:21:42,000 --> 00:21:44,000
我们会用公钥去做加密

673
00:21:44,000 --> 00:21:47,000
然后收讯息的人用私钥去做解密

674
00:21:47,000 --> 00:21:49,000
这方向会不太一样

675
00:21:49,000 --> 00:21:52,000
那如果是以数位签章来讲的话

676
00:21:52,000 --> 00:21:55,000
那他会用私钥去签

677
00:21:55,000 --> 00:21:59,000
然后大家可以用公钥去确认这个签章

678
00:21:59,000 --> 00:22:03,000
那另外还有精药交换的这种功能

679
00:22:03,000 --> 00:22:05,000
我们透过交换

680
00:22:05,000 --> 00:22:07,000
我们透过交换这个公钥

681
00:22:07,000 --> 00:22:10,000
然后去想办法产生的一个

682
00:22:10,000 --> 00:22:13,000
一样的一把对称的这个精药

683
00:22:13,000 --> 00:22:14,000
所以

684
00:22:14,000 --> 00:22:16,000
这边还没有要

685
00:22:16,000 --> 00:22:17,000
不希望这边先搞乱大家

686
00:22:17,000 --> 00:22:19,000
但是主要的重点是在于说

687
00:22:19,000 --> 00:22:22,000
非对称式的密码系统

688
00:22:22,000 --> 00:22:24,000
它是有非常多的用途

689
00:22:24,000 --> 00:22:27,000
那我们刚刚提的是先提了加解密的这种

690
00:22:27,000 --> 00:22:30,000
那后续我们会提到的其他的功能

691
00:22:30,000 --> 00:22:34,000
也很多都会跟非对称式的密码学有关

692
00:22:34,000 --> 00:22:35,000
那一样

693
00:22:35,000 --> 00:22:36,000
这边有一张表诊里

694
00:22:36,000 --> 00:22:38,000
现在会在用的东西

695
00:22:38,000 --> 00:22:41,000
那整个非对称式密码学的数学的原理

696
00:22:41,000 --> 00:22:44,000
都是从这个Deaf Helmets 这个演算法来的

697
00:22:44,000 --> 00:22:45,000
这是两个姓氏

698
00:22:45,000 --> 00:22:47,000
那它最刚开始

699
00:22:47,000 --> 00:22:48,000
最刚开始被发明

700
00:22:48,000 --> 00:22:50,000
这是1975年的事情

701
00:22:50,000 --> 00:22:53,000
那纯粹目的就是去做精药交换

702
00:22:53,000 --> 00:22:55,000
精药交换是一切

703
00:22:55,000 --> 00:22:57,000
这个非对称式密码学的基础

704
00:22:57,000 --> 00:22:59,000
所以大部分我们看到的

705
00:22:59,000 --> 00:23:01,000
只要是非对称式的演算法

706
00:23:01,000 --> 00:23:03,000
只要是非对称式演算法

707
00:23:03,000 --> 00:23:06,000
通常都一定能够做精药交换的功能

708
00:23:06,000 --> 00:23:09,000
那我们现在比较常在用的

709
00:23:09,000 --> 00:23:11,000
像是这边列的这个橢圆曲线

710
00:23:11,000 --> 00:23:13,000
就跟我们前面定义里面看到的

711
00:23:13,000 --> 00:23:16,000
跟另外一种叫做RSA

712
00:23:16,000 --> 00:23:19,000
RSA来讲它是比较古老

713
00:23:19,000 --> 00:23:21,000
比较庞大一点的东西

714
00:23:21,000 --> 00:23:23,000
现在还会用 但比较少

715
00:23:23,000 --> 00:23:26,000
因为最主要是因为它的精药的长度非常的长

716
00:23:26,000 --> 00:23:27,000
比较厚重

717
00:23:27,000 --> 00:23:29,000
像这种东西可能会在哪里看到

718
00:23:29,000 --> 00:23:33,000
会在比方说信用卡里面的那一颗IC

719
00:23:33,000 --> 00:23:35,000
它里面就会有用RSA去做

720
00:23:35,000 --> 00:23:37,000
不管是做千张

721
00:23:37,000 --> 00:23:39,000
通常是做千张的这种做法

722
00:23:39,000 --> 00:23:41,000
现在是现在还有在用的

723
00:23:41,000 --> 00:23:45,000
那所以刚刚也有提到过

724
00:23:45,000 --> 00:23:47,000
我们提过比较模糊说

725
00:23:47,000 --> 00:23:50,000
对称式的加密算是安全

726
00:23:50,000 --> 00:23:52,000
那非对称式的加密也算安全

727
00:23:52,000 --> 00:23:54,000
那具体来讲有多安全的话

728
00:23:54,000 --> 00:23:55,000
那这边就有一张

729
00:23:55,000 --> 00:23:58,000
对照表可以给大家参考

730
00:23:58,000 --> 00:24:02,000
这个对照表是纯粹是用精药的长度

731
00:24:02,000 --> 00:24:06,000
然后去equivalent to它的破解的难度

732
00:24:06,000 --> 00:24:09,000
所以怎么看就是比方说以我们前面讲说

733
00:24:09,000 --> 00:24:12,000
随便一个对称式的演算法

734
00:24:12,000 --> 00:24:13,000
比方说AES

735
00:24:13,000 --> 00:24:16,000
然后我们可能在128bit的时候

736
00:24:16,000 --> 00:24:18,000
它的key长度128bit的时候

737
00:24:18,000 --> 00:24:23,000
它相当于RSA的3K bits的key长度

738
00:24:23,000 --> 00:24:27,000
然后也相当于这个橢圆曲线密码学

739
00:24:27,000 --> 00:24:31,000
差不多key长度为256bit左右的强度

740
00:24:31,000 --> 00:24:36,000
那所以这样大家可以比较有概念说

741
00:24:36,000 --> 00:24:39,000
为什么RSA现在已经慢慢的在退流行

742
00:24:39,000 --> 00:24:42,000
主要是因为它要能够达到同样的强度

743
00:24:42,000 --> 00:24:45,000
它所需要的精药的长度很长

744
00:24:45,000 --> 00:24:48,000
那很长是会卡在storage的问题

745
00:24:48,000 --> 00:24:50,000
就是你反而你装置

746
00:24:50,000 --> 00:24:52,000
或是你晶片里面没有那么多的空间

747
00:24:52,000 --> 00:24:55,000
可以用来儲存用途比较单薄的

748
00:24:55,000 --> 00:24:59,000
这种演算法的参数

749
00:24:59,000 --> 00:25:04,000
那这中间的话是原始的Deafy Helmet

750
00:25:04,000 --> 00:25:08,000
跟由NES 国家技术标准局

751
00:25:08,000 --> 00:25:12,000
他们所发布的一种比较基础的数位签账的算法

752
00:25:12,000 --> 00:25:14,000
那这个当然是因为比较早期的东西

753
00:25:14,000 --> 00:25:18,000
所以它所需要的这个分量又更大

754
00:25:18,000 --> 00:25:21,000
所以再回过头来说

755
00:25:21,000 --> 00:25:23,000
虽然我们说

756
00:25:23,000 --> 00:25:25,000
虽然在这边可以看到的是说

757
00:25:25,000 --> 00:25:28,000
对称式的演算法它好像是数字最小的

758
00:25:28,000 --> 00:25:29,000
是没有错

759
00:25:29,000 --> 00:25:31,000
但是重点还是在于说

760
00:25:31,000 --> 00:25:33,000
它有先天的缺陷

761
00:25:33,000 --> 00:25:37,000
它会有精药传递的问题

762
00:25:37,000 --> 00:25:38,000
接下来我们就要看

763
00:25:38,000 --> 00:25:42,000
到底什么样的精药传递的问题

764
00:25:42,000 --> 00:25:43,000
我们都知道说

765
00:25:43,000 --> 00:25:46,000
你要用对圣式的加密演算法的时候

766
00:25:46,000 --> 00:25:50,000
你讯息的传送方跟接收方

767
00:25:50,000 --> 00:25:53,000
两边必须要持有同样的一把钥匙

768
00:25:53,000 --> 00:25:57,000
那其中一方用这把钥匙做加密

769
00:25:57,000 --> 00:25:58,000
另外一方有同样的钥匙

770
00:25:58,000 --> 00:26:01,000
它就可以用这把钥匙做解密

771
00:26:01,000 --> 00:26:02,000
所以我们要

772
00:26:02,000 --> 00:26:04,000
要initiate一个对话

773
00:26:04,000 --> 00:26:05,000
它大概会发生什么事

774
00:26:05,000 --> 00:26:06,000
我们首先

775
00:26:06,000 --> 00:26:07,000
我们要做加密通讯

776
00:26:07,000 --> 00:26:09,000
我们当然就要能够去加密

777
00:26:09,000 --> 00:26:12,000
这个讯息或是资料

778
00:26:12,000 --> 00:26:13,000
为了要加密这个资料

779
00:26:13,000 --> 00:26:16,000
我们会需要一把key

780
00:26:16,000 --> 00:26:17,000
那为了要

781
00:26:17,000 --> 00:26:19,000
但是我们要

782
00:26:19,000 --> 00:26:22,000
我们要如何由一方产生这把key之后

783
00:26:22,000 --> 00:26:23,000
传送到另外一方

784
00:26:23,000 --> 00:26:25,000
最直觉的方法就是

785
00:26:25,000 --> 00:26:27,000
把这把key去做加密

786
00:26:27,000 --> 00:26:29,000
要把这把key做加密的时候

787
00:26:29,000 --> 00:26:31,000
我们会需要另外一把key

788
00:26:31,000 --> 00:26:33,000
所以从这边开始下面

789
00:26:33,000 --> 00:26:35,000
就是不断的在循环

790
00:26:35,000 --> 00:26:37,000
所以经济传递的问题的意思

791
00:26:37,000 --> 00:26:38,000
是在这里

792
00:26:38,000 --> 00:26:40,000
就是说除非你很确定

793
00:26:40,000 --> 00:26:42,000
一开始就已经有

794
00:26:42,000 --> 00:26:44,000
两把重好的key在里面

795
00:26:44,000 --> 00:26:45,000
同样的一把key

796
00:26:45,000 --> 00:26:46,000
然后在这个

797
00:26:46,000 --> 00:26:48,000
讯息的传送跟接收方

798
00:26:48,000 --> 00:26:49,000
重好的里面的话

799
00:26:49,000 --> 00:26:51,000
不然在一开始

800
00:26:51,000 --> 00:26:53,000
没有共同的这把

801
00:26:53,000 --> 00:26:54,000
经济的状况下

802
00:26:54,000 --> 00:26:55,000
一定会遇到这样的问题

803
00:26:55,000 --> 00:26:56,000
就是说到底

804
00:26:56,000 --> 00:26:58,000
怎么样能够安全的传递经济

805
00:26:58,000 --> 00:27:01,000
那以密码学而言的话

806
00:27:01,000 --> 00:27:02,000
以密码学而言的话

807
00:27:02,000 --> 00:27:03,000
解决这个问题

808
00:27:03,000 --> 00:27:05,000
是有几种方法的

809
00:27:05,000 --> 00:27:08,000
那首先我们看的是第一种

810
00:27:08,000 --> 00:27:09,000
第一种当然是

811
00:27:09,000 --> 00:27:10,000
像我们刚刚讲的

812
00:27:10,000 --> 00:27:12,000
如果你在加密的时候

813
00:27:12,000 --> 00:27:14,000
使用非对称式的密码学

814
00:27:14,000 --> 00:27:16,000
也就是说我们刚刚提过那种

815
00:27:16,000 --> 00:27:19,000
用讯息接收方的A要传讯息给B

816
00:27:19,000 --> 00:27:22,000
那A把讯息用B的公要

817
00:27:22,000 --> 00:27:23,000
做加密

818
00:27:23,000 --> 00:27:25,000
然后并且让B用

819
00:27:25,000 --> 00:27:27,000
它自己的这个食药做解密

820
00:27:27,000 --> 00:27:30,000
这个是绝对可以行得通

821
00:27:30,000 --> 00:27:32,000
但是比较没有效率

822
00:27:32,000 --> 00:27:33,000
为什么

823
00:27:33,000 --> 00:27:34,000
因为最主要的问题是

824
00:27:34,000 --> 00:27:36,000
前面有提过它数学比较难

825
00:27:36,000 --> 00:27:38,000
运算比较慢

826
00:27:38,000 --> 00:27:40,000
所以我们会尽可能的

827
00:27:40,000 --> 00:27:43,000
希望能够减少

828
00:27:43,000 --> 00:27:47,000
这个非对称式加密的使用

829
00:27:47,000 --> 00:27:49,000
就加密而言

830
00:27:49,000 --> 00:27:51,000
我们绝对是希望能够使用

831
00:27:51,000 --> 00:27:53,000
对称式加密又快又安全

832
00:27:53,000 --> 00:27:54,000
是最好的

833
00:27:54,000 --> 00:27:56,000
所以只要能够解决

834
00:27:56,000 --> 00:27:59,000
那个传递经要的难题之后

835
00:27:59,000 --> 00:28:01,000
接下来我们再做

836
00:28:01,000 --> 00:28:03,000
加密沟通的时候

837
00:28:03,000 --> 00:28:05,000
都希望能够用

838
00:28:05,000 --> 00:28:08,000
对称式的算法来做

839
00:28:08,000 --> 00:28:11,000
所以第一种解决方案

840
00:28:11,000 --> 00:28:13,000
显然是不太理想

841
00:28:13,000 --> 00:28:14,000
就是说它

842
00:28:14,000 --> 00:28:15,000
因为它要用到

843
00:28:15,000 --> 00:28:16,000
比较耗费资源的

844
00:28:16,000 --> 00:28:18,000
这个非对称式的加密的做法

845
00:28:18,000 --> 00:28:20,000
所以不推荐

846
00:28:20,000 --> 00:28:23,000
好 那再来还有第二种跟第三种

847
00:28:23,000 --> 00:28:24,000
那

848
00:28:24,000 --> 00:28:33,000
好 那想接下来的话

849
00:28:33,000 --> 00:28:34,000
接下来的话

850
00:28:34,000 --> 00:28:36,000
这个我们希望能够把大家

851
00:28:36,000 --> 00:28:37,000
分成四种

852
00:28:37,000 --> 00:28:39,000
然后让大家去讨论

853
00:28:39,000 --> 00:28:42,000
然后推到我看看第二种解法

854
00:28:42,000 --> 00:28:44,000
当然我会给一定程度的提示

855
00:28:44,000 --> 00:28:49,000
那主要是有奉命要做exercise

856
00:28:49,000 --> 00:28:51,000
所以大家多包含

857
00:28:51,000 --> 00:28:54,000
那好 所以分四组的话

858
00:28:54,000 --> 00:28:59,000
那白色椅子前后是两边

859
00:28:59,000 --> 00:29:01,000
然后好 所以现在如果大家都已经知道

860
00:29:01,000 --> 00:29:03,000
自己属于哪一组的话

861
00:29:03,000 --> 00:29:06,000
那我这边再把问题描述清楚一点

862
00:29:06,000 --> 00:29:08,000
为了要解决

863
00:29:08,000 --> 00:29:10,000
为了要解决经要传递的问题

864
00:29:10,000 --> 00:29:11,000
那我们刚刚提过

865
00:29:11,000 --> 00:29:14,000
可能可以用现在上面锁裂的

866
00:29:14,000 --> 00:29:15,000
现在上面锁裂的

867
00:29:15,000 --> 00:29:16,000
你单纯的用

868
00:29:16,000 --> 00:29:18,000
非对称式的加密来做

869
00:29:18,000 --> 00:29:20,000
是不推荐 因为它比较厚重

870
00:29:20,000 --> 00:29:23,000
那有没有其他种方法

871
00:29:23,000 --> 00:29:27,000
可以混合非对称式跟对称式的使用

872
00:29:27,000 --> 00:29:29,000
可以达到我们的目的

873
00:29:29,000 --> 00:29:34,000
好 我再试着把题目说明清楚一点

874
00:29:34,000 --> 00:29:38,000
就是说为了要解决经要传递的问题

875
00:29:38,000 --> 00:29:40,000
我们的目标是希望

876
00:29:40,000 --> 00:29:43,000
沟通能够使用对称式的密码

877
00:29:43,000 --> 00:29:44,000
学研算法来做沟通

878
00:29:44,000 --> 00:29:47,000
可是那一把key要怎么办

879
00:29:47,000 --> 00:29:49,000
因为一开始没有

880
00:29:49,000 --> 00:29:54,000
两边都有同样的这把key

881
00:29:54,000 --> 00:29:56,000
希望大家可以稍微看看

882
00:29:56,000 --> 00:29:58,000
中间的那一行

883
00:29:58,000 --> 00:29:59,000
灰色的那个字

884
00:29:59,000 --> 00:30:04,000
有哪一组还需要时间讨论吗

885
00:30:04,000 --> 00:30:07,000
没有 那

886
00:30:07,000 --> 00:30:13,000
那有哪一组有人要致愿吗

887
00:30:14,000 --> 00:30:19,000
点了

888
00:30:19,000 --> 00:30:22,000
那我们这组的朋友

889
00:30:22,000 --> 00:30:24,000
可以拍一个代表回答吗

890
00:30:24,000 --> 00:30:34,000
用那个非对称式加密去加密

891
00:30:34,000 --> 00:30:36,000
你要传输的那把钥匙

892
00:30:36,000 --> 00:30:38,000
对 这样至少你

893
00:30:38,000 --> 00:30:40,000
因为钥匙的长度基本上是元小于

894
00:30:40,000 --> 00:30:42,000
你data要传输的长度

895
00:30:42,000 --> 00:30:43,000
所以这样的做法

896
00:30:43,000 --> 00:30:46,000
应该会有效的节省你的运算职员

897
00:30:46,000 --> 00:30:48,000
然后本身资料的部分

898
00:30:48,000 --> 00:30:50,000
还是用对称式加密加密就好

899
00:30:50,000 --> 00:31:01,000
非常的正确写详细

900
00:31:01,000 --> 00:31:06,000
本来应该要点第二组的

901
00:31:06,000 --> 00:31:08,000
可是Ben讲完了

902
00:31:09,000 --> 00:31:10,000
蛤

903
00:31:10,000 --> 00:31:18,000
就是得到了大家的尊重

904
00:31:18,000 --> 00:31:26,000
所以确实

905
00:31:26,000 --> 00:31:28,000
刚刚提的情境里面

906
00:31:28,000 --> 00:31:29,000
重点是在说

907
00:31:29,000 --> 00:31:31,000
最后在做加密传输

908
00:31:31,000 --> 00:31:33,000
主要的沟通的

909
00:31:33,000 --> 00:31:35,000
要加密的讯息的时候

910
00:31:35,000 --> 00:31:36,000
我们绝对是希望

911
00:31:36,000 --> 00:31:37,000
使用对称式的演算法

912
00:31:37,000 --> 00:31:39,000
是比较有效率的

913
00:31:39,000 --> 00:31:40,000
但是我们为了要解决

914
00:31:40,000 --> 00:31:42,000
前面的这个静药传递的问题

915
00:31:42,000 --> 00:31:43,000
我们可以容许

916
00:31:43,000 --> 00:31:45,000
我们稍微的使用

917
00:31:45,000 --> 00:31:48,000
非对称式的加密的方法

918
00:31:48,000 --> 00:31:50,000
来去加密那一把静药

919
00:31:50,000 --> 00:31:51,000
因为静药的长度

920
00:31:51,000 --> 00:31:53,000
绝对会是比这个讯息

921
00:31:53,000 --> 00:31:55,000
还要短上很多

922
00:31:55,000 --> 00:31:58,000
所以这边有列几个图示

923
00:31:58,000 --> 00:32:00,000
就是说

924
00:32:00,000 --> 00:32:02,000
首先我们希望最后能够使用

925
00:32:02,000 --> 00:32:05,000
这把红色的key

926
00:32:05,000 --> 00:32:06,000
来当做对称式的静药

927
00:32:06,000 --> 00:32:07,000
来做加密

928
00:32:07,000 --> 00:32:08,000
所以一开始

929
00:32:08,000 --> 00:32:09,000
我们会要怎么样做

930
00:32:09,000 --> 00:32:10,000
我们会把

931
00:32:10,000 --> 00:32:11,000
我们会把他

932
00:32:11,000 --> 00:32:13,000
没错就像刚刚这位同学讲

933
00:32:13,000 --> 00:32:15,000
就是我们会把这个钥匙

934
00:32:15,000 --> 00:32:16,000
当做是

935
00:32:16,000 --> 00:32:18,000
当做是讯息

936
00:32:18,000 --> 00:32:19,000
然后A

937
00:32:19,000 --> 00:32:22,000
用这个接收方B的公钥

938
00:32:22,000 --> 00:32:24,000
做加密之后

939
00:32:24,000 --> 00:32:25,000
然后传送B

940
00:32:25,000 --> 00:32:27,000
用他的这个私钥去做解密

941
00:32:27,000 --> 00:32:29,000
然后得到这把红色的钥匙

942
00:32:29,000 --> 00:32:31,000
接下来的沟通的话

943
00:32:31,000 --> 00:32:34,000
就会是AB双方是用这把

944
00:32:34,000 --> 00:32:35,000
已经传过来

945
00:32:35,000 --> 00:32:37,000
并且解回去的这把

946
00:32:37,000 --> 00:32:38,000
红色的钥匙

947
00:32:38,000 --> 00:32:40,000
来做讯息的加密

948
00:32:40,000 --> 00:32:43,000
所以这是简化的图示

949
00:32:43,000 --> 00:32:45,000
所以

950
00:32:45,000 --> 00:32:47,000
几个重点就是说

951
00:32:47,000 --> 00:32:49,000
非对称式的加密

952
00:32:49,000 --> 00:32:50,000
不是不能用

953
00:32:50,000 --> 00:32:51,000
而是要小心使用

954
00:32:51,000 --> 00:32:52,000
因为我们不希望

955
00:32:52,000 --> 00:32:53,000
大量的用它

956
00:32:53,000 --> 00:32:55,000
然后它会运算的时间

957
00:32:55,000 --> 00:32:56,000
比较久

958
00:32:56,000 --> 00:32:58,000
或者是耗比较多资源

959
00:32:58,000 --> 00:33:01,000
接下来的话

960
00:33:01,000 --> 00:33:02,000
我们要下一个要提的是

961
00:33:02,000 --> 00:33:03,000
这个资料完整性

962
00:33:03,000 --> 00:33:05,000
然后资料完整性的话

963
00:33:05,000 --> 00:33:06,000
像我们前面定义里面

964
00:33:06,000 --> 00:33:08,000
有看到的一个果汁机

965
00:33:08,000 --> 00:33:10,000
我们通常会使用

966
00:33:10,000 --> 00:33:11,000
杂臭函数

967
00:33:11,000 --> 00:33:13,000
来做这个资料完整性

968
00:33:13,000 --> 00:33:14,000
那

969
00:33:14,000 --> 00:33:15,000
首先杂臭函数的话

970
00:33:15,000 --> 00:33:17,000
大家可能也熟悉

971
00:33:17,000 --> 00:33:19,000
它的重点跟我们刚刚提过一样

972
00:33:19,000 --> 00:33:20,000
是说

973
00:33:20,000 --> 00:33:21,000
它是有

974
00:33:21,000 --> 00:33:24,000
它会有任意长度的输入

975
00:33:24,000 --> 00:33:26,000
把它进到这个

976
00:33:26,000 --> 00:33:27,000
Hash Function之后

977
00:33:27,000 --> 00:33:30,000
它会转成固定长度的输出

978
00:33:31,000 --> 00:33:34,000
任意长度的输入

979
00:33:34,000 --> 00:33:35,000
进果汁机之后

980
00:33:35,000 --> 00:33:37,000
出来变成固定长度的输出

981
00:33:37,000 --> 00:33:39,000
所以我们一般习惯叫

982
00:33:39,000 --> 00:33:42,000
它出来的Output叫做Digest

983
00:33:42,000 --> 00:33:43,000
就是像摘要一样

984
00:33:43,000 --> 00:33:44,000
就是讯息摘要

985
00:33:44,000 --> 00:33:46,000
但这个摘要并不包含

986
00:33:46,000 --> 00:33:49,000
它并不包含讯息

987
00:33:49,000 --> 00:33:50,000
任何字面的意思

988
00:33:50,000 --> 00:33:52,000
而是一串Hash Value

989
00:33:52,000 --> 00:33:53,000
一串Hex

990
00:33:53,000 --> 00:33:54,000
通常都是Hex

991
00:33:54,000 --> 00:33:58,000
这样的

992
00:33:58,000 --> 00:34:00,000
这样的杂臭函数

993
00:34:00,000 --> 00:34:02,000
它就有几个性质

994
00:34:02,000 --> 00:34:03,000
我们一个一个看

995
00:34:03,000 --> 00:34:04,000
首先来讲

996
00:34:04,000 --> 00:34:06,000
就是刚刚很重要的

997
00:34:06,000 --> 00:34:08,000
这个任意长度的这件事情

998
00:34:08,000 --> 00:34:11,000
依据你所使用的

999
00:34:11,000 --> 00:34:12,000
杂臭函数的不同

1000
00:34:12,000 --> 00:34:15,000
它的输出的长度也会不同

1001
00:34:15,000 --> 00:34:16,000
可能短的

1002
00:34:16,000 --> 00:34:18,000
可能128或64

1003
00:34:18,000 --> 00:34:21,000
或是到一般比较常使用的

1004
00:34:21,000 --> 00:34:24,000
256或是更长的512这种

1005
00:34:24,000 --> 00:34:25,000
但是不管怎么样

1006
00:34:25,000 --> 00:34:27,000
它都一定要能够吃

1007
00:34:27,000 --> 00:34:29,000
任意长度的输入

1008
00:34:29,000 --> 00:34:30,000
注意是任意

1009
00:34:30,000 --> 00:34:31,000
而且没有上限

1010
00:34:31,000 --> 00:34:35,000
所以这边的图示

1011
00:34:35,000 --> 00:34:36,000
大概就是这样

1012
00:34:36,000 --> 00:34:38,000
就是你不管输入的是很长的

1013
00:34:38,000 --> 00:34:39,000
或是很短的

1014
00:34:39,000 --> 00:34:41,000
只有一个字母

1015
00:34:41,000 --> 00:34:43,000
甚至是空集合

1016
00:34:43,000 --> 00:34:45,000
甚至是你的Import是空的

1017
00:34:45,000 --> 00:34:47,000
它都有办法兔东西给你

1018
00:34:47,000 --> 00:34:48,000
它都要办法兔出

1019
00:34:48,000 --> 00:34:50,000
固定长度的摘要给你

1020
00:34:50,000 --> 00:34:52,000
那当然是比较极端的例子

1021
00:34:52,000 --> 00:34:55,000
但是它必须要能够做到这件事情

1022
00:34:55,000 --> 00:34:56,000
这是第一个性质

1023
00:34:56,000 --> 00:34:58,000
就是它任意长度

1024
00:34:59,000 --> 00:35:01,000
那第二个性质这边讲的是说

1025
00:35:01,000 --> 00:35:07,000
只要你的输入是一样的

1026
00:35:07,000 --> 00:35:10,000
那你的输出就会一模一样

1027
00:35:10,000 --> 00:35:12,000
任意长度

1028
00:35:12,000 --> 00:35:13,000
所以搭配前面这个

1029
00:35:13,000 --> 00:35:14,000
你会得到说

1030
00:35:14,000 --> 00:35:16,000
任意长度的输入只要一样

1031
00:35:16,000 --> 00:35:19,000
你都可以得到短短的输出

1032
00:35:19,000 --> 00:35:21,000
而且这个短短的输出也一模一样

1033
00:35:21,000 --> 00:35:24,000
那大家可以再回想一下

1034
00:35:24,000 --> 00:35:26,000
前面我在解释资料完整的性质的时候

1035
00:35:26,000 --> 00:35:27,000
举的例子

1036
00:35:27,000 --> 00:35:29,000
就是说假设我们上传了

1037
00:35:29,000 --> 00:35:33,000
我们之前存的资料到云端硬碟里面

1038
00:35:33,000 --> 00:35:36,000
就假设我写了一本书

1039
00:35:36,000 --> 00:35:37,000
非常非常多字

1040
00:35:37,000 --> 00:35:40,000
那到这个云端连接里面

1041
00:35:40,000 --> 00:35:41,000
云端的硬碟里面

1042
00:35:41,000 --> 00:35:43,000
过一阵子我再把它当作回来

1043
00:35:43,000 --> 00:35:45,000
那但是我怎么知道

1044
00:35:45,000 --> 00:35:47,000
我怎么知道有没有人动过它

1045
00:35:47,000 --> 00:35:48,000
我不可能逐字去比对

1046
00:35:48,000 --> 00:35:51,000
所以套用到这两个性质

1047
00:35:51,000 --> 00:35:52,000
我们可以做到什么事情

1048
00:35:52,000 --> 00:35:54,000
我们可以在上传的时候

1049
00:35:54,000 --> 00:35:57,000
先把这样子的一个资料过这个 hash

1050
00:35:57,000 --> 00:35:58,000
得到一个摘要

1051
00:35:58,000 --> 00:36:01,000
到时候过了一段时间

1052
00:36:01,000 --> 00:36:03,000
我们再要把它download回来的时候

1053
00:36:03,000 --> 00:36:06,000
我们同样的把我们下载的这个 file

1054
00:36:06,000 --> 00:36:07,000
也一样过这个 hash function

1055
00:36:07,000 --> 00:36:09,000
得到一个短短的摘要

1056
00:36:09,000 --> 00:36:10,000
这个时候就会发现

1057
00:36:10,000 --> 00:36:12,000
我们只要比摘要就好

1058
00:36:12,000 --> 00:36:14,000
我们不需要去比里面

1059
00:36:14,000 --> 00:36:16,000
完整的讯息的这个内容

1060
00:36:16,000 --> 00:36:20,000
那再来是第三个性质

1061
00:36:20,000 --> 00:36:21,000
这个也跟刚刚提到的一样

1062
00:36:21,000 --> 00:36:25,000
就是说只要你有任何一点变化

1063
00:36:25,000 --> 00:36:27,000
就从这边的例子说

1064
00:36:27,000 --> 00:36:29,000
从 abc改成abd

1065
00:36:29,000 --> 00:36:32,000
那你经过 hash 出来的这个

1066
00:36:32,000 --> 00:36:34,000
出来的这个 output 会

1067
00:36:34,000 --> 00:36:36,000
会剧烈的变化

1068
00:36:36,000 --> 00:36:38,000
会大大的不相同

1069
00:36:38,000 --> 00:36:40,000
那到这边来讲

1070
00:36:40,000 --> 00:36:41,000
就有一个问题

1071
00:36:41,000 --> 00:36:42,000
就是说

1072
00:36:42,000 --> 00:36:43,000
它的重点是在说

1073
00:36:43,000 --> 00:36:45,000
你就算是只改一个 bit

1074
00:36:45,000 --> 00:36:47,000
那你出来的结果也要很不一样

1075
00:36:47,000 --> 00:36:50,000
所以下一个问题来了

1076
00:36:50,000 --> 00:36:53,000
就是说到底应该要多不一样

1077
00:36:53,000 --> 00:36:56,000
那这一题的话我们用

1078
00:36:56,000 --> 00:37:00,000
我们用投票的好了

1079
00:37:00,000 --> 00:37:01,000
那有几个选项

1080
00:37:01,000 --> 00:37:04,000
假设我们就看

1081
00:37:04,000 --> 00:37:06,000
现在的情境是在问说

1082
00:37:06,000 --> 00:37:09,000
我们把上面的 input 改了一个 bit

1083
00:37:09,000 --> 00:37:12,000
下面的这两个 output 有多不一样

1084
00:37:12,000 --> 00:37:15,000
那当然我们指的是

1085
00:37:15,000 --> 00:37:16,000
in general 情况

1086
00:37:16,000 --> 00:37:17,000
不是要去数说

1087
00:37:17,000 --> 00:37:19,000
这两个到底有多少格不一样

1088
00:37:19,000 --> 00:37:22,000
那我们就用这个

1089
00:37:22,000 --> 00:37:24,000
两个 output 它有

1090
00:37:24,000 --> 00:37:25,000
比方说完全不一样

1091
00:37:25,000 --> 00:37:27,000
我们就是100%不一样

1092
00:37:27,000 --> 00:37:31,000
或完全一样就是0%不一样

1093
00:37:31,000 --> 00:37:33,000
我们就用这个%数来做判断好了

1094
00:37:33,000 --> 00:37:35,000
那我们就开放

1095
00:37:35,000 --> 00:37:37,000
30 50 70 的选项

1096
00:37:37,000 --> 00:37:39,000
那大家认为

1097
00:37:39,000 --> 00:37:40,000
就是怎么样是

1098
00:37:40,000 --> 00:37:42,000
才是符合它这样的特性呢

1099
00:37:42,000 --> 00:37:43,000
是说

1100
00:37:43,000 --> 00:37:46,000
觉得会有30%不一样的举手

1101
00:37:48,000 --> 00:37:50,000
就是说改动

1102
00:37:50,000 --> 00:37:52,000
平均而言

1103
00:37:52,000 --> 00:37:53,000
我的 input 改动一个 bit

1104
00:37:53,000 --> 00:37:55,000
那出来的 output 这两种

1105
00:37:55,000 --> 00:37:58,000
会有30%的位元数不一样

1106
00:37:58,000 --> 00:38:00,000
好没有人

1107
00:38:00,000 --> 00:38:01,000
那50%的

1108
00:38:01,000 --> 00:38:12,000
好那 70%的

1109
00:38:14,000 --> 00:38:17,000
好那好那这边容我解释

1110
00:38:17,000 --> 00:38:18,000
就是说

1111
00:38:18,000 --> 00:38:19,000
实际上正确的答案

1112
00:38:19,000 --> 00:38:21,000
应该要是50%

1113
00:38:21,000 --> 00:38:24,000
我们期待平均而言

1114
00:38:24,000 --> 00:38:26,000
平均而言你改动了一个 bit

1115
00:38:26,000 --> 00:38:29,000
它的 output 会有50%不一样

1116
00:38:29,000 --> 00:38:31,000
为什么是50%

1117
00:38:31,000 --> 00:38:34,000
这样讲好

1118
00:38:34,000 --> 00:38:35,000
就是说

1119
00:38:35,000 --> 00:38:37,000
今天我们的课程

1120
00:38:37,000 --> 00:38:38,000
我们的课程

1121
00:38:38,000 --> 00:38:39,000
我们的课程

1122
00:38:39,000 --> 00:38:41,000
这样讲好就是说

1123
00:38:41,000 --> 00:38:42,000
今天

1124
00:38:42,000 --> 00:38:45,000
今天假设我们就玩猜数字的游戏

1125
00:38:45,000 --> 00:38:47,000
然后我说我有10个数字要猜

1126
00:38:47,000 --> 00:38:49,000
好那我从

1127
00:38:49,000 --> 00:38:50,000
一组10个数字

1128
00:38:50,000 --> 00:38:52,000
我要猜下一个

1129
00:38:52,000 --> 00:38:54,000
下一组10个数字

1130
00:38:54,000 --> 00:38:58,000
我希望它怎么样

1131
00:38:58,000 --> 00:39:00,000
设计这个题目的难度才最高

1132
00:39:00,000 --> 00:39:02,000
其实它在问的是这件事情

1133
00:39:02,000 --> 00:39:04,000
我们希望它安全

1134
00:39:04,000 --> 00:39:05,000
所以这边来讲

1135
00:39:05,000 --> 00:39:07,000
其实我们要讲的意思是说

1136
00:39:07,000 --> 00:39:10,000
它有50%不一样的时候是最安全

1137
00:39:10,000 --> 00:39:14,000
70%不一样的时候

1138
00:39:14,000 --> 00:39:16,000
我们刚刚的题目

1139
00:39:16,000 --> 00:39:18,000
刚刚我们猜10个的题目

1140
00:39:18,000 --> 00:39:20,000
我们再把它简化

1141
00:39:20,000 --> 00:39:21,000
我们是讲说

1142
00:39:21,000 --> 00:39:23,000
10个 binary bit

1143
00:39:23,000 --> 00:39:24,000
讲到 binary bit

1144
00:39:24,000 --> 00:39:26,000
我想大家可能会比较容易可以理解

1145
00:39:26,000 --> 00:39:29,000
假设这10个bit只有一根零

1146
00:39:29,000 --> 00:39:31,000
那我从这一根零

1147
00:39:31,000 --> 00:39:33,000
去猜下一组一根零的时候

1148
00:39:33,000 --> 00:39:36,000
并且如果它大部分都不一样

1149
00:39:36,000 --> 00:39:38,000
那我就知道我要反着猜

1150
00:39:38,000 --> 00:39:40,000
如果它大部分都一样

1151
00:39:40,000 --> 00:39:42,000
我就知道我不用什么改

1152
00:39:42,000 --> 00:39:43,000
猜的会比较接近

1153
00:39:43,000 --> 00:39:45,000
但是只有在它

1154
00:39:45,000 --> 00:39:47,000
一半一半不一样的时候

1155
00:39:47,000 --> 00:39:49,000
是最难猜的

1156
00:39:49,000 --> 00:39:50,000
大家可以理解吗

1157
00:39:50,000 --> 00:39:52,000
这个就是这个

1158
00:39:52,000 --> 00:39:53,000
这个其实跟我们

1159
00:39:53,000 --> 00:39:55,000
我们讲的这个

1160
00:39:55,000 --> 00:39:56,000
比方说puff

1161
00:39:56,000 --> 00:39:58,000
它有很好的叫uniqueness

1162
00:39:58,000 --> 00:39:59,000
一样的事情

1163
00:39:59,000 --> 00:40:01,000
这个我们常常会用的是叫做

1164
00:40:01,000 --> 00:40:04,000
inter-hamming distance

1165
00:40:04,000 --> 00:40:05,000
inter-hamming distance

1166
00:40:05,000 --> 00:40:08,000
就是说你今天一组128 bit of puff

1167
00:40:08,000 --> 00:40:10,000
跟另外一组128 bit of puff

1168
00:40:10,000 --> 00:40:12,000
它里面的这个值

1169
00:40:12,000 --> 00:40:13,000
大概会有多少不一样

1170
00:40:13,000 --> 00:40:15,000
其实它的大概

1171
00:40:15,000 --> 00:40:17,000
你100倍去比的话

1172
00:40:17,000 --> 00:40:18,000
大概会是50%

1173
00:40:18,000 --> 00:40:20,000
这个是nil puff的特性

1174
00:40:20,000 --> 00:40:23,000
那但是这个在密码学里面

1175
00:40:23,000 --> 00:40:24,000
是非常常见

1176
00:40:24,000 --> 00:40:26,000
也非常重要的一个性质

1177
00:40:26,000 --> 00:40:28,000
就是所谓这个改一个bit

1178
00:40:28,000 --> 00:40:29,000
就有50%不一样的

1179
00:40:29,000 --> 00:40:30,000
这个是一个理想的

1180
00:40:30,000 --> 00:40:32,000
密码学上会用到的性质

1181
00:40:32,000 --> 00:40:34,000
然后这在密码学里面叫做雪崩效应

1182
00:40:34,000 --> 00:40:35,000
就是说你只要动了一点

1183
00:40:35,000 --> 00:40:36,000
前一法动全身

1184
00:40:36,000 --> 00:40:37,000
就是你的

1185
00:40:37,000 --> 00:40:38,000
你的输入有一点变化的时候

1186
00:40:38,000 --> 00:40:40,000
你的输出会剧烈的改变

1187
00:40:40,000 --> 00:40:42,000
但是也不希望太剧烈

1188
00:40:42,000 --> 00:40:43,000
剧烈到完全变反

1189
00:40:43,000 --> 00:40:44,000
也就好猜

1190
00:40:44,000 --> 00:40:46,000
所以它其实变不一样

1191
00:40:46,000 --> 00:40:48,000
是差不多50%不一样

1192
00:40:48,000 --> 00:40:50,000
所以前面我们刚刚看到的各种

1193
00:40:50,000 --> 00:40:51,000
不管是ECC

1194
00:40:51,000 --> 00:40:52,000
不管是RSA

1195
00:40:52,000 --> 00:40:53,000
不管是AES

1196
00:40:53,000 --> 00:40:55,000
也都会具备有这种的性质

1197
00:40:55,000 --> 00:40:57,000
因为这样才会难破解

1198
00:40:57,000 --> 00:40:59,000
所以这边

1199
00:40:59,000 --> 00:41:01,000
这边是针对这样的特性

1200
00:41:01,000 --> 00:41:02,000
再做补充

1201
00:41:02,000 --> 00:41:05,000
就是说同样的一个好的杂臭寒树

1202
00:41:05,000 --> 00:41:07,000
它也势必也会带有这样的

1203
00:41:07,000 --> 00:41:09,000
雪崩效应的这个性质

1204
00:41:09,000 --> 00:41:14,000
好 那再来是第四个特性

1205
00:41:14,000 --> 00:41:16,000
第四个特性我们是讲的是叫说

1206
00:41:16,000 --> 00:41:18,000
即便问题来了

1207
00:41:18,000 --> 00:41:21,000
即便你的这个输入完全不一样

1208
00:41:21,000 --> 00:41:26,000
但是你还是有可能得到

1209
00:41:26,000 --> 00:41:28,000
同样的两个输出

1210
00:41:28,000 --> 00:41:30,000
两个一样的摘要

1211
00:41:31,000 --> 00:41:33,000
这个跟前面讲的

1212
00:41:33,000 --> 00:41:36,000
跟整个杂臭寒树的目的

1213
00:41:36,000 --> 00:41:39,000
似乎有点冲突

1214
00:41:39,000 --> 00:41:44,000
那有没有厉害的同人

1215
00:41:44,000 --> 00:41:45,000
可以发表一下

1216
00:41:45,000 --> 00:41:47,000
觉得为什么会是这样

1217
00:41:47,000 --> 00:41:54,000
好 这边我再描述了

1218
00:41:54,000 --> 00:41:56,000
再仔细一点

1219
00:41:56,000 --> 00:41:57,000
就是说

1220
00:41:57,000 --> 00:41:59,000
好 我们就假设

1221
00:41:59,000 --> 00:42:02,000
我们所使用的这一版果汁机

1222
00:42:02,000 --> 00:42:04,000
它能够出来的摘要

1223
00:42:04,000 --> 00:42:07,000
我们就说是32bit

1224
00:42:07,000 --> 00:42:13,000
那为什么有可能会发生

1225
00:42:13,000 --> 00:42:15,000
为什么有可能会发生

1226
00:42:15,000 --> 00:42:16,000
不同的输入

1227
00:42:16,000 --> 00:42:19,000
得到一样的输出的结果

1228
00:42:19,000 --> 00:42:22,000
请说

1229
00:42:24,000 --> 00:42:27,000
因为这个世界的东西

1230
00:42:27,000 --> 00:42:30,000
原比那些摘要还要多

1231
00:42:30,000 --> 00:42:32,000
所以有可能不一样的东西

1232
00:42:32,000 --> 00:42:35,000
进入这个杂臭寒树以后

1233
00:42:35,000 --> 00:42:38,000
会得到相同的数字

1234
00:42:38,000 --> 00:42:39,000
是的

1235
00:42:39,000 --> 00:42:40,000
就是

1236
00:42:40,000 --> 00:42:41,000
意思是

1237
00:42:41,000 --> 00:42:43,000
注意我们前面讲到

1238
00:42:43,000 --> 00:42:45,000
任意长度的输入

1239
00:42:45,000 --> 00:42:46,000
所以在你

1240
00:42:46,000 --> 00:42:48,000
基本上是在你输出的

1241
00:42:48,000 --> 00:42:50,000
长度是固定的状况下

1242
00:42:50,000 --> 00:42:52,000
一定一定会有机会

1243
00:42:52,000 --> 00:42:54,000
你的输入的

1244
00:42:54,000 --> 00:42:55,000
输入的纸域

1245
00:42:55,000 --> 00:42:57,000
会超过输出的纸域

1246
00:42:57,000 --> 00:42:59,000
所以

1247
00:42:59,000 --> 00:43:02,000
当然这个是必须要发生的

1248
00:43:02,000 --> 00:43:04,000
因为你的设计就是让

1249
00:43:04,000 --> 00:43:06,000
杂臭寒树可以吃

1250
00:43:06,000 --> 00:43:07,000
任意长度的输入

1251
00:43:07,000 --> 00:43:09,000
所以这个是势必会发生的

1252
00:43:09,000 --> 00:43:10,000
但是

1253
00:43:10,000 --> 00:43:12,000
但是我们一般在密码学上面

1254
00:43:12,000 --> 00:43:13,000
会用到的杂臭寒树

1255
00:43:13,000 --> 00:43:15,000
我们希望这样的发生

1256
00:43:15,000 --> 00:43:16,000
所以

1257
00:43:16,000 --> 00:43:18,000
我们把这个杂臭寒树

1258
00:43:18,000 --> 00:43:20,000
我们希望这样的发生几率

1259
00:43:20,000 --> 00:43:22,000
我们把这个叫做碰撞

1260
00:43:22,000 --> 00:43:23,000
要碰撞

1261
00:43:23,000 --> 00:43:25,000
我们希望这个发生几率极低

1262
00:43:25,000 --> 00:43:27,000
而且不能被操控

1263
00:43:27,000 --> 00:43:29,000
不能我想要它碰撞

1264
00:43:29,000 --> 00:43:30,000
它就碰撞

1265
00:43:30,000 --> 00:43:31,000
不能说

1266
00:43:31,000 --> 00:43:32,000
不能说我看到

1267
00:43:32,000 --> 00:43:33,000
我看到一个摘药

1268
00:43:33,000 --> 00:43:34,000
我就知道

1269
00:43:34,000 --> 00:43:35,000
什么样的输入

1270
00:43:35,000 --> 00:43:37,000
可以得到这样的摘药

1271
00:43:37,000 --> 00:43:40,000
不能轻易的被操作

1272
00:43:40,000 --> 00:43:42,000
所以碰撞是一定会发生

1273
00:43:42,000 --> 00:43:44,000
但是密码学上面

1274
00:43:44,000 --> 00:43:47,000
并且也不容易被实现

1275
00:43:47,000 --> 00:43:48,000
好

1276
00:43:48,000 --> 00:43:49,000
谢谢

1277
00:43:49,000 --> 00:43:51,000
再来第五项特性的话

1278
00:43:51,000 --> 00:43:53,000
前面有讲到

1279
00:43:53,000 --> 00:43:55,000
它是不可逆的

1280
00:43:55,000 --> 00:43:58,000
它是单向的寒树

1281
00:43:58,000 --> 00:44:01,000
具体为什么它是单向的

1282
00:44:01,000 --> 00:44:02,000
是因为多半

1283
00:44:02,000 --> 00:44:06,000
你就算是用哪一种的杂臭寒树

1284
00:44:06,000 --> 00:44:08,000
它的流程里面一定会包含

1285
00:44:08,000 --> 00:44:10,000
多对一的mapping

1286
00:44:10,000 --> 00:44:12,000
本来你再有输入

1287
00:44:12,000 --> 00:44:13,000
多个输入

1288
00:44:13,000 --> 00:44:14,000
可能都会得到

1289
00:44:14,000 --> 00:44:16,000
同一个输出的结果下

1290
00:44:16,000 --> 00:44:17,000
你当然不可能

1291
00:44:17,000 --> 00:44:18,000
知道那个输出

1292
00:44:18,000 --> 00:44:19,000
就返回去 偷回去输入

1293
00:44:19,000 --> 00:44:20,000
你根本就不知道

1294
00:44:20,000 --> 00:44:22,000
你要走哪一条路回去

1295
00:44:22,000 --> 00:44:23,000
这样

1296
00:44:23,000 --> 00:44:24,000
好

1297
00:44:24,000 --> 00:44:25,000
那再来是第六个性质

1298
00:44:25,000 --> 00:44:27,000
这边第六个性质是说

1299
00:44:27,000 --> 00:44:29,000
当然这样的杂臭寒树

1300
00:44:29,000 --> 00:44:30,000
会经过世代更迭

1301
00:44:30,000 --> 00:44:31,000
所以以前在用的

1302
00:44:31,000 --> 00:44:33,000
这种叫MD4/MD5

1303
00:44:33,000 --> 00:44:34,000
这叫Message Digest

1304
00:44:34,000 --> 00:44:35,000
第四代 第五代

1305
00:44:35,000 --> 00:44:36,000
这种都已经除异

1306
00:44:36,000 --> 00:44:38,000
那现在最常使用的是

1307
00:44:38,000 --> 00:44:40,000
这个红色框框框起来的

1308
00:44:40,000 --> 00:44:41,000
叫做Shadow

1309
00:44:41,000 --> 00:44:42,000
那Shadow来讲

1310
00:44:42,000 --> 00:44:44,000
它当然是有前面

1311
00:44:44,000 --> 00:44:45,000
前面几个的后代

1312
00:44:45,000 --> 00:44:47,000
就是从下凌开始

1313
00:44:47,000 --> 00:44:48,000
跟下万

1314
00:44:48,000 --> 00:44:49,000
然后到现在来讲

1315
00:44:49,000 --> 00:44:51,000
在使用的是Shadow

1316
00:44:51,000 --> 00:44:54,000
那Shadow跟Shadow来讲的话

1317
00:44:54,000 --> 00:44:54,000
它

1318
00:44:54,000 --> 00:44:55,000
Shadow是本身

1319
00:44:55,000 --> 00:44:57,000
它的演算法就有缺陷

1320
00:44:57,000 --> 00:44:58,000
那Shadow的话是它的

1321
00:44:58,000 --> 00:45:00,000
它的运算已经可以开始被

1322
00:45:00,000 --> 00:45:01,000
可以开始被超弄

1323
00:45:01,000 --> 00:45:03,000
所以已经被除异

1324
00:45:03,000 --> 00:45:05,000
那现在所使用的

1325
00:45:05,000 --> 00:45:07,000
现在所使用的Shadow呢

1326
00:45:07,000 --> 00:45:08,000
它大概是这样

1327
00:45:08,000 --> 00:45:10,000
就是说Shadow是一整个竹

1328
00:45:10,000 --> 00:45:11,000
它这个竹里面

1329
00:45:11,000 --> 00:45:13,000
它有不同的

1330
00:45:13,000 --> 00:45:14,000
不同的这个版本

1331
00:45:14,000 --> 00:45:15,000
可以让你得到

1332
00:45:15,000 --> 00:45:17,000
不同长度的摘要的输出

1333
00:45:17,000 --> 00:45:19,000
所以比方说这边是224的

1334
00:45:19,000 --> 00:45:20,000
256的

1335
00:45:20,000 --> 00:45:21,000
384 512

1336
00:45:21,000 --> 00:45:24,000
跟它这边写有512/224

1337
00:45:24,000 --> 00:45:26,000
跟512/256

1338
00:45:26,000 --> 00:45:27,000
这个是什么意思

1339
00:45:27,000 --> 00:45:28,000
这个是

1340
00:45:28,000 --> 00:45:29,000
大家补充一下就是说

1341
00:45:29,000 --> 00:45:31,000
当然这几个

1342
00:45:31,000 --> 00:45:32,000
这几个224 256

1343
00:45:32,000 --> 00:45:34,000
这些函数的构造是不同的

1344
00:45:34,000 --> 00:45:37,000
那但是只要是512开头的

1345
00:45:37,000 --> 00:45:38,000
它都是相同的

1346
00:45:38,000 --> 00:45:40,000
但是它是用

1347
00:45:40,000 --> 00:45:42,000
类似这样子512的这样的

1348
00:45:42,000 --> 00:45:43,000
函数的架构呢

1349
00:45:43,000 --> 00:45:45,000
它能够去帮你转出

1350
00:45:45,000 --> 00:45:46,000
224

1351
00:45:46,000 --> 00:45:49,000
或是256B的摘要的长度

1352
00:45:49,000 --> 00:45:50,000
它的这边的

1353
00:45:50,000 --> 00:45:52,000
slash 224或256是这个意思

1354
00:45:52,000 --> 00:45:54,000
那目前来讲

1355
00:45:54,000 --> 00:45:55,000
针对下吐

1356
00:45:55,000 --> 00:45:57,000
还并没有有效的攻击

1357
00:45:57,000 --> 00:45:59,000
那在这边讲这个

1358
00:45:59,000 --> 00:46:01,000
所谓没有有效的攻击

1359
00:46:01,000 --> 00:46:02,000
跟我们讲说可能

1360
00:46:02,000 --> 00:46:03,000
为什么我们讲说

1361
00:46:03,000 --> 00:46:04,000
下凌跟下万被破解

1362
00:46:04,000 --> 00:46:06,000
那这边给大家一个观念

1363
00:46:06,000 --> 00:46:07,000
就是说

1364
00:46:07,000 --> 00:46:09,000
所谓被破解来讲的话

1365
00:46:09,000 --> 00:46:10,000
绝对不是说你

1366
00:46:10,000 --> 00:46:12,000
马上一秒就能

1367
00:46:12,000 --> 00:46:13,000
短短的时间内

1368
00:46:13,000 --> 00:46:14,000
就能变出答案

1369
00:46:14,000 --> 00:46:15,000
不是这个意思

1370
00:46:15,000 --> 00:46:17,000
而是说

1371
00:46:17,000 --> 00:46:19,000
先从这边讲的

1372
00:46:19,000 --> 00:46:20,000
被破解来说的话

1373
00:46:20,000 --> 00:46:22,000
一般来讲说被破解

1374
00:46:22,000 --> 00:46:23,000
或是说有效的攻击

1375
00:46:23,000 --> 00:46:24,000
我们指的是说

1376
00:46:24,000 --> 00:46:26,000
有比暴力破解

1377
00:46:26,000 --> 00:46:28,000
更有效率的方法

1378
00:46:28,000 --> 00:46:31,000
可以降低它的运算的复杂度

1379
00:46:31,000 --> 00:46:33,000
这样应该比较精确

1380
00:46:33,000 --> 00:46:34,000
只要能够做到这样的话

1381
00:46:34,000 --> 00:46:36,000
那大致上我们就

1382
00:46:36,000 --> 00:46:37,000
等于说这样的

1383
00:46:37,000 --> 00:46:38,000
这样的演算法

1384
00:46:38,000 --> 00:46:40,000
它的安全性已经打折了

1385
00:46:40,000 --> 00:46:41,000
那打多少折

1386
00:46:41,000 --> 00:46:42,000
其实不用管

1387
00:46:42,000 --> 00:46:43,000
很多时候

1388
00:46:43,000 --> 00:46:45,000
当然所谓宣称被破解而言

1389
00:46:45,000 --> 00:46:47,000
它不过是运算的复杂度

1390
00:46:47,000 --> 00:46:48,000
降低了一点而已

1391
00:46:48,000 --> 00:46:50,000
降低了个二的几次方而已

1392
00:46:50,000 --> 00:46:52,000
那那个不见得

1393
00:46:52,000 --> 00:46:54,000
所以其实说真的

1394
00:46:54,000 --> 00:46:55,000
虽然说不建议使用

1395
00:46:55,000 --> 00:46:57,000
但是很多时候

1396
00:46:57,000 --> 00:46:58,000
那些被处议的

1397
00:46:58,000 --> 00:46:59,000
被处议的做法来讲

1398
00:46:59,000 --> 00:47:00,000
它其实也没有

1399
00:47:00,000 --> 00:47:02,000
没有马上就能够

1400
00:47:02,000 --> 00:47:04,000
没有马上就能够破解

1401
00:47:04,000 --> 00:47:06,000
就破密这一回事

1402
00:47:06,000 --> 00:47:07,000
并没有

1403
00:47:07,000 --> 00:47:10,000
那这边就带来

1404
00:47:10,000 --> 00:47:11,000
另外一个问题

1405
00:47:11,000 --> 00:47:13,000
就是说刚刚已经讲过说

1406
00:47:13,000 --> 00:47:14,000
刚刚已经讲过说

1407
00:47:14,000 --> 00:47:17,000
所谓的被破解

1408
00:47:17,000 --> 00:47:19,000
或是说已经被处议的这种指的是说

1409
00:47:19,000 --> 00:47:22,000
存在比暴力破解更有效的

1410
00:47:22,000 --> 00:47:23,000
更有效率的做法

1411
00:47:23,000 --> 00:47:25,000
那也有另外一种是

1412
00:47:25,000 --> 00:47:28,000
它的本身的

1413
00:47:28,000 --> 00:47:30,000
演算法的设计是有问题的

1414
00:47:30,000 --> 00:47:32,000
它是有数学上面的缺陷的

1415
00:47:32,000 --> 00:47:34,000
但是特别是像

1416
00:47:34,000 --> 00:47:35,000
数学有缺陷这件事情

1417
00:47:35,000 --> 00:47:37,000
以现在的审查制度来讲

1418
00:47:37,000 --> 00:47:40,000
现在这种都是类似去投标

1419
00:47:40,000 --> 00:47:41,000
去做竞赛的

1420
00:47:41,000 --> 00:47:42,000
以这种状况来讲

1421
00:47:42,000 --> 00:47:44,000
现在有数学缺陷

1422
00:47:44,000 --> 00:47:45,000
还能够通过

1423
00:47:45,000 --> 00:47:46,000
成为正式标准的

1424
00:47:46,000 --> 00:47:47,000
会比较难

1425
00:47:47,000 --> 00:47:49,000
就一般比较不太会有这种状况

1426
00:47:49,000 --> 00:47:50,000
以前可能会有

1427
00:47:50,000 --> 00:47:51,000
现在很少

1428
00:47:51,000 --> 00:47:53,000
那这边来讲

1429
00:47:53,000 --> 00:47:56,000
有另外一个事情要提的就是说

1430
00:47:56,000 --> 00:47:58,000
那所以所谓被破解

1431
00:47:58,000 --> 00:47:59,000
还有什么样的可能

1432
00:47:59,000 --> 00:48:01,000
其实一种是说

1433
00:48:01,000 --> 00:48:02,000
有一种简单的情境

1434
00:48:02,000 --> 00:48:04,000
就是说我们

1435
00:48:04,000 --> 00:48:07,000
我们希望这个系统安全

1436
00:48:07,000 --> 00:48:08,000
除了它的演算法

1437
00:48:08,000 --> 00:48:09,000
要健康之外

1438
00:48:09,000 --> 00:48:13,000
就是它不是被破解的演算法

1439
00:48:13,000 --> 00:48:15,000
另外一种

1440
00:48:15,000 --> 00:48:17,000
我们常常会用来保护

1441
00:48:17,000 --> 00:48:19,000
安全的一种东西

1442
00:48:19,000 --> 00:48:21,000
我们把它叫做协定

1443
00:48:21,000 --> 00:48:23,000
最简单的说法就是说

1444
00:48:23,000 --> 00:48:26,000
假设我今天

1445
00:48:26,000 --> 00:48:29,000
我所使用的加密演算法

1446
00:48:29,000 --> 00:48:32,000
它在100个microsecond

1447
00:48:32,000 --> 00:48:35,000
内会被破解

1448
00:48:35,000 --> 00:48:37,000
那很简单

1449
00:48:37,000 --> 00:48:39,000
如果还是只能使用这个的话

1450
00:48:39,000 --> 00:48:40,000
也很简单

1451
00:48:40,000 --> 00:48:42,000
我只要跟对方约定好说

1452
00:48:42,000 --> 00:48:44,000
我们10microsecond就换一次key

1453
00:48:44,000 --> 00:48:45,000
这样会让你

1454
00:48:45,000 --> 00:48:47,000
没有100microsecond去破解

1455
00:48:47,000 --> 00:48:50,000
这个就是所谓协定的意思

1456
00:48:50,000 --> 00:48:51,000
所以一般来讲

1457
00:48:51,000 --> 00:48:53,000
协定跟演算法

1458
00:48:53,000 --> 00:48:54,000
那这边我们比较

1459
00:48:54,000 --> 00:48:55,000
不会去讨论协定

1460
00:48:55,000 --> 00:48:56,000
因为协定通常来讲

1461
00:48:56,000 --> 00:48:59,000
更established

1462
00:48:59,000 --> 00:49:00,000
就比较

1463
00:49:00,000 --> 00:49:02,000
大家会都比较用

1464
00:49:02,000 --> 00:49:03,000
这种公开的标准

1465
00:49:03,000 --> 00:49:05,000
比方说Https这种东西

1466
00:49:05,000 --> 00:49:06,000
我们常常看到的

1467
00:49:06,000 --> 00:49:07,000
那所以协定这边的话

1468
00:49:07,000 --> 00:49:08,000
我们就不会再去多谈

1469
00:49:08,000 --> 00:49:09,000
这边的话

1470
00:49:09,000 --> 00:49:11,000
比较会多讲一点点的是演算法

1471
00:49:11,000 --> 00:49:16,000
好 那接下来

1472
00:49:16,000 --> 00:49:17,000
记得我们有四个

1473
00:49:17,000 --> 00:49:19,000
四个大单权目标

1474
00:49:19,000 --> 00:49:20,000
有保密性

1475
00:49:20,000 --> 00:49:22,000
有资料完整性

1476
00:49:22,000 --> 00:49:23,000
然后有认证性

1477
00:49:23,000 --> 00:49:26,000
跟不可否认性的四个

1478
00:49:26,000 --> 00:49:27,000
对应的

1479
00:49:27,000 --> 00:49:28,000
对应的有四种

1480
00:49:28,000 --> 00:49:29,000
比较常用的做法

1481
00:49:29,000 --> 00:49:30,000
就是加密

1482
00:49:30,000 --> 00:49:31,000
或者是杂售喊数

1483
00:49:31,000 --> 00:49:33,000
或者是认证

1484
00:49:33,000 --> 00:49:34,000
认证的机制

1485
00:49:34,000 --> 00:49:35,000
或者是现在要谈的

1486
00:49:35,000 --> 00:49:36,000
叫不可否认性

1487
00:49:36,000 --> 00:49:37,000
我们会用数位签张

1488
00:49:37,000 --> 00:49:39,000
注意这边我们是

1489
00:49:39,000 --> 00:49:41,000
先跳到第四项

1490
00:49:41,000 --> 00:49:43,000
先跳到不可否认性的签张

1491
00:49:43,000 --> 00:49:45,000
因为主要的原因是

1492
00:49:45,000 --> 00:49:47,000
因为认证它稍微复杂一些

1493
00:49:47,000 --> 00:49:49,000
所以我们会比较后面才提

1494
00:49:49,000 --> 00:49:54,000
好 那

1495
00:49:54,000 --> 00:49:56,000
不可否认性

1496
00:49:56,000 --> 00:49:57,000
就是说签张这件事情

1497
00:49:57,000 --> 00:49:58,000
我们前面大概有提过

1498
00:49:58,000 --> 00:50:01,000
就好比借钱之所以要签解剧

1499
00:50:01,000 --> 00:50:03,000
就是因为怕口说无评

1500
00:50:03,000 --> 00:50:05,000
所以这种情况就是说

1501
00:50:05,000 --> 00:50:07,000
的确有可能A

1502
00:50:07,000 --> 00:50:09,000
2亿的A传送了一个讯息

1503
00:50:09,000 --> 00:50:11,000
然后过了一阵子之后

1504
00:50:11,000 --> 00:50:12,000
它否认说抵赖

1505
00:50:12,000 --> 00:50:15,000
不否认说我从来没有送过

1506
00:50:15,000 --> 00:50:19,000
所以为了要解决这个问题

1507
00:50:19,000 --> 00:50:21,000
我们会用类似叫签张的方式

1508
00:50:21,000 --> 00:50:24,000
用签张的方式可以避免什么

1509
00:50:24,000 --> 00:50:26,000
可以避免两种情况

1510
00:50:26,000 --> 00:50:28,000
第一种是说

1511
00:50:28,000 --> 00:50:31,000
贸用身份的问题

1512
00:50:31,000 --> 00:50:33,000
我们会假定只有我们自己

1513
00:50:33,000 --> 00:50:35,000
才能签出我们自己的签名

1514
00:50:35,000 --> 00:50:37,000
别人没有办法伪造你的签名

1515
00:50:37,000 --> 00:50:39,000
那再来就是说

1516
00:50:39,000 --> 00:50:41,000
也一样跟前面提到说

1517
00:50:41,000 --> 00:50:43,000
有可能会伪造

1518
00:50:43,000 --> 00:50:45,000
有可能会伪造讯息

1519
00:50:45,000 --> 00:50:48,000
签张能够解决这两个问题

1520
00:50:48,000 --> 00:50:50,000
那签张

1521
00:50:50,000 --> 00:50:52,000
它也同样都是用

1522
00:50:52,000 --> 00:50:54,000
非对称式的研算法来做

1523
00:50:56,000 --> 00:50:59,000
所以它的简单的流程来讲

1524
00:50:59,000 --> 00:51:02,000
大概简单的概念大概会是说

1525
00:51:02,000 --> 00:51:04,000
同样我每一个人

1526
00:51:04,000 --> 00:51:07,000
有自己的一对私药和公药

1527
00:51:07,000 --> 00:51:09,000
并且我很有可能是

1528
00:51:09,000 --> 00:51:12,000
通常都是从私药开始去产生公药

1529
00:51:12,000 --> 00:51:15,000
那这边讲的是说

1530
00:51:15,000 --> 00:51:17,000
这边讲的是说

1531
00:51:17,000 --> 00:51:18,000
为什么会有签张

1532
00:51:18,000 --> 00:51:20,000
签张的安全基础在哪里

1533
00:51:20,000 --> 00:51:22,000
签张的安全基础是在于说

1534
00:51:22,000 --> 00:51:24,000
我只有我自己

1535
00:51:24,000 --> 00:51:25,000
拥有我自己的私药

1536
00:51:25,000 --> 00:51:27,000
因为它绝对不外泄

1537
00:51:27,000 --> 00:51:29,000
只有我自己有

1538
00:51:29,000 --> 00:51:31,000
并且我公药市善在外

1539
00:51:31,000 --> 00:51:32,000
前面也讲过

1540
00:51:32,000 --> 00:51:34,000
你单有公药是推不回私药的

1541
00:51:34,000 --> 00:51:36,000
它的数学基础

1542
00:51:36,000 --> 00:51:38,000
这两个前提之下呢

1543
00:51:38,000 --> 00:51:40,000
这两个前提之下

1544
00:51:40,000 --> 00:51:43,000
要做这个签张的人

1545
00:51:43,000 --> 00:51:45,000
要generate这个签张的人

1546
00:51:45,000 --> 00:51:47,000
他会去用他自己的私药

1547
00:51:47,000 --> 00:51:48,000
去签

1548
00:51:48,000 --> 00:51:50,000
去签一个讯息

1549
00:51:50,000 --> 00:51:52,000
然后所有其他人

1550
00:51:52,000 --> 00:51:53,000
因为都可以取得

1551
00:51:53,000 --> 00:51:55,000
这个人的公药

1552
00:51:55,000 --> 00:51:56,000
所有其他人都可以用

1553
00:51:56,000 --> 00:51:59,000
这个签数方的公药

1554
00:51:59,000 --> 00:52:01,000
来确认这个签名

1555
00:52:01,000 --> 00:52:03,000
是否有效

1556
00:52:03,000 --> 00:52:05,000
所以

1557
00:52:05,000 --> 00:52:07,000
概念跟我们一般会用蛮类式

1558
00:52:07,000 --> 00:52:09,000
假设你有去到

1559
00:52:09,000 --> 00:52:11,000
做什么签名鸡定这种

1560
00:52:11,000 --> 00:52:12,000
也是因为我们会认定

1561
00:52:12,000 --> 00:52:14,000
有人能够验得出你的签名

1562
00:52:14,000 --> 00:52:16,000
是否由你所签

1563
00:52:16,000 --> 00:52:17,000
并且我们会假定

1564
00:52:17,000 --> 00:52:19,000
只有你能签出你自己的签名

1565
00:52:19,000 --> 00:52:20,000
整个签名这件事情的

1566
00:52:20,000 --> 00:52:22,000
安全性主要是建立在这里

1567
00:52:22,000 --> 00:52:25,000
所以

1568
00:52:25,000 --> 00:52:27,000
实用上的话都会是类似说

1569
00:52:27,000 --> 00:52:29,000
我这个人他要

1570
00:52:29,000 --> 00:52:31,000
他要做签张的时候

1571
00:52:31,000 --> 00:52:33,000
对不同人

1572
00:52:33,000 --> 00:52:34,000
他都会用他同一把私药

1573
00:52:34,000 --> 00:52:36,000
去做签数

1574
00:52:36,000 --> 00:52:38,000
所有人都用

1575
00:52:38,000 --> 00:52:41,000
这个人的公药去确认

1576
00:52:41,000 --> 00:52:43,000
主义是确认这个签名

1577
00:52:43,000 --> 00:52:46,000
这个方向呢

1578
00:52:46,000 --> 00:52:47,000
跟我们前面提到过

1579
00:52:47,000 --> 00:52:48,000
用非对真实演算法

1580
00:52:48,000 --> 00:52:50,000
做加密是反过来的

1581
00:52:50,000 --> 00:52:51,000
前面我们在讲

1582
00:52:51,000 --> 00:52:52,000
非对证实的加密的时候

1583
00:52:52,000 --> 00:52:54,000
我们说

1584
00:52:54,000 --> 00:52:58,000
传送方用接收方的公药加密

1585
00:52:58,000 --> 00:53:00,000
并且只有接收方自己拥有

1586
00:53:00,000 --> 00:53:02,000
那一把私药能够去解密

1587
00:53:02,000 --> 00:53:04,000
这边的方向是反过来的

1588
00:53:04,000 --> 00:53:06,000
我要

1589
00:53:06,000 --> 00:53:08,000
issue一个签张

1590
00:53:08,000 --> 00:53:10,000
是由我自己

1591
00:53:10,000 --> 00:53:11,000
用我的私药

1592
00:53:11,000 --> 00:53:13,000
才能证明我的身份去签

1593
00:53:13,000 --> 00:53:16,000
所有人都可以用我的公药

1594
00:53:16,000 --> 00:53:18,000
去确认这个签名

1595
00:53:18,000 --> 00:53:25,000
再来我们再看一下

1596
00:53:25,000 --> 00:53:27,000
比较简易的流程

1597
00:53:27,000 --> 00:53:29,000
通常会怎么做

1598
00:53:29,000 --> 00:53:30,000
通常呢

1599
00:53:30,000 --> 00:53:31,000
我们第一步

1600
00:53:31,000 --> 00:53:34,000
会把我们所要签的这个讯息

1601
00:53:34,000 --> 00:53:36,000
我们所要签的这个讯息

1602
00:53:36,000 --> 00:53:38,000
我们先经过hash

1603
00:53:38,000 --> 00:53:40,000
得到摘药

1604
00:53:40,000 --> 00:53:42,000
再来呢

1605
00:53:42,000 --> 00:53:43,000
再来我们会用

1606
00:53:43,000 --> 00:53:44,000
这一个私药

1607
00:53:44,000 --> 00:53:45,000
我说了A要做签名

1608
00:53:45,000 --> 00:53:47,000
A会把A的私药

1609
00:53:47,000 --> 00:53:48,000
拿来

1610
00:53:48,000 --> 00:53:50,000
然后对这个

1611
00:53:50,000 --> 00:53:52,000
讯息做签张

1612
00:53:52,000 --> 00:53:53,000
但是这边我们讲

1613
00:53:53,000 --> 00:53:56,000
好比是用私药去做加密

1614
00:53:56,000 --> 00:53:57,000
所以这边的加密

1615
00:53:57,000 --> 00:53:59,000
我放了call on call

1616
00:53:59,000 --> 00:54:01,000
那

1617
00:54:01,000 --> 00:54:02,000
当然

1618
00:54:02,000 --> 00:54:03,000
为什么我们要用

1619
00:54:03,000 --> 00:54:04,000
为什么我们要经过一个hash

1620
00:54:04,000 --> 00:54:05,000
很简单

1621
00:54:05,000 --> 00:54:06,000
因为

1622
00:54:06,000 --> 00:54:07,000
背对称式的演算法

1623
00:54:07,000 --> 00:54:08,000
运算复杂

1624
00:54:08,000 --> 00:54:10,000
我们不希望它过大量的

1625
00:54:10,000 --> 00:54:12,000
大量的这个input

1626
00:54:12,000 --> 00:54:13,000
所以

1627
00:54:13,000 --> 00:54:15,000
因为我们没有

1628
00:54:15,000 --> 00:54:17,000
要去确认这个

1629
00:54:17,000 --> 00:54:18,000
就是签张来讲

1630
00:54:18,000 --> 00:54:20,000
它并没有要去

1631
00:54:20,000 --> 00:54:23,000
它并没有要带有那个讯息

1632
00:54:23,000 --> 00:54:24,000
你讯息是分开传的

1633
00:54:24,000 --> 00:54:26,000
讯息夹带签张

1634
00:54:26,000 --> 00:54:27,000
所以

1635
00:54:27,000 --> 00:54:29,000
你不用去管那个讯息

1636
00:54:29,000 --> 00:54:30,000
一不一样

1637
00:54:30,000 --> 00:54:32,000
签张里面只要包含

1638
00:54:32,000 --> 00:54:33,000
成分就可以

1639
00:54:33,000 --> 00:54:36,000
所以它会用hash

1640
00:54:36,000 --> 00:54:37,000
好

1641
00:54:37,000 --> 00:54:38,000
那

1642
00:54:38,000 --> 00:54:39,000
再来呢

1643
00:54:39,000 --> 00:54:40,000
再来它有了这个签名

1644
00:54:40,000 --> 00:54:42,000
做好了之后

1645
00:54:42,000 --> 00:54:44,000
它会把

1646
00:54:44,000 --> 00:54:46,000
讯息也传送给b

1647
00:54:46,000 --> 00:54:47,000
然后

1648
00:54:47,000 --> 00:54:48,000
签张也传送给b

1649
00:54:48,000 --> 00:54:49,000
所以刚刚讲的

1650
00:54:49,000 --> 00:54:51,000
讯息跟附件

1651
00:54:51,000 --> 00:54:52,000
这边为了简化

1652
00:54:52,000 --> 00:54:53,000
我们不去讨论

1653
00:54:53,000 --> 00:54:54,000
讯息的加密

1654
00:54:54,000 --> 00:54:55,000
我们就假设

1655
00:54:55,000 --> 00:54:56,000
不管它有没有加密

1656
00:54:56,000 --> 00:54:57,000
总之

1657
00:54:57,000 --> 00:54:58,000
这个讯息接收方

1658
00:54:58,000 --> 00:55:00,000
它得到了讯息和这个

1659
00:55:00,000 --> 00:55:02,000
签张

1660
00:55:02,000 --> 00:55:03,000
最后会做什么事

1661
00:55:03,000 --> 00:55:06,000
最后我们这个

1662
00:55:06,000 --> 00:55:07,000
接收方b

1663
00:55:07,000 --> 00:55:08,000
它会用一样的过程

1664
00:55:08,000 --> 00:55:09,000
把

1665
00:55:09,000 --> 00:55:11,000
收到的这个讯息

1666
00:55:11,000 --> 00:55:12,000
经过hash

1667
00:55:12,000 --> 00:55:14,000
也得到摘要

1668
00:55:14,000 --> 00:55:15,000
然后呢

1669
00:55:15,000 --> 00:55:17,000
把它收到的这个签张呢

1670
00:55:17,000 --> 00:55:18,000
好比

1671
00:55:18,000 --> 00:55:20,000
好比是用a的公要

1672
00:55:20,000 --> 00:55:21,000
去做解密

1673
00:55:21,000 --> 00:55:22,000
好比

1674
00:55:22,000 --> 00:55:23,000
好比是解密

1675
00:55:23,000 --> 00:55:24,000
但是

1676
00:55:24,000 --> 00:55:26,000
实际上我们就要确认

1677
00:55:26,000 --> 00:55:27,000
做一个确认的函数

1678
00:55:27,000 --> 00:55:29,000
verification的函数

1679
00:55:29,000 --> 00:55:30,000
然后最后再来

1680
00:55:30,000 --> 00:55:31,000
比对这两个hash

1681
00:55:31,000 --> 00:55:34,000
只是否相同

1682
00:55:34,000 --> 00:55:35,000
它大概是过

1683
00:55:35,000 --> 00:55:40,000
这样的过程

1684
00:55:40,000 --> 00:55:41,000
好所以到这边

1685
00:55:41,000 --> 00:55:42,000
为止有问题吗

1686
00:55:42,000 --> 00:55:49,000
好那我想

1687
00:55:49,000 --> 00:55:51,000
我们先休息

1688
00:55:51,000 --> 00:55:53,000
十

1689
00:55:53,000 --> 00:55:54,000
十分钟

1690
00:55:54,000 --> 00:55:55,000
十分钟好了

1691
00:55:55,000 --> 00:55:56,000
那我们回来的时候

1692
00:55:56,000 --> 00:55:58,000
会再接着讲第四个authentication

1693
00:55:58,000 --> 00:56:00,000
那我想时间差不多

1694
00:56:00,000 --> 00:56:01,000
我们就就继续

1695
00:56:01,000 --> 00:56:03,000
好那所以到刚刚为止

1696
00:56:03,000 --> 00:56:04,000
我们大概看了

1697
00:56:04,000 --> 00:56:06,000
四个安全目标的

1698
00:56:06,000 --> 00:56:07,000
其中三种

1699
00:56:07,000 --> 00:56:08,000
保密性

1700
00:56:08,000 --> 00:56:09,000
保密性

1701
00:56:09,000 --> 00:56:10,000
保密性

1702
00:56:10,000 --> 00:56:11,000
保密性

1703
00:56:11,000 --> 00:56:12,000
保密性

1704
00:56:12,000 --> 00:56:13,000
保密性

1705
00:56:13,000 --> 00:56:14,000
保密性

1706
00:56:14,000 --> 00:56:15,000
保密性

1707
00:56:15,000 --> 00:56:16,000
保密性

1708
00:56:16,000 --> 00:56:17,000
保密性

1709
00:56:17,000 --> 00:56:18,000
保密性

1710
00:56:18,000 --> 00:56:19,000
保密性

1711
00:56:19,000 --> 00:56:20,000
保密性

1712
00:56:20,000 --> 00:56:21,000
保密性

1713
00:56:21,000 --> 00:56:22,000
保密性

1714
00:56:22,000 --> 00:56:23,000
保密性

1715
00:56:23,000 --> 00:56:24,000
保密性

1716
00:56:24,000 --> 00:56:25,000
保密性

1717
00:56:25,000 --> 00:56:26,000
保密性

1718
00:56:26,000 --> 00:56:27,000
保密性

1719
00:56:27,000 --> 00:56:28,000
保密性

1720
00:56:28,000 --> 00:56:29,000
保密性

1721
00:56:29,000 --> 00:56:30,000
保密性

1722
00:56:30,000 --> 00:56:31,000
保密性

1723
00:56:31,000 --> 00:56:32,000
保密性

1724
00:56:32,000 --> 00:56:33,000
保密性

1725
00:56:33,000 --> 00:56:34,000
保密性

1726
00:56:34,000 --> 00:56:35,000
保密性

1727
00:56:35,000 --> 00:56:36,000
保密性

1728
00:56:36,000 --> 00:56:37,000
保密性

1729
00:56:37,000 --> 00:56:38,000
保密性

1730
00:56:38,000 --> 00:56:39,000
保密性

1731
00:56:39,000 --> 00:56:40,000
保密性

1732
00:56:40,000 --> 00:56:41,000
保密性

1733
00:56:41,000 --> 00:56:42,000
保密性

1734
00:56:42,000 --> 00:56:43,000
保密性

1735
00:56:43,000 --> 00:56:44,000
保密性

1736
00:56:44,000 --> 00:56:45,000
保密性

1737
00:56:45,000 --> 00:56:46,000
保密性

1738
00:56:46,000 --> 00:56:47,000
保密性

1739
00:56:47,000 --> 00:56:48,000
保密性

1740
00:56:48,000 --> 00:56:49,000
保密性

1741
00:56:49,000 --> 00:56:50,000
保密性

1742
00:56:50,000 --> 00:56:51,000
保密性

1743
00:56:51,000 --> 00:56:52,000
保密性

1744
00:56:52,000 --> 00:56:53,000
保密性

1745
00:56:53,000 --> 00:56:54,000
保密性

1746
00:56:54,000 --> 00:56:55,000
保密性

1747
00:56:55,000 --> 00:56:56,000
保密性

1748
00:56:56,000 --> 00:56:57,000
保密性

1749
00:56:57,000 --> 00:56:58,000
保密性

1750
00:56:58,000 --> 00:56:59,000
保密性

1751
00:56:59,000 --> 00:57:00,000
保密性

1752
00:57:00,000 --> 00:57:01,000
保密性

1753
00:57:01,000 --> 00:57:02,000
保密性

1754
00:57:02,000 --> 00:57:03,000
保密性

1755
00:57:03,000 --> 00:57:04,000
保密性

1756
00:57:04,000 --> 00:57:05,000
保密性

1757
00:57:05,000 --> 00:57:06,000
保密性

1758
00:57:06,000 --> 00:57:07,000
保密性

1759
00:57:07,000 --> 00:57:08,000
保密性

1760
00:57:08,000 --> 00:57:09,000
保密性

1761
00:57:09,000 --> 00:57:10,000
保密性

1762
00:57:10,000 --> 00:57:11,000
保密性

1763
00:57:11,000 --> 00:57:12,000
保密性

1764
00:57:12,000 --> 00:57:13,000
保密性

1765
00:57:13,000 --> 00:57:14,000
保密性

1766
00:57:14,000 --> 00:57:15,000
保密性

1767
00:57:15,000 --> 00:57:16,000
保密性

1768
00:57:16,000 --> 00:57:17,000
保密性

1769
00:57:17,000 --> 00:57:18,000
保密性

1770
00:57:18,000 --> 00:57:19,000
保密性

1771
00:57:19,000 --> 00:57:20,000
保密性

1772
00:57:20,000 --> 00:57:21,000
保密性

1773
00:57:21,000 --> 00:57:22,000
保密性

1774
00:57:22,000 --> 00:57:23,000
保密性

1775
00:57:23,000 --> 00:57:24,000
保密性

1776
00:57:24,000 --> 00:57:25,000
保密性

1777
00:57:25,000 --> 00:57:26,000
保密性

1778
00:57:26,000 --> 00:57:27,000
保密性

1779
00:57:27,000 --> 00:57:28,000
保密性

1780
00:57:28,000 --> 00:57:29,000
保密性

1781
00:57:29,000 --> 00:57:30,000
保密性

1782
00:57:30,000 --> 00:57:31,000
保密性

1783
00:57:31,000 --> 00:57:32,000
保密性

1784
00:57:32,000 --> 00:57:33,000
保密性

1785
00:57:33,000 --> 00:57:34,000
保密性

1786
00:57:34,000 --> 00:57:35,000
保密性

1787
00:57:35,000 --> 00:57:36,000
保密性

1788
00:57:36,000 --> 00:57:37,000
保密性

1789
00:57:37,000 --> 00:57:38,000
保密性

1790
00:57:38,000 --> 00:57:39,000
保密性

1791
00:57:39,000 --> 00:57:40,000
保密性

1792
00:57:40,000 --> 00:57:41,000
保密性

1793
00:57:41,000 --> 00:57:42,000
保密性

1794
00:57:42,000 --> 00:57:43,000
保密性

1795
00:57:43,000 --> 00:57:44,000
保密性

1796
00:57:44,000 --> 00:57:45,000
保密性

1797
00:57:45,000 --> 00:57:46,000
保密性

1798
00:57:46,000 --> 00:57:47,000
保密性

1799
00:57:47,000 --> 00:57:48,000
保密性

1800
00:57:48,000 --> 00:57:49,000
保密性

1801
00:57:49,000 --> 00:57:50,000
保密性

1802
00:57:50,000 --> 00:57:51,000
保密性

1803
00:57:51,000 --> 00:57:52,000
保密性

1804
00:57:52,000 --> 00:57:53,000
保密性

1805
00:57:53,000 --> 00:57:54,000
保密性

1806
00:57:54,000 --> 00:57:55,000
保密性

1807
00:57:55,000 --> 00:57:56,000
保密性

1808
00:57:56,000 --> 00:57:57,000
保密性

1809
00:57:57,000 --> 00:57:58,000
保密性

1810
00:57:58,000 --> 00:57:59,000
保密性

1811
00:57:59,000 --> 00:58:00,000
保密性

1812
00:58:00,000 --> 00:58:01,000
保密性

1813
00:58:01,000 --> 00:58:02,000
保密性

1814
00:58:02,000 --> 00:58:03,000
保密性

1815
00:58:03,000 --> 00:58:04,000
保密性

1816
00:58:04,000 --> 00:58:05,000
保密性

1817
00:58:05,000 --> 00:58:06,000
保密性

1818
00:58:06,000 --> 00:58:07,000
保密性

1819
00:58:07,000 --> 00:58:08,000
保密性

1820
00:58:08,000 --> 00:58:09,000
保密性

1821
00:58:09,000 --> 00:58:10,000
保密性

1822
00:58:10,000 --> 00:58:11,000
保密性

1823
00:58:11,000 --> 00:58:12,000
保密性

1824
00:58:12,000 --> 00:58:13,000
保密性

1825
00:58:13,000 --> 00:58:14,000
保密性

1826
00:58:14,000 --> 00:58:15,000
保密性

1827
00:58:15,000 --> 00:58:16,000
保密性

1828
00:58:16,000 --> 00:58:17,000
保密性

1829
00:58:17,000 --> 00:58:18,000
保密性

1830
00:58:18,000 --> 00:58:19,000
保密性

1831
00:58:19,000 --> 00:58:20,000
保密性

1832
00:58:20,000 --> 00:58:21,000
保密性

1833
00:58:21,000 --> 00:58:22,000
保密性

1834
00:58:22,000 --> 00:58:23,000
保密性

1835
00:58:23,000 --> 00:58:24,000
保密性

1836
00:58:24,000 --> 00:58:25,000
保密性

1837
00:58:25,000 --> 00:58:26,000
保密性

1838
00:58:26,000 --> 00:58:27,000
保密性

1839
00:58:27,000 --> 00:58:28,000
保密性

1840
00:58:28,000 --> 00:58:29,000
保密性

1841
00:58:29,000 --> 00:58:30,000
保密性

1842
00:58:30,000 --> 00:58:31,000
保密性

1843
00:58:31,000 --> 00:58:32,000
保密性

1844
00:58:32,000 --> 00:58:33,000
保密性

1845
00:58:33,000 --> 00:58:34,000
保密性

1846
00:58:34,000 --> 00:58:35,000
保密性

1847
00:58:35,000 --> 00:58:36,000
保密性

1848
00:58:36,000 --> 00:58:37,000
保密性

1849
00:58:37,000 --> 00:58:38,000
保密性

1850
00:58:38,000 --> 00:58:39,000
保密性

1851
00:58:39,000 --> 00:58:40,000
保密性

1852
00:58:40,000 --> 00:58:41,000
保密性

1853
00:58:41,000 --> 00:58:42,000
保密性

1854
00:58:42,000 --> 00:58:43,000
保密性

1855
00:58:43,000 --> 00:58:44,000
保密性

1856
00:58:44,000 --> 00:58:45,000
保密性

1857
00:58:45,000 --> 00:58:46,000
保密性

1858
00:58:46,000 --> 00:58:47,000
保密性

1859
00:58:47,000 --> 00:58:48,000
保密性

1860
00:58:48,000 --> 00:58:49,000
保密性

1861
00:58:49,000 --> 00:58:50,000
保密性

1862
00:58:50,000 --> 00:58:51,000
保密性

1863
00:58:51,000 --> 00:58:52,000
保密性

1864
00:58:52,000 --> 00:58:53,000
保密性

1865
00:58:53,000 --> 00:58:54,000
保密性

1866
00:58:54,000 --> 00:58:55,000
保密性

1867
00:58:55,000 --> 00:58:56,000
保密性

1868
00:58:56,000 --> 00:58:57,000
保密性

1869
00:58:57,000 --> 00:58:58,000
保密性

1870
00:58:58,000 --> 00:58:59,000
保密性

1871
00:58:59,000 --> 00:59:00,000
保密性

1872
00:59:00,000 --> 00:59:01,000
保密性

1873
00:59:01,000 --> 00:59:02,000
保密性

1874
00:59:02,000 --> 00:59:03,000
保密性

1875
00:59:03,000 --> 00:59:04,000
保密性

1876
00:59:04,000 --> 00:59:05,000
保密性

1877
00:59:05,000 --> 00:59:06,000
保密性

1878
00:59:06,000 --> 00:59:07,000
保密性

1879
00:59:07,000 --> 00:59:08,000
保密性

1880
00:59:08,000 --> 00:59:09,000
保密性

1881
00:59:09,000 --> 00:59:10,000
保密性

1882
00:59:10,000 --> 00:59:11,000
保密性

1883
00:59:11,000 --> 00:59:12,000
保密性

1884
00:59:12,000 --> 00:59:13,000
保密性

1885
00:59:13,000 --> 00:59:14,000
保密性

1886
00:59:14,000 --> 00:59:15,000
保密性

1887
00:59:15,000 --> 00:59:16,000
保密性

1888
00:59:16,000 --> 00:59:17,000
保密性

1889
00:59:17,000 --> 00:59:18,000
保密性

1890
00:59:18,000 --> 00:59:19,000
保密性

1891
00:59:19,000 --> 00:59:20,000
保密性

1892
00:59:20,000 --> 00:59:21,000
保密性

1893
00:59:21,000 --> 00:59:22,000
保密性

1894
00:59:22,000 --> 00:59:23,000
保密性

1895
00:59:23,000 --> 00:59:24,000
保密性

1896
00:59:24,000 --> 00:59:25,000
保密性

1897
00:59:25,000 --> 00:59:26,000
保密性

1898
00:59:26,000 --> 00:59:27,000
保密性

1899
00:59:27,000 --> 00:59:28,000
保密性

1900
00:59:28,000 --> 00:59:29,000
保密性

1901
00:59:29,000 --> 00:59:30,000
保密性

1902
00:59:30,000 --> 00:59:31,000
保密性

1903
00:59:31,000 --> 00:59:32,000
保密性

1904
00:59:32,000 --> 00:59:33,000
保密性

1905
00:59:33,000 --> 00:59:34,000
保密性

1906
00:59:34,000 --> 00:59:35,000
保密性

1907
00:59:35,000 --> 00:59:36,000
保密性

1908
00:59:36,000 --> 00:59:37,000
保密性

1909
00:59:37,000 --> 00:59:38,000
保密性

1910
00:59:38,000 --> 00:59:39,000
保密性

1911
00:59:39,000 --> 00:59:40,000
保密性

1912
00:59:40,000 --> 00:59:41,000
保密性

1913
00:59:41,000 --> 00:59:42,000
保密性

1914
00:59:42,000 --> 00:59:43,000
保密性

1915
00:59:43,000 --> 00:59:44,000
保密性

1916
00:59:44,000 --> 00:59:45,000
保密性

1917
00:59:45,000 --> 00:59:46,000
保密性

1918
00:59:46,000 --> 00:59:47,000
保密性

1919
00:59:47,000 --> 00:59:48,000
保密性

1920
00:59:48,000 --> 00:59:49,000
保密性

1921
00:59:49,000 --> 00:59:50,000
保密性

1922
00:59:50,000 --> 00:59:51,000
保密性

1923
00:59:51,000 --> 00:59:52,000
保密性

1924
00:59:52,000 --> 00:59:53,000
保密性

1925
00:59:53,000 --> 00:59:54,000
保密性

1926
00:59:54,000 --> 00:59:55,000
保密性

1927
00:59:55,000 --> 00:59:56,000
保密性

1928
00:59:56,000 --> 00:59:57,000
保密性

1929
00:59:57,000 --> 00:59:58,000
保密性

1930
00:59:58,000 --> 00:59:59,000
保密性

1931
00:59:59,000 --> 01:00:00,000
保密性

1932
01:00:00,000 --> 01:00:01,000
保密性

1933
01:00:01,000 --> 01:00:02,000
保密性

1934
01:00:02,000 --> 01:00:03,000
保密性

1935
01:00:03,000 --> 01:00:04,000
保密性

1936
01:00:04,000 --> 01:00:05,000
保密性

1937
01:00:05,000 --> 01:00:06,000
保密性

1938
01:00:06,000 --> 01:00:07,000
保密性

1939
01:00:07,000 --> 01:00:08,000
保密性

1940
01:00:08,000 --> 01:00:09,000
保密性

1941
01:00:09,000 --> 01:00:10,000
保密性

1942
01:00:10,000 --> 01:00:11,000
保密性

1943
01:00:11,000 --> 01:00:12,000
保密性

1944
01:00:12,000 --> 01:00:13,000
保密性

1945
01:00:13,000 --> 01:00:14,000
保密性

1946
01:00:14,000 --> 01:00:15,000
保密性

1947
01:00:15,000 --> 01:00:16,000
保密性

1948
01:00:16,000 --> 01:00:17,000
保密性

1949
01:00:17,000 --> 01:00:18,000
保密性

1950
01:00:18,000 --> 01:00:19,000
保密性

1951
01:00:19,000 --> 01:00:20,000
保密性

1952
01:00:20,000 --> 01:00:21,000
保密性

1953
01:00:21,000 --> 01:00:22,000
保密性

1954
01:00:22,000 --> 01:00:23,000
保密性

1955
01:00:23,000 --> 01:00:24,000
保密性

1956
01:00:24,000 --> 01:00:25,000
保密性

1957
01:00:25,000 --> 01:00:26,000
保密性

1958
01:00:26,000 --> 01:00:27,000
保密性

1959
01:00:27,000 --> 01:00:28,000
保密性

1960
01:00:28,000 --> 01:00:29,000
保密性

1961
01:00:29,000 --> 01:00:30,000
保密性

1962
01:00:30,000 --> 01:00:31,000
保密性

1963
01:00:31,000 --> 01:00:32,000
保密性

1964
01:00:32,000 --> 01:00:33,000
保密性

1965
01:00:33,000 --> 01:00:34,000
保密性

1966
01:00:34,000 --> 01:00:35,000
保密性

1967
01:00:35,000 --> 01:00:36,000
保密性

1968
01:00:36,000 --> 01:00:37,000
保密性

1969
01:00:37,000 --> 01:00:38,000
保密性

1970
01:00:38,000 --> 01:00:39,000
保密性

1971
01:00:39,000 --> 01:00:40,000
保密性

1972
01:00:40,000 --> 01:00:41,000
保密性

1973
01:00:41,000 --> 01:00:42,000
保密性

1974
01:00:42,000 --> 01:00:43,000
保密性

1975
01:00:43,000 --> 01:00:44,000
保密性

1976
01:00:44,000 --> 01:00:45,000
保密性

1977
01:00:45,000 --> 01:00:46,000
保密性

1978
01:00:46,000 --> 01:00:47,000
保密性

1979
01:00:47,000 --> 01:00:48,000
保密性

1980
01:00:48,000 --> 01:00:49,000
保密性

1981
01:00:49,000 --> 01:00:50,000
保密性

1982
01:00:50,000 --> 01:00:51,000
保密性

1983
01:00:51,000 --> 01:00:52,000
保密性

1984
01:00:52,000 --> 01:00:53,000
保密性

1985
01:00:53,000 --> 01:00:54,000
保密性

1986
01:00:54,000 --> 01:00:55,000
保密性

1987
01:00:55,000 --> 01:00:56,000
保密性

1988
01:00:56,000 --> 01:00:57,000
保密性

1989
01:00:57,000 --> 01:00:58,000
保密性

1990
01:00:58,000 --> 01:00:59,000
保密性

1991
01:00:59,000 --> 01:01:00,000
保密性

1992
01:01:00,000 --> 01:01:01,000
保密性

1993
01:01:01,000 --> 01:01:02,000
保密性

1994
01:01:02,000 --> 01:01:03,000
保密性

1995
01:01:03,000 --> 01:01:04,000
保密性

1996
01:01:04,000 --> 01:01:05,000
保密性

1997
01:01:05,000 --> 01:01:06,000
保密性

1998
01:01:06,000 --> 01:01:07,000
保密性

1999
01:01:07,000 --> 01:01:08,000
保密性

2000
01:01:08,000 --> 01:01:09,000
保密性

2001
01:01:09,000 --> 01:01:10,000
保密性

2002
01:01:10,000 --> 01:01:11,000
保密性

2003
01:01:11,000 --> 01:01:12,000
保密性

2004
01:01:12,000 --> 01:01:13,000
保密性

2005
01:01:13,000 --> 01:01:14,000
保密性

2006
01:01:14,000 --> 01:01:15,000
保密性

2007
01:01:15,000 --> 01:01:16,000
保密性

2008
01:01:16,000 --> 01:01:17,000
保密性

2009
01:01:17,000 --> 01:01:18,000
保密性

2010
01:01:18,000 --> 01:01:19,000
保密性

2011
01:01:19,000 --> 01:01:20,000
保密性

2012
01:01:20,000 --> 01:01:21,000
保密性

2013
01:01:21,000 --> 01:01:22,000
保密性

2014
01:01:22,000 --> 01:01:23,000
保密性

2015
01:01:23,000 --> 01:01:24,000
保密性

2016
01:01:24,000 --> 01:01:25,000
保密性

2017
01:01:25,000 --> 01:01:26,000
保密性

2018
01:01:26,000 --> 01:01:27,000
保密性

2019
01:01:27,000 --> 01:01:28,000
保密性

2020
01:01:28,000 --> 01:01:29,000
保密性

2021
01:01:29,000 --> 01:01:30,000
保密性

2022
01:01:30,000 --> 01:01:31,000
保密性

2023
01:01:31,000 --> 01:01:32,000
保密性

2024
01:01:32,000 --> 01:01:33,000
保密性

2025
01:01:33,000 --> 01:01:34,000
保密性

2026
01:01:34,000 --> 01:01:35,000
保密性

2027
01:01:35,000 --> 01:01:36,000
保密性

2028
01:01:36,000 --> 01:01:37,000
保密性

2029
01:01:37,000 --> 01:01:38,000
保密性

2030
01:01:38,000 --> 01:01:39,000
保密性

2031
01:01:39,000 --> 01:01:40,000
保密性

2032
01:01:40,000 --> 01:01:41,000
保密性

2033
01:01:41,000 --> 01:01:42,000
保密性

2034
01:01:42,000 --> 01:01:43,000
保密性

2035
01:01:43,000 --> 01:01:44,000
保密性

2036
01:01:44,000 --> 01:01:45,000
保密性

2037
01:01:45,000 --> 01:01:46,000
保密性

2038
01:01:46,000 --> 01:01:47,000
保密性

2039
01:01:47,000 --> 01:01:48,000
保密性

2040
01:01:48,000 --> 01:01:49,000
保密性

2041
01:01:49,000 --> 01:01:50,000
保密性

2042
01:01:50,000 --> 01:01:51,000
保密性

2043
01:01:51,000 --> 01:01:52,000
保密性

2044
01:01:52,000 --> 01:01:53,000
保密性

2045
01:01:53,000 --> 01:01:54,000
保密性

2046
01:01:54,000 --> 01:01:55,000
保密性

2047
01:01:55,000 --> 01:01:56,000
保密性

2048
01:01:56,000 --> 01:01:57,000
我們前面講過

2049
01:01:57,000 --> 01:01:58,000
我們前面講過

2050
01:01:58,000 --> 01:02:01,000
在公開精藥密碼學

2051
01:02:01,000 --> 01:02:04,000
或是叫非對趁勢密碼學的世界裡面

2052
01:02:04,000 --> 01:02:06,000
公藥可以試散在外

2053
01:02:06,000 --> 01:02:08,000
私藥只能自己持有

2054
01:02:08,000 --> 01:02:09,000
絕對不外洩

2055
01:02:09,000 --> 01:02:11,000
公藥可以試散在外代表什麼事情

2056
01:02:11,000 --> 01:02:13,000
就是說任何人都可以去access

2057
01:02:13,000 --> 01:02:16,000
或者是去派發公藥

2058
01:02:16,000 --> 01:02:17,000
但是問題在於說

2059
01:02:17,000 --> 01:02:20,000
你怎麼知道這個公藥是誰的

2060
01:02:20,000 --> 01:02:21,000
所以這邊

2061
01:02:21,000 --> 01:02:23,000
這邊我們舉一個例子

2062
01:02:23,000 --> 01:02:24,000
所以

2063
01:02:26,000 --> 01:02:28,000
這邊有一個惡意的hikex

2064
01:02:28,000 --> 01:02:29,000
他首先

2065
01:02:29,000 --> 01:02:32,000
他首先他就聲稱自己是b

2066
01:02:32,000 --> 01:02:36,000
把他的公藥px交給a

2067
01:02:36,000 --> 01:02:38,000
a不知道他以為

2068
01:02:38,000 --> 01:02:42,000
他以為這個公藥是屬於b的

2069
01:02:42,000 --> 01:02:45,000
他用這個公藥去加密訊息

2070
01:02:45,000 --> 01:02:47,000
傳給hikex

2071
01:02:47,000 --> 01:02:49,000
那hikex呢

2072
01:02:49,000 --> 01:02:51,000
他有他自己的私藥

2073
01:02:51,000 --> 01:02:53,000
他當然可以解讀這個訊息

2074
01:02:53,000 --> 01:02:54,000
這個是我們前面講的

2075
01:02:54,000 --> 01:02:56,000
非對稱勢的加密

2076
01:02:56,000 --> 01:02:57,000
各位應該還記得

2077
01:02:57,000 --> 01:03:00,000
所以他可以解讀這個訊息

2078
01:03:00,000 --> 01:03:03,000
假設他拿到的是正確的pb的話

2079
01:03:03,000 --> 01:03:05,000
他可以隨心所欲的

2080
01:03:05,000 --> 01:03:07,000
改這個訊息交給b

2081
01:03:07,000 --> 01:03:09,000
因為他有拿到b的公藥

2082
01:03:09,000 --> 01:03:12,000
並且b會依照hikex

2083
01:03:12,000 --> 01:03:13,000
所設定的

2084
01:03:13,000 --> 01:03:15,000
讓他去用他的私藥去做解密

2085
01:03:15,000 --> 01:03:18,000
然後得到一個假的訊息

2086
01:03:18,000 --> 01:03:21,000
這個是有可能發生的一種狀況

2087
01:03:21,000 --> 01:03:24,000
那大家可以想更恐怖的狀況

2088
01:03:24,000 --> 01:03:26,000
會是說他可以

2089
01:03:26,000 --> 01:03:29,000
他可以自己解讀這個訊息之外

2090
01:03:29,000 --> 01:03:32,000
他甚至可以把正確的訊息傳給b

2091
01:03:32,000 --> 01:03:33,000
他可以

2092
01:03:33,000 --> 01:03:37,000
並且ab以為溝通暢通無阻

2093
01:03:37,000 --> 01:03:39,000
可是不知道有人完全的

2094
01:03:39,000 --> 01:03:41,000
竊聽了這整個通訊

2095
01:03:41,000 --> 01:03:42,000
各位應該可以想像

2096
01:03:42,000 --> 01:03:44,000
就是這兩種都是有可能發生的

2097
01:03:44,000 --> 01:03:46,000
所以這樣的關鍵的

2098
01:03:46,000 --> 01:03:48,000
這樣的事發的原因是在於說

2099
01:03:48,000 --> 01:03:51,000
所以認錯了這一把公藥

2100
01:03:51,000 --> 01:03:53,000
以為他是合法的

2101
01:03:53,000 --> 01:03:54,000
以為他是合法的

2102
01:03:54,000 --> 01:03:56,000
接收方b的公藥

2103
01:03:56,000 --> 01:03:58,000
但其實他是hikex的公藥

2104
01:03:58,000 --> 01:04:00,000
因為我們前面講過

2105
01:04:00,000 --> 01:04:01,000
公藥是站在外

2106
01:04:01,000 --> 01:04:02,000
但是你不知道

2107
01:04:02,000 --> 01:04:04,000
如何去證明這個公藥的身份

2108
01:04:04,000 --> 01:04:10,000
OK 所以像前面講的

2109
01:04:10,000 --> 01:04:13,000
假設有這個平正

2110
01:04:13,000 --> 01:04:14,000
那事先

2111
01:04:14,000 --> 01:04:17,000
a就先把他的平正交給b

2112
01:04:17,000 --> 01:04:19,000
我們再回頭看一下

2113
01:04:19,000 --> 01:04:21,000
平正的內容有什麼呢

2114
01:04:21,000 --> 01:04:23,000
平正的內容有a的身份

2115
01:04:23,000 --> 01:04:25,000
要知道這個是誰

2116
01:04:25,000 --> 01:04:27,000
綁定了他的這個公藥

2117
01:04:27,000 --> 01:04:29,000
這樣就把身份跟公藥

2118
01:04:29,000 --> 01:04:30,000
綁定在一起了

2119
01:04:30,000 --> 01:04:32,000
那再來他會有一個

2120
01:04:32,000 --> 01:04:34,000
這邊有一個ca在這裡

2121
01:04:34,000 --> 01:04:36,000
就是說這個

2122
01:04:36,000 --> 01:04:39,000
這一個平正是由ca所頒發

2123
01:04:39,000 --> 01:04:42,000
並且有ca的簽名

2124
01:04:42,000 --> 01:04:45,000
換回我們具體點的例子來講

2125
01:04:45,000 --> 01:04:46,000
我們的身份證會有什麼

2126
01:04:46,000 --> 01:04:48,000
就是我們的身份證會有

2127
01:04:48,000 --> 01:04:50,000
會有我們的

2128
01:04:50,000 --> 01:04:51,000
到底是誰

2129
01:04:51,000 --> 01:04:52,000
我們的一些個人的資訊

2130
01:04:52,000 --> 01:04:54,000
父母配有什麼的

2131
01:04:54,000 --> 01:04:56,000
並且有我們最重要的那一個

2132
01:04:56,000 --> 01:04:58,000
用來證明身份用的那一個

2133
01:04:58,000 --> 01:05:00,000
我們可能叫做身份證字號

2134
01:05:00,000 --> 01:05:03,000
那同時他會告訴你說

2135
01:05:03,000 --> 01:05:05,000
到底這個是

2136
01:05:05,000 --> 01:05:06,000
這個到底是什麼證

2137
01:05:06,000 --> 01:05:07,000
為什麼它是身份證

2138
01:05:07,000 --> 01:05:08,000
是因為它的規定是這樣

2139
01:05:08,000 --> 01:05:09,000
那就是說

2140
01:05:09,000 --> 01:05:11,000
它是由什麼機構所頒發

2141
01:05:11,000 --> 01:05:13,000
然後怎麼做成這樣身份證

2142
01:05:13,000 --> 01:05:15,000
然後跟一些你

2143
01:05:15,000 --> 01:05:17,000
絕對不可能去

2144
01:05:17,000 --> 01:05:20,000
輕易去篡改的一些加工

2145
01:05:20,000 --> 01:05:23,000
大概的概念是類似這樣子

2146
01:05:23,000 --> 01:05:25,000
所以只要今天

2147
01:05:25,000 --> 01:05:28,000
a有先把這個平正交給b

2148
01:05:28,000 --> 01:05:30,000
這個平正上面會宰明

2149
01:05:30,000 --> 01:05:31,000
a到底是誰

2150
01:05:31,000 --> 01:05:33,000
公藥到底是什麼

2151
01:05:33,000 --> 01:05:35,000
那再來

2152
01:05:35,000 --> 01:05:38,000
hikex要去冒充成a的時候

2153
01:05:38,000 --> 01:05:39,000
它就會遇到問題

2154
01:05:39,000 --> 01:05:41,000
因為它沒有辦法提出

2155
01:05:41,000 --> 01:05:42,000
它沒有辦法提出

2156
01:05:42,000 --> 01:05:44,000
正確的公藥加上

2157
01:05:44,000 --> 01:05:45,000
它的

2158
01:05:45,000 --> 01:05:46,000
它沒有辦法提出

2159
01:05:46,000 --> 01:05:48,000
一個偽造的證書

2160
01:05:48,000 --> 01:05:50,000
沒有辦法把它的公藥px

2161
01:05:50,000 --> 01:05:53,000
跟a的身份綁在一起

2162
01:05:53,000 --> 01:05:54,000
因為a的身份

2163
01:05:54,000 --> 01:05:56,000
已經跟a的公藥綁在一起了

2164
01:05:56,000 --> 01:06:00,000
它的大概的概念是這樣子

2165
01:06:00,000 --> 01:06:02,000
好 那我們這邊

2166
01:06:02,000 --> 01:06:03,000
會先看一個檢圖

2167
01:06:03,000 --> 01:06:06,000
是說到底這個證書

2168
01:06:06,000 --> 01:06:07,000
是怎麼樣

2169
01:06:07,000 --> 01:06:10,000
平正是怎麼樣做出來的

2170
01:06:10,000 --> 01:06:11,000
所以前面講過了

2171
01:06:11,000 --> 01:06:13,000
我們這裡面我們講的是

2172
01:06:13,000 --> 01:06:14,000
我們要去證明

2173
01:06:14,000 --> 01:06:16,000
我們要做一張給b的平正

2174
01:06:16,000 --> 01:06:19,000
那我們分為左半邊是

2175
01:06:19,000 --> 01:06:21,000
就是左半邊是

2176
01:06:21,000 --> 01:06:24,000
建立這個平正的過程

2177
01:06:24,000 --> 01:06:25,000
右半邊是

2178
01:06:25,000 --> 01:06:27,000
確認這個平正的過程

2179
01:06:27,000 --> 01:06:28,000
左半邊來講

2180
01:06:28,000 --> 01:06:30,000
我們先從它的成份來

2181
01:06:30,000 --> 01:06:32,000
它會包含b的id

2182
01:06:32,000 --> 01:06:35,000
就是它的個人的一些資訊

2183
01:06:35,000 --> 01:06:38,000
跟最重要的b的公藥

2184
01:06:38,000 --> 01:06:39,000
然後再來

2185
01:06:39,000 --> 01:06:42,000
這一張平正是由誰所牽發的

2186
01:06:42,000 --> 01:06:44,000
然後最後下面再配合

2187
01:06:44,000 --> 01:06:46,000
一段牽張

2188
01:06:46,000 --> 01:06:48,000
那他怎麼做的

2189
01:06:48,000 --> 01:06:50,000
他會把前面這三個

2190
01:06:50,000 --> 01:06:52,000
上面這三個成份

2191
01:06:52,000 --> 01:06:54,000
過一個hash一樣

2192
01:06:54,000 --> 01:06:55,000
過一個hash

2193
01:06:55,000 --> 01:06:57,000
然後得到一個短的摘要

2194
01:06:57,000 --> 01:07:00,000
再來就是用牽張

2195
01:07:00,000 --> 01:07:01,000
我們剛剛講說

2196
01:07:01,000 --> 01:07:03,000
牽張是類似於你用

2197
01:07:03,000 --> 01:07:05,000
私藥去做加密

2198
01:07:05,000 --> 01:07:06,000
這邊的話

2199
01:07:06,000 --> 01:07:10,000
這個牽張是由ca來做的

2200
01:07:10,000 --> 01:07:12,000
由國家單位

2201
01:07:12,000 --> 01:07:16,000
或是平正機構來幫你的公藥背書

2202
01:07:16,000 --> 01:07:18,000
他用他的私藥去牽

2203
01:07:18,000 --> 01:07:20,000
得到了這個牽張

2204
01:07:20,000 --> 01:07:23,000
所以把這三個資訊

2205
01:07:23,000 --> 01:07:26,000
跟這一個牽張的復健

2206
01:07:26,000 --> 01:07:27,000
組合起來

2207
01:07:27,000 --> 01:07:29,000
這就是一張完整的平正

2208
01:07:29,000 --> 01:07:30,000
那這樣的平正

2209
01:07:30,000 --> 01:07:32,000
收到的人會做什麼事

2210
01:07:32,000 --> 01:07:33,000
收到的人會一樣

2211
01:07:33,000 --> 01:07:36,000
把這三個資訊過hash

2212
01:07:36,000 --> 01:07:39,000
並且也就是去verify這個signature

2213
01:07:39,000 --> 01:07:41,000
確認這個牽名

2214
01:07:41,000 --> 01:07:43,000
他們會用ca的公藥

2215
01:07:43,000 --> 01:07:47,000
來去類似於對這個牽張做解密

2216
01:07:47,000 --> 01:07:49,000
或是我們叫做確認牽名

2217
01:07:49,000 --> 01:07:50,000
得出來的是

2218
01:07:50,000 --> 01:07:55,000
應該要跟這個hash能夠做比對

2219
01:07:55,000 --> 01:07:59,000
這個會太複雜嗎

2220
01:07:59,000 --> 01:08:00,000
好

2221
01:08:00,000 --> 01:08:03,000
所以整體來說

2222
01:08:03,000 --> 01:08:06,000
這樣的就包含了說

2223
01:08:06,000 --> 01:08:07,000
應該說

2224
01:08:07,000 --> 01:08:09,000
整件事情的關鍵在於

2225
01:08:09,000 --> 01:08:11,000
我們如何解決公藥

2226
01:08:11,000 --> 01:08:13,000
事善在外不可信的問題

2227
01:08:13,000 --> 01:08:16,000
他的解法其實非常的單純

2228
01:08:16,000 --> 01:08:18,000
我們就是找人幫我們背書

2229
01:08:18,000 --> 01:08:20,000
找人幫我們背書

2230
01:08:20,000 --> 01:08:22,000
誰有資格幫我們背書

2231
01:08:22,000 --> 01:08:24,000
誰有資格幫我們背書

2232
01:08:24,000 --> 01:08:26,000
誰有資格幫我們背書的話

2233
01:08:26,000 --> 01:08:27,000
那個答案會是說

2234
01:08:27,000 --> 01:08:31,000
我們不會去懷疑他的公藥

2235
01:08:31,000 --> 01:08:33,000
普通人的公藥我們不信

2236
01:08:33,000 --> 01:08:35,000
有利人士的公藥我們相信

2237
01:08:35,000 --> 01:08:36,000
關鍵就在這裡

2238
01:08:36,000 --> 01:08:40,000
他的解法就是這麼樣的單純

2239
01:08:40,000 --> 01:08:41,000
所以等於說

2240
01:08:41,000 --> 01:08:43,000
再回來看到這邊的關鍵是什麼

2241
01:08:43,000 --> 01:08:46,000
你明明就已經要證明公藥

2242
01:08:46,000 --> 01:08:47,000
公藥跟身份的關係了

2243
01:08:47,000 --> 01:08:48,000
為什麼你這邊可以用一個

2244
01:08:48,000 --> 01:08:51,000
CA的公藥去確認這個牽名

2245
01:08:51,000 --> 01:08:52,000
原因很單純

2246
01:08:52,000 --> 01:08:53,000
因為CA是有利人士

2247
01:08:53,000 --> 01:08:55,000
我們不會去懷疑他的公藥

2248
01:08:55,000 --> 01:08:58,000
就這樣而已

2249
01:08:58,000 --> 01:08:59,000
那當然來講

2250
01:08:59,000 --> 01:09:02,000
這樣的CA就會慢慢的構成

2251
01:09:02,000 --> 01:09:04,000
一個類似塑狀的結構

2252
01:09:04,000 --> 01:09:08,000
你可能有普通等級的有利人士

2253
01:09:08,000 --> 01:09:10,000
然後可能到什麼地方

2254
01:09:10,000 --> 01:09:13,000
代表往上一路到政府之類的

2255
01:09:13,000 --> 01:09:14,000
這樣子的情況

2256
01:09:14,000 --> 01:09:16,000
那可能就會最後停在一個

2257
01:09:16,000 --> 01:09:18,000
RootCA這樣的一個機構

2258
01:09:18,000 --> 01:09:22,000
並且他的平正是由自己來牽自己

2259
01:09:22,000 --> 01:09:27,000
因為他是最有利的人士

2260
01:09:27,000 --> 01:09:29,000
所以剛剛提的是

2261
01:09:29,000 --> 01:09:30,000
比較簡化的情境

2262
01:09:30,000 --> 01:09:31,000
就是說

2263
01:09:31,000 --> 01:09:33,000
我們剛剛所提到的這個平正

2264
01:09:33,000 --> 01:09:36,000
大概是包含這幾個基本的資訊

2265
01:09:36,000 --> 01:09:38,000
實務上來講的話

2266
01:09:38,000 --> 01:09:41,000
現在流通比較常使用的

2267
01:09:41,000 --> 01:09:42,000
這個平正的系統

2268
01:09:42,000 --> 01:09:44,000
我們都是叫做XDN509

2269
01:09:44,000 --> 01:09:45,000
這一套的平正

2270
01:09:45,000 --> 01:09:48,000
它現在是在第七版

2271
01:09:48,000 --> 01:09:50,000
簡單的講它的內容的話

2272
01:09:50,000 --> 01:09:52,000
左邊這個是它完整的

2273
01:09:52,000 --> 01:09:54,000
平正的資料結構

2274
01:09:54,000 --> 01:09:57,000
它裡面會包含很快的代過

2275
01:09:57,000 --> 01:09:59,000
就是除了剛剛提到的那些簡易的話

2276
01:09:59,000 --> 01:10:01,000
包含它的版本號

2277
01:10:01,000 --> 01:10:04,000
可能它的證書號

2278
01:10:04,000 --> 01:10:06,000
或者是說它用哪些演算法

2279
01:10:06,000 --> 01:10:07,000
它是用哪些演算法做的平正

2280
01:10:07,000 --> 01:10:09,000
因為有不同的演算法可以做

2281
01:10:09,000 --> 01:10:11,000
或者說它用哪一個演算法

2282
01:10:11,000 --> 01:10:13,000
跟哪一些參數等等的這些資訊

2283
01:10:13,000 --> 01:10:16,000
總之意思跟前面我們看到的製作平正

2284
01:10:16,000 --> 01:10:19,000
確認平正的那一套是類似的

2285
01:10:19,000 --> 01:10:21,000
並且它也會有另外一個是

2286
01:10:21,000 --> 01:10:24,000
叫做Revocation List

2287
01:10:24,000 --> 01:10:26,000
就是說你平正會有效期

2288
01:10:26,000 --> 01:10:28,000
當然我們希望你過一陣子之後

2289
01:10:28,000 --> 01:10:30,000
再去更新的平正

2290
01:10:30,000 --> 01:10:32,000
所以它會有一個

2291
01:10:32,000 --> 01:10:33,000
平正撤回的時候

2292
01:10:33,000 --> 01:10:35,000
它也需要留存做記錄

2293
01:10:35,000 --> 01:10:37,000
然後以後可以做集合

2294
01:10:37,000 --> 01:10:40,000
所以這樣的提這件事情的重點

2295
01:10:40,000 --> 01:10:42,000
是跟大家講說

2296
01:10:42,000 --> 01:10:44,000
現在來講最常使用的

2297
01:10:44,000 --> 01:10:46,000
不管是在怎麼樣的

2298
01:10:46,000 --> 01:10:48,000
Cloud的結構什麼都會用這種

2299
01:10:48,000 --> 01:10:51,000
叫做公開機要基礎建設

2300
01:10:51,000 --> 01:10:52,000
Infrastructure

2301
01:10:52,000 --> 01:10:54,000
或者叫做Public Infrastructure

2302
01:10:54,000 --> 01:10:56,000
就是PKI這種東西

2303
01:10:56,000 --> 01:10:57,000
這個東西的重點是什麼

2304
01:10:57,000 --> 01:10:59,000
我們這邊提供一個簡單的定義

2305
01:10:59,000 --> 01:11:01,000
就是說它是有可能是有硬體

2306
01:11:01,000 --> 01:11:04,000
有軟體 有人 有政策 有流程

2307
01:11:04,000 --> 01:11:06,000
但是它來做什麼呢

2308
01:11:06,000 --> 01:11:10,000
它會去建立 管理 儲存

2309
01:11:10,000 --> 01:11:12,000
派發 或者是去撤回平正

2310
01:11:12,000 --> 01:11:14,000
這邊的重點是在於說

2311
01:11:14,000 --> 01:11:16,000
它整件事情整個Public Infrastructure

2312
01:11:16,000 --> 01:11:19,000
它能夠去做認證的基礎

2313
01:11:19,000 --> 01:11:22,000
都建立在平正上面

2314
01:11:22,000 --> 01:11:24,000
下面這邊就是

2315
01:11:24,000 --> 01:11:26,000
下面這邊就是在多一些包含說

2316
01:11:26,000 --> 01:11:29,000
那它的PKI裡面有什麼樣的成員

2317
01:11:29,000 --> 01:11:32,000
成員可能就會有各個

2318
01:11:32,000 --> 01:11:35,000
中端的實體 比如說像Baba

2319
01:11:35,000 --> 01:11:37,000
可能是系統裡面的成員

2320
01:11:37,000 --> 01:11:40,000
然後是也會有我們剛剛講到的CA

2321
01:11:40,000 --> 01:11:42,000
那有CA之外

2322
01:11:42,000 --> 01:11:43,000
也有可能會有RA

2323
01:11:43,000 --> 01:11:45,000
RA是專門做註冊的

2324
01:11:45,000 --> 01:11:49,000
就是說剛剛在我們舉的例子裡面

2325
01:11:49,000 --> 01:11:51,000
我們人去互證事務所辦

2326
01:11:51,000 --> 01:11:53,000
然後拿到的身份證

2327
01:11:53,000 --> 01:11:55,000
之所以我們以後能夠用身份證

2328
01:11:55,000 --> 01:11:56,000
暢行無足

2329
01:11:56,000 --> 01:11:58,000
是因為我們在去辦的時候

2330
01:11:58,000 --> 01:12:00,000
它經過了嚴格的確認

2331
01:12:00,000 --> 01:12:01,000
確認你是正確的人

2332
01:12:01,000 --> 01:12:03,000
才頒發給你的身份證

2333
01:12:03,000 --> 01:12:04,000
所以註冊的時候

2334
01:12:04,000 --> 01:12:05,000
也是非常重要的一步

2335
01:12:05,000 --> 01:12:07,000
你當然不會希望說

2336
01:12:07,000 --> 01:12:09,000
註冊的時候可以輕易的

2337
01:12:09,000 --> 01:12:11,000
可以輕易的把hikex的身份

2338
01:12:11,000 --> 01:12:14,000
跟a的公要綁在一起

2339
01:12:14,000 --> 01:12:16,000
所以註冊也是另外一個難題

2340
01:12:16,000 --> 01:12:17,000
所以註冊有可能是會分開

2341
01:12:17,000 --> 01:12:19,000
另外一個RA來做的

2342
01:12:19,000 --> 01:12:20,000
然後並且也會有

2343
01:12:20,000 --> 01:12:23,000
平正撤回叫revocation list

2344
01:12:23,000 --> 01:12:26,000
revocation list的管理

2345
01:12:26,000 --> 01:12:29,000
跟最後就是storage

2346
01:12:29,000 --> 01:12:31,000
所以整個PK大概會有

2347
01:12:31,000 --> 01:12:33,000
類似這樣的架構

2348
01:12:33,000 --> 01:12:35,000
跟它的目的是在這裡

2349
01:12:35,000 --> 01:12:39,000
所以重點還是回到說

2350
01:12:39,000 --> 01:12:41,000
現在來講最常用的這些

2351
01:12:41,000 --> 01:12:43,000
特別是認證的手段

2352
01:12:43,000 --> 01:12:46,000
大部分都圍繞在這個平正上面

2353
01:12:49,000 --> 01:12:53,000
所以到剛剛為止

2354
01:12:53,000 --> 01:12:56,000
大概講了這個

2355
01:12:56,000 --> 01:12:58,000
我們大概已經完成了

2356
01:12:58,000 --> 01:13:00,000
四個安全的目標

2357
01:13:00,000 --> 01:13:04,000
那剛剛才講完的認證

2358
01:13:04,000 --> 01:13:05,000
我們有講了

2359
01:13:05,000 --> 01:13:06,000
所謂有對稱式的

2360
01:13:06,000 --> 01:13:08,000
跟非對稱式的認證

2361
01:13:08,000 --> 01:13:10,000
再來的話

2362
01:13:10,000 --> 01:13:11,000
我們要提的是

2363
01:13:11,000 --> 01:13:13,000
這邊先幫大家整理了

2364
01:13:13,000 --> 01:13:15,000
我們前面所提過的

2365
01:13:15,000 --> 01:13:17,000
下面有四個

2366
01:13:17,000 --> 01:13:19,000
我們前面提到的安全的目標

2367
01:13:19,000 --> 01:13:20,000
跟對應的做法

2368
01:13:20,000 --> 01:13:22,000
在以保密性而言

2369
01:13:22,000 --> 01:13:24,000
我們會利用加密

2370
01:13:24,000 --> 01:13:25,000
那可能包含了

2371
01:13:25,000 --> 01:13:27,000
對稱跟非對稱式的加密

2372
01:13:27,000 --> 01:13:28,000
那資料完整性的話

2373
01:13:28,000 --> 01:13:29,000
我們用雜湊含數

2374
01:13:29,000 --> 01:13:31,000
用來比對摘要是否一樣

2375
01:13:31,000 --> 01:13:33,000
來確認資料完整性

2376
01:13:33,000 --> 01:13:34,000
這個認證的話

2377
01:13:34,000 --> 01:13:36,000
剛剛最後提的比較難一點

2378
01:13:36,000 --> 01:13:37,000
那我們會用對稱式的

2379
01:13:37,000 --> 01:13:40,000
我們會用訊息認證碼

2380
01:13:40,000 --> 01:13:42,000
或者是用非對稱式的時候

2381
01:13:42,000 --> 01:13:45,000
我們會用這個平正來做

2382
01:13:45,000 --> 01:13:46,000
不可否認信的話

2383
01:13:46,000 --> 01:13:48,000
就通常是依靠數位簽章

2384
01:13:48,000 --> 01:13:51,000
那可以值得注意的是說

2385
01:13:51,000 --> 01:13:52,000
這裡面大部分

2386
01:13:52,000 --> 01:13:53,000
都會有牽涉到key

2387
01:13:53,000 --> 01:13:54,000
所以其實在

2388
01:13:54,000 --> 01:13:56,000
我們在講整套

2389
01:13:56,000 --> 01:13:57,000
要去做密碼學的時候

2390
01:13:57,000 --> 01:13:58,000
也有一個足

2391
01:13:58,000 --> 01:14:00,000
也有一個種類的算法

2392
01:14:00,000 --> 01:14:01,000
是很常會被用到的

2393
01:14:01,000 --> 01:14:04,000
它都是跟精藥有關

2394
01:14:04,000 --> 01:14:05,000
那我們這邊放叫key schemes

2395
01:14:05,000 --> 01:14:06,000
那接下來要講的

2396
01:14:06,000 --> 01:14:07,000
就是其中一個

2397
01:14:07,000 --> 01:14:09,000
叫做share secret

2398
01:14:09,000 --> 01:14:13,000
所以在講share secret之前

2399
01:14:13,000 --> 01:14:14,000
我們要回顧一下

2400
01:14:14,000 --> 01:14:16,000
前面所提到的精藥傳遞的問題

2401
01:14:16,000 --> 01:14:17,000
再一次呢

2402
01:14:17,000 --> 01:14:18,000
這個精藥的傳遞的問題

2403
01:14:18,000 --> 01:14:19,000
是來自於說

2404
01:14:19,000 --> 01:14:21,000
你在要做正常的加密

2405
01:14:21,000 --> 01:14:22,000
傳輸訊息的時候

2406
01:14:22,000 --> 01:14:23,000
我們會推薦

2407
01:14:23,000 --> 01:14:25,000
使用對稱式的加密演算法

2408
01:14:25,000 --> 01:14:27,000
比較快也很安全

2409
01:14:27,000 --> 01:14:29,000
但是它的致命的缺陷是在於說

2410
01:14:29,000 --> 01:14:30,000
你會需要有

2411
01:14:30,000 --> 01:14:32,000
包含有精藥的傳遞

2412
01:14:32,000 --> 01:14:33,000
所以前面講過了

2413
01:14:33,000 --> 01:14:35,000
兩種解決這個

2414
01:14:35,000 --> 01:14:36,000
精藥傳遞問題的方法

2415
01:14:36,000 --> 01:14:37,000
第一種是說

2416
01:14:37,000 --> 01:14:39,000
你就單純的直接使用

2417
01:14:39,000 --> 01:14:41,000
非對稱式精藥來做

2418
01:14:41,000 --> 01:14:43,000
那這個比較不推薦

2419
01:14:43,000 --> 01:14:44,000
因為你會變成

2420
01:14:44,000 --> 01:14:45,000
你會用複雜的算法

2421
01:14:45,000 --> 01:14:47,000
去算到大量的這個資料

2422
01:14:47,000 --> 01:14:49,000
那第二種我們提的是說

2423
01:14:49,000 --> 01:14:50,000
我們簡化一些

2424
01:14:50,000 --> 01:14:51,000
我們先用

2425
01:14:51,000 --> 01:14:53,000
先用這個非對稱式的加密

2426
01:14:53,000 --> 01:14:55,000
來把鑰匙做加密

2427
01:14:55,000 --> 01:14:57,000
之後我們就用那一把鑰匙

2428
01:14:57,000 --> 01:14:59,000
來做對稱式的溝通

2429
01:14:59,000 --> 01:15:00,000
那現在要講的這種

2430
01:15:00,000 --> 01:15:02,000
就叫做用精藥交換的協定

2431
01:15:02,000 --> 01:15:03,000
那這個是

2432
01:15:03,000 --> 01:15:05,000
其實是一種更快的做法

2433
01:15:05,000 --> 01:15:07,000
你只要有公司藥就可以做了

2434
01:15:07,000 --> 01:15:09,000
那大部分的

2435
01:15:09,000 --> 01:15:10,000
我們大部分的這種

2436
01:15:10,000 --> 01:15:12,000
這種精藥交換的協定

2437
01:15:12,000 --> 01:15:13,000
前面有提過

2438
01:15:13,000 --> 01:15:15,000
都是都是跟源於一種

2439
01:15:15,000 --> 01:15:16,000
叫Devihelmen

2440
01:15:16,000 --> 01:15:18,000
是整套非對稱式

2441
01:15:18,000 --> 01:15:20,000
密碼系統的十組

2442
01:15:20,000 --> 01:15:21,000
所以我們這邊看的

2443
01:15:21,000 --> 01:15:23,000
就是Devihelmen的結構

2444
01:15:23,000 --> 01:15:25,000
那大致上很簡單

2445
01:15:25,000 --> 01:15:26,000
它就是呢

2446
01:15:26,000 --> 01:15:29,000
A跟B各自有他們的公司藥對

2447
01:15:29,000 --> 01:15:30,000
私藥跟公藥是成對的

2448
01:15:30,000 --> 01:15:32,000
所以A會有secret key

2449
01:15:32,000 --> 01:15:34,000
of A跟public key of A

2450
01:15:34,000 --> 01:15:35,000
這邊是SA跟PA

2451
01:15:35,000 --> 01:15:38,000
同樣的B會有SB跟PB

2452
01:15:38,000 --> 01:15:40,000
那按照道理

2453
01:15:40,000 --> 01:15:41,000
我們前面講過了

2454
01:15:41,000 --> 01:15:43,000
就是私藥是絕對不會外洩

2455
01:15:43,000 --> 01:15:44,000
公藥可以

2456
01:15:44,000 --> 01:15:45,000
可以四散在外

2457
01:15:45,000 --> 01:15:47,000
所以這邊的話呢

2458
01:15:47,000 --> 01:15:49,000
我們把PA交給B

2459
01:15:49,000 --> 01:15:51,000
把PB交給A

2460
01:15:51,000 --> 01:15:52,000
也只有這種選項的

2461
01:15:52,000 --> 01:15:53,000
就是你不會把

2462
01:15:53,000 --> 01:15:54,000
你不會把這個私藥

2463
01:15:54,000 --> 01:15:55,000
系列的都交出去

2464
01:15:55,000 --> 01:15:57,000
所以你只會交公藥

2465
01:15:57,000 --> 01:15:58,000
交以後發生什麼事情呢

2466
01:15:58,000 --> 01:16:01,000
那A這邊這時候有SA跟PB

2467
01:16:01,000 --> 01:16:02,000
B這邊有SB跟PA

2468
01:16:02,000 --> 01:16:05,000
就是他們各自的私藥

2469
01:16:05,000 --> 01:16:06,000
都保留得好好的

2470
01:16:06,000 --> 01:16:08,000
跟對方的公藥

2471
01:16:08,000 --> 01:16:10,000
因為公藥可以隨意使用

2472
01:16:10,000 --> 01:16:12,000
那很神奇的

2473
01:16:12,000 --> 01:16:14,000
因為數學上的設計的原因呢

2474
01:16:14,000 --> 01:16:17,000
你的SA去跟PB做operation

2475
01:16:17,000 --> 01:16:18,000
得到的這一把G

2476
01:16:18,000 --> 01:16:21,000
會跟SB跟PA

2477
01:16:21,000 --> 01:16:22,000
operate

2478
01:16:22,000 --> 01:16:25,000
做出來的這把G一模一樣

2479
01:16:25,000 --> 01:16:26,000
就很神奇的數學原因

2480
01:16:26,000 --> 01:16:28,000
造成了這一把得到的G

2481
01:16:28,000 --> 01:16:29,000
是一樣

2482
01:16:29,000 --> 01:16:30,000
也就是說你只要有

2483
01:16:30,000 --> 01:16:31,000
這樣子的成分

2484
01:16:31,000 --> 01:16:33,000
這兩個人就相當於

2485
01:16:33,000 --> 01:16:35,000
有一把一模一樣的key

2486
01:16:35,000 --> 01:16:37,000
因此就可以開始

2487
01:16:37,000 --> 01:16:39,000
做對稱式的加密的傳輸

2488
01:16:39,000 --> 01:16:42,000
所以這邊再舉個例子

2489
01:16:42,000 --> 01:16:43,000
就是說

2490
01:16:43,000 --> 01:16:45,000
這邊開始會有一些些

2491
01:16:45,000 --> 01:16:46,000
數學細節我們不會去提

2492
01:16:46,000 --> 01:16:47,000
但是最重要的是

2493
01:16:47,000 --> 01:16:49,000
希望大家可以藉由類似

2494
01:16:49,000 --> 01:16:50,000
圖像記憶的方式

2495
01:16:50,000 --> 01:16:51,000
只要知道結構就好

2496
01:16:51,000 --> 01:16:53,000
結構呢會是說

2497
01:16:53,000 --> 01:16:55,000
各自這個A跟B

2498
01:16:55,000 --> 01:16:57,000
雙方會有一些需要的

2499
01:16:57,000 --> 01:16:59,000
演算法需要的公開的參數

2500
01:16:59,000 --> 01:17:01,000
那A跟B

2501
01:17:01,000 --> 01:17:04,000
先一會有產生他們的私藥

2502
01:17:04,000 --> 01:17:05,000
在這裡XA跟XB

2503
01:17:05,000 --> 01:17:06,000
就相當於圖裡面的

2504
01:17:06,000 --> 01:17:07,000
XA跟XB

2505
01:17:07,000 --> 01:17:11,000
藉由這個私藥去產生公藥

2506
01:17:11,000 --> 01:17:13,000
這邊用的是一個指數

2507
01:17:13,000 --> 01:17:15,000
然後再取MODE的這個做法

2508
01:17:15,000 --> 01:17:17,000
所以A跟B兩方都是

2509
01:17:17,000 --> 01:17:18,000
由SA產生PA

2510
01:17:18,000 --> 01:17:20,000
由SB產生PB

2511
01:17:20,000 --> 01:17:22,000
做好之後把公藥交換

2512
01:17:22,000 --> 01:17:23,000
我們剛剛提過了

2513
01:17:23,000 --> 01:17:25,000
因為私藥絕對不會交出去

2514
01:17:25,000 --> 01:17:27,000
所以你能交換的只有公藥

2515
01:17:27,000 --> 01:17:28,000
把公藥交換了之後

2516
01:17:28,000 --> 01:17:30,000
得到A得到B的公藥

2517
01:17:30,000 --> 01:17:31,000
B得到A的公藥

2518
01:17:31,000 --> 01:17:32,000
再來呢

2519
01:17:32,000 --> 01:17:33,000
就是下一步我們講

2520
01:17:33,000 --> 01:17:35,000
就是因為神奇的數學的原因

2521
01:17:35,000 --> 01:17:37,000
所以會造成他們

2522
01:17:37,000 --> 01:17:38,000
做同樣的運算

2523
01:17:38,000 --> 01:17:40,000
所得到的這一把

2524
01:17:40,000 --> 01:17:41,000
這一把

2525
01:17:41,000 --> 01:17:42,000
經藥是相同的

2526
01:17:42,000 --> 01:17:44,000
一模一樣的

2527
01:17:44,000 --> 01:17:46,000
這個數學大部分都是

2528
01:17:46,000 --> 01:17:48,000
都是離散數學的

2529
01:17:48,000 --> 01:17:49,000
大部分都是離散數學

2530
01:17:49,000 --> 01:17:53,000
那像這一種就是

2531
01:17:53,000 --> 01:17:54,000
前面也講過說

2532
01:17:54,000 --> 01:17:56,000
大部分的非對稱是的演算法

2533
01:17:56,000 --> 01:17:58,000
都是有這樣子的backbomb在

2534
01:17:58,000 --> 01:18:00,000
基本都能做經藥交換的協定

2535
01:18:00,000 --> 01:18:03,000
那然後並且我們也提過

2536
01:18:03,000 --> 01:18:04,000
它的重點是在於說

2537
01:18:04,000 --> 01:18:06,000
你有公藥的時候

2538
01:18:06,000 --> 01:18:10,000
基本是沒有辦法推回私藥的

2539
01:18:10,000 --> 01:18:12,000
那之所以為什麼

2540
01:18:12,000 --> 01:18:14,000
沒有辦法推回私藥的原因

2541
01:18:14,000 --> 01:18:15,000
是在於說

2542
01:18:15,000 --> 01:18:17,000
它是一定是用到了

2543
01:18:17,000 --> 01:18:19,000
某個數學難題

2544
01:18:19,000 --> 01:18:22,000
所以以離散對數而言

2545
01:18:22,000 --> 01:18:24,000
就是以diffie helman而言

2546
01:18:24,000 --> 01:18:26,000
它所用到的這個難題

2547
01:18:26,000 --> 01:18:29,000
叫做離散對數

2548
01:18:29,000 --> 01:18:32,000
那它的具體來講是怎麼樣呢

2549
01:18:32,000 --> 01:18:33,000
就是說我們這邊看

2550
01:18:33,000 --> 01:18:34,000
很簡單的數字裡

2551
01:18:34,000 --> 01:18:35,000
我們用很小的數字

2552
01:18:35,000 --> 01:18:36,000
我們用一個直數

2553
01:18:36,000 --> 01:18:38,000
有一個直數353

2554
01:18:38,000 --> 01:18:40,000
然後有一個直數的圓根

2555
01:18:40,000 --> 01:18:44,000
這個是離散數學裡面會有

2556
01:18:44,000 --> 01:18:46,000
那簡單的來講就是

2557
01:18:46,000 --> 01:18:48,000
我們如果把

2558
01:18:48,000 --> 01:18:50,000
我們現在有一個圓根3

2559
01:18:50,000 --> 01:18:52,000
我們把3的一次方

2560
01:18:52,000 --> 01:18:53,000
兩次方 三次方

2561
01:18:53,000 --> 01:18:56,000
一路到353次方

2562
01:18:56,000 --> 01:19:00,000
三的一次方到353次方

2563
01:19:00,000 --> 01:19:03,000
然後都去mode 353

2564
01:19:03,000 --> 01:19:06,000
它會以某種排列

2565
01:19:06,000 --> 01:19:09,000
完成1到353這個數字

2566
01:19:09,000 --> 01:19:13,000
並且只會各出現一次

2567
01:19:13,000 --> 01:19:15,000
用比較簡單的例子

2568
01:19:15,000 --> 01:19:17,000
假設有一個直數11

2569
01:19:17,000 --> 01:19:19,000
它有一個圓根2

2570
01:19:19,000 --> 01:19:22,000
2的一次方mode的11

2571
01:19:22,000 --> 01:19:25,000
2的一次方mode的11是

2572
01:19:25,000 --> 01:19:27,000
那一路這樣往上疊加到

2573
01:19:27,000 --> 01:19:30,000
2的11次方mode的11

2574
01:19:30,000 --> 01:19:32,000
你得到的那個數字

2575
01:19:32,000 --> 01:19:36,000
它會以某種排列完成1到11

2576
01:19:36,000 --> 01:19:37,000
這就是圓根

2577
01:19:37,000 --> 01:19:40,000
所以它的整個難題是建立在說

2578
01:19:40,000 --> 01:19:41,000
接下來我們看

2579
01:19:41,000 --> 01:19:43,000
它選A選的公要

2580
01:19:43,000 --> 01:19:45,000
A選的私要97

2581
01:19:45,000 --> 01:19:47,000
B選的私要233

2582
01:19:47,000 --> 01:19:49,000
這都是在合法的範圍裡面

2583
01:19:49,000 --> 01:19:52,000
因為要小於Q 小於353

2584
01:19:52,000 --> 01:19:54,000
再來就是做公要的過程

2585
01:19:54,000 --> 01:19:56,000
它們分別去取次方

2586
01:19:56,000 --> 01:19:57,000
像我們剛剛提的

2587
01:19:57,000 --> 01:19:59,000
把3的取97次方之後

2588
01:19:59,000 --> 01:20:02,000
mode 353得到40

2589
01:20:02,000 --> 01:20:04,000
那B也去做它的公要

2590
01:20:04,000 --> 01:20:07,000
它計算233次方

2591
01:20:07,000 --> 01:20:10,000
之後去mode 353得到248

2592
01:20:10,000 --> 01:20:12,000
然後最後一步很神奇的

2593
01:20:12,000 --> 01:20:14,000
因為數學的原因

2594
01:20:14,000 --> 01:20:17,000
你把公要在成上私要的次方

2595
01:20:17,000 --> 01:20:18,000
再去做mode

2596
01:20:18,000 --> 01:20:20,000
這兩個會是完全一樣的

2597
01:20:20,000 --> 01:20:22,000
得到的會是160

2598
01:20:22,000 --> 01:20:25,000
這個事情的困難的點是在於說

2599
01:20:25,000 --> 01:20:27,000
我們要從私要去計算公要

2600
01:20:27,000 --> 01:20:29,000
相對很容易

2601
01:20:29,000 --> 01:20:32,000
我們這是單純的把算數算完

2602
01:20:32,000 --> 01:20:33,000
然後去做mode而已

2603
01:20:33,000 --> 01:20:34,000
這個容易

2604
01:20:34,000 --> 01:20:35,000
但是男是男在說

2605
01:20:35,000 --> 01:20:37,000
我今天告訴你事實

2606
01:20:37,000 --> 01:20:39,000
你要怎麼樣能夠知道

2607
01:20:39,000 --> 01:20:41,000
是3的97次方mode 353得

2608
01:20:41,000 --> 01:20:43,000
這個非常非常的困難

2609
01:20:43,000 --> 01:20:45,000
所以這是離散對數的難題

2610
01:20:45,000 --> 01:20:47,000
是類似這樣的意思

2611
01:20:47,000 --> 01:20:49,000
那大概有個感覺

2612
01:20:49,000 --> 01:20:50,000
就就可以了

2613
01:20:50,000 --> 01:20:51,000
那另外來講的話

2614
01:20:51,000 --> 01:20:53,000
這邊是橢圓曲線的版本

2615
01:20:53,000 --> 01:20:54,000
我們前面講過橢圓曲線

2616
01:20:54,000 --> 01:20:56,000
它也能夠做加解密

2617
01:20:56,000 --> 01:20:57,000
也能夠做千張

2618
01:20:57,000 --> 01:20:59,000
也能夠做精藥交換

2619
01:20:59,000 --> 01:21:01,000
這邊就是elitif curve

2620
01:21:01,000 --> 01:21:02,000
版的defi helmet

2621
01:21:02,000 --> 01:21:04,000
那它的細節也不用管

2622
01:21:04,000 --> 01:21:05,000
它的結構一樣

2623
01:21:05,000 --> 01:21:07,000
我會有公開的參數

2624
01:21:07,000 --> 01:21:10,000
a跟b先有他們的各自的私要

2625
01:21:10,000 --> 01:21:12,000
從私要伸出公要

2626
01:21:12,000 --> 01:21:14,000
然後把公要做交換

2627
01:21:14,000 --> 01:21:15,000
最後神奇的數學

2628
01:21:15,000 --> 01:21:17,000
得到他們有一把共同的精藥

2629
01:21:17,000 --> 01:21:18,000
一樣的

2630
01:21:18,000 --> 01:21:24,000
好 那所以有想要知道細節的話

2631
01:21:24,000 --> 01:21:27,000
或是有很多資料可以查詢

2632
01:21:27,000 --> 01:21:28,000
或是要討論你都可以

2633
01:21:28,000 --> 01:21:32,000
那關於ShareSecret的這個部分

2634
01:21:32,000 --> 01:21:34,000
我們先暫時就談到這

2635
01:21:34,000 --> 01:21:35,000
那接下來的話

2636
01:21:35,000 --> 01:21:37,000
要進到的是case study

2637
01:21:37,000 --> 01:21:38,000
就是基本上是幫大家

2638
01:21:38,000 --> 01:21:39,000
能夠複習一下

2639
01:21:39,000 --> 01:21:40,000
我們今天所提的所有東西

2640
01:21:40,000 --> 01:21:42,000
我們這邊用一個

2641
01:21:42,000 --> 01:21:45,000
簡單的生活中的範例

2642
01:21:45,000 --> 01:21:48,000
我們假設今天

2643
01:21:48,000 --> 01:21:51,000
我們手機的iOS要更新

2644
01:21:51,000 --> 01:21:52,000
所以我們手機的iOS

2645
01:21:52,000 --> 01:21:53,000
要更新的時候

2646
01:21:53,000 --> 01:21:55,000
是從我們當然是

2647
01:21:55,000 --> 01:21:57,000
有Apple送這個file來

2648
01:21:57,000 --> 01:22:00,000
所以這邊我們要先做幾點假設

2649
01:22:00,000 --> 01:22:03,000
就是說第一個我們認定

2650
01:22:03,000 --> 01:22:06,000
Apple不希望iOS file輕易的外洩

2651
01:22:06,000 --> 01:22:08,000
它是指的是保密性

2652
01:22:08,000 --> 01:22:10,000
那我們這邊隱含的就是說

2653
01:22:10,000 --> 01:22:13,000
我們假定它是有加密過的file

2654
01:22:13,000 --> 01:22:15,000
然後用了iOS file傳過來

2655
01:22:15,000 --> 01:22:17,000
那當然iOS file

2656
01:22:17,000 --> 01:22:18,000
我們知道它的檔案

2657
01:22:18,000 --> 01:22:19,000
檔案非常的龐大

2658
01:22:19,000 --> 01:22:21,000
所以就像我們一直在講的

2659
01:22:21,000 --> 01:22:23,000
只要是這種加密的傳輸

2660
01:22:23,000 --> 01:22:25,000
我們推薦使用的是對稱式的

2661
01:22:25,000 --> 01:22:27,000
加密的演算法

2662
01:22:27,000 --> 01:22:28,000
比較不會吃力

2663
01:22:28,000 --> 01:22:30,000
那所以為了你要能夠

2664
01:22:30,000 --> 01:22:32,000
用對稱式的加密演算法

2665
01:22:32,000 --> 01:22:34,000
那你就會需要有

2666
01:22:34,000 --> 01:22:36,000
那一把對稱的key

2667
01:22:36,000 --> 01:22:38,000
所以沒有一開始

2668
01:22:38,000 --> 01:22:39,000
當然我們跟Apple

2669
01:22:39,000 --> 01:22:41,000
可能沒有對稱的那一把key的時候

2670
01:22:41,000 --> 01:22:42,000
我們會做什麼

2671
01:22:42,000 --> 01:22:44,000
我們就可以用剛剛所提到的share secret

2672
01:22:44,000 --> 01:22:46,000
去做一把share key出來

2673
01:22:46,000 --> 01:22:49,000
所以剛剛怎麼樣提到做share key呢

2674
01:22:49,000 --> 01:22:52,000
我們都是交換public key

2675
01:22:52,000 --> 01:22:54,000
我們這樣一路道著回去

2676
01:22:54,000 --> 01:22:55,000
我們要做share key

2677
01:22:55,000 --> 01:22:56,000
我們必須要交換public key

2678
01:22:56,000 --> 01:22:57,000
就是表示我們各自有

2679
01:22:57,000 --> 01:22:59,000
我們各自的公要跟食藥

2680
01:22:59,000 --> 01:23:02,000
並且我們拿公藥出去跟別人交換

2681
01:23:02,000 --> 01:23:03,000
然後再經過神奇的數學

2682
01:23:03,000 --> 01:23:06,000
運算得到同樣一把共同的精藥

2683
01:23:06,000 --> 01:23:07,000
問題又來了

2684
01:23:07,000 --> 01:23:10,000
這一把公藥怎麼樣知道能夠性

2685
01:23:10,000 --> 01:23:12,000
所以我們需要有那一把

2686
01:23:12,000 --> 01:23:15,000
公藥跟那個公藥持有人的身份

2687
01:23:15,000 --> 01:23:17,000
我們需要把這件事情綁定在一起

2688
01:23:17,000 --> 01:23:19,000
那就是我們照我們剛剛講的

2689
01:23:19,000 --> 01:23:20,000
用平正

2690
01:23:20,000 --> 01:23:21,000
有平正的機構

2691
01:23:21,000 --> 01:23:23,000
可以來幫我們做這件事情

2692
01:23:23,000 --> 01:23:26,000
所以這裡面至少會需要什麼呢

2693
01:23:26,000 --> 01:23:28,000
至少會需要說Apple呢

2694
01:23:28,000 --> 01:23:30,000
有一個由CA

2695
01:23:30,000 --> 01:23:34,000
由平正機構所牽發的這一個平正

2696
01:23:34,000 --> 01:23:36,000
那我們要更新的user呢

2697
01:23:36,000 --> 01:23:39,000
我們可以用這個

2698
01:23:39,000 --> 01:23:42,000
我們可以用CA的公藥去verify

2699
01:23:42,000 --> 01:23:44,000
確認這一個平正

2700
01:23:44,000 --> 01:23:47,000
以得到正確的Apple的public key

2701
01:23:47,000 --> 01:23:49,000
得到Apple的public key

2702
01:23:49,000 --> 01:23:50,000
我們的public key之後呢

2703
01:23:50,000 --> 01:23:51,000
就可以做精藥交換

2704
01:23:51,000 --> 01:23:53,000
就可以得到

2705
01:23:53,000 --> 01:23:55,000
就可以得到共同的一把精藥

2706
01:23:55,000 --> 01:23:57,000
再來用這把共同的精藥做gami

2707
01:23:57,000 --> 01:23:59,000
所以這樣一路倒著回去是這樣

2708
01:23:59,000 --> 01:24:04,000
那再來是收到了之後會需要什麼

2709
01:24:04,000 --> 01:24:05,000
收到了之後呢

2710
01:24:05,000 --> 01:24:07,000
我們會想要知道幾件事情

2711
01:24:07,000 --> 01:24:09,000
我們想要知道說

2712
01:24:09,000 --> 01:24:11,000
這個file是Apple送過來的

2713
01:24:11,000 --> 01:24:14,000
而且不是由別人所送過來的

2714
01:24:14,000 --> 01:24:15,000
並且呢

2715
01:24:15,000 --> 01:24:17,000
並且這個

2716
01:24:17,000 --> 01:24:19,000
我們收到的file的內容

2717
01:24:19,000 --> 01:24:20,000
沒有經過篡改

2718
01:24:20,000 --> 01:24:21,000
跟Apple原本想傳的那個東西

2719
01:24:21,000 --> 01:24:22,000
是一樣的

2720
01:24:22,000 --> 01:24:24,000
所以有這兩個條件呢

2721
01:24:24,000 --> 01:24:27,000
我們會要用到的是數位簽章

2722
01:24:27,000 --> 01:24:28,000
數位簽章能夠幫我們確認

2723
01:24:28,000 --> 01:24:31,000
只有擁有那個私藥的人能夠簽

2724
01:24:31,000 --> 01:24:33,000
大家都可以確認

2725
01:24:33,000 --> 01:24:35,000
並且因為你簽的東西

2726
01:24:35,000 --> 01:24:38,000
也包含了這個內容的災藥

2727
01:24:38,000 --> 01:24:40,000
所以內容經過篡改的時候

2728
01:24:40,000 --> 01:24:42,000
簽名就不會

2729
01:24:42,000 --> 01:24:44,000
簽名就會變得不一樣

2730
01:24:44,000 --> 01:24:49,000
好 那再來的話

2731
01:24:49,000 --> 01:24:51,000
再來的話我們就畫幾個簡單的圖

2732
01:24:51,000 --> 01:24:52,000
所以

2733
01:24:52,000 --> 01:24:54,000
所以剛剛講了這麼多呢

2734
01:24:54,000 --> 01:24:55,000
我們把整件事情

2735
01:24:55,000 --> 01:24:57,000
整個要完成iOS的更新

2736
01:24:57,000 --> 01:24:58,000
我們把它分成三個步驟

2737
01:24:58,000 --> 01:24:59,000
我們前面提過

2738
01:24:59,000 --> 01:25:02,000
我們需要得到正確的Apple的public key

2739
01:25:02,000 --> 01:25:04,000
這個怎麼做

2740
01:25:04,000 --> 01:25:06,000
我們會用到憑證

2741
01:25:06,000 --> 01:25:07,000
跟我們要想辦法

2742
01:25:07,000 --> 01:25:08,000
得到這個Apple的public key

2743
01:25:08,000 --> 01:25:09,000
正確的public key之後

2744
01:25:09,000 --> 01:25:11,000
我們就可以跑這個

2745
01:25:11,000 --> 01:25:12,000
經藥交換的協定

2746
01:25:12,000 --> 01:25:14,000
得到一把共同的經藥

2747
01:25:14,000 --> 01:25:16,000
再來是

2748
01:25:16,000 --> 01:25:17,000
再來是收到了

2749
01:25:17,000 --> 01:25:19,000
收到了加密過後的這個file之後

2750
01:25:19,000 --> 01:25:20,000
我們要確認它的來源

2751
01:25:20,000 --> 01:25:21,000
跟確認它的

2752
01:25:21,000 --> 01:25:22,000
它的內容有沒有經過篡改

2753
01:25:22,000 --> 01:25:24,000
會用數位簽章

2754
01:25:24,000 --> 01:25:26,000
所以

2755
01:25:26,000 --> 01:25:28,000
所以首先是第一步

2756
01:25:28,000 --> 01:25:30,000
是要取得正確的public key

2757
01:25:30,000 --> 01:25:31,000
我們會做什麼事情呢

2758
01:25:31,000 --> 01:25:32,000
大概會是這樣

2759
01:25:32,000 --> 01:25:34,000
A. 把它的public key

2760
01:25:34,000 --> 01:25:37,000
它自己拿去找這個ca去做註冊

2761
01:25:37,000 --> 01:25:39,000
註冊通過ca確認

2762
01:25:39,000 --> 01:25:40,000
你是Apple

2763
01:25:40,000 --> 01:25:42,000
你的public key也對了

2764
01:25:42,000 --> 01:25:44,000
我就頒發證書給你

2765
01:25:44,000 --> 01:25:46,000
這個證書就會有

2766
01:25:46,000 --> 01:25:47,000
Apple的ID

2767
01:25:47,000 --> 01:25:49,000
跟Apple的public key

2768
01:25:49,000 --> 01:25:51,000
並且是由

2769
01:25:51,000 --> 01:25:54,000
ca的私藥所簽發的

2770
01:25:54,000 --> 01:25:58,000
得到了這個憑證之後

2771
01:25:58,000 --> 01:26:01,000
Apple也可以把這個憑證

2772
01:26:01,000 --> 01:26:02,000
交給Bob

2773
01:26:02,000 --> 01:26:04,000
Bob可以去確認這個憑證

2774
01:26:04,000 --> 01:26:06,000
他可以用這個ca的公要

2775
01:26:06,000 --> 01:26:08,000
因為我們不會懷疑他的公要

2776
01:26:08,000 --> 01:26:11,000
然後去確認這個憑證

2777
01:26:11,000 --> 01:26:13,000
得到正確的AppleID跟public key

2778
01:26:13,000 --> 01:26:15,000
我們就得到正確的public key

2779
01:26:15,000 --> 01:26:19,000
下一步的話

2780
01:26:19,000 --> 01:26:21,000
再來就是一樣用這個

2781
01:26:21,000 --> 01:26:22,000
經藥交換協定

2782
01:26:22,000 --> 01:26:24,000
就是很神奇的

2783
01:26:24,000 --> 01:26:27,000
我們就有SAPSVPB之後

2784
01:26:27,000 --> 01:26:28,000
把PA跟PB交換

2785
01:26:28,000 --> 01:26:30,000
就得到了一把對稱的

2786
01:26:30,000 --> 01:26:32,000
並且是一樣的

2787
01:26:32,000 --> 01:26:33,000
完全一模一樣的

2788
01:26:33,000 --> 01:26:35,000
這一把共同經藥G

2789
01:26:35,000 --> 01:26:37,000
前面再補充一點

2790
01:26:37,000 --> 01:26:39,000
這邊指的是

2791
01:26:39,000 --> 01:26:41,000
取得了正確的Apple的public key

2792
01:26:41,000 --> 01:26:43,000
但是等於說反過來

2793
01:26:43,000 --> 01:26:44,000
Bob也可以做這件事

2794
01:26:44,000 --> 01:26:47,000
也可以去得到他的憑證

2795
01:26:47,000 --> 01:26:49,000
然後把他的公要跟憑證

2796
01:26:49,000 --> 01:26:51,000
也一併交給Apple

2797
01:26:51,000 --> 01:26:53,000
所以這是雙向

2798
01:26:53,000 --> 01:26:54,000
所以到這邊

2799
01:26:54,000 --> 01:26:55,000
已經有了一把

2800
01:26:55,000 --> 01:26:56,000
共同的經藥G

2801
01:26:56,000 --> 01:26:59,000
可以用來做對稱師的加密

2802
01:26:59,000 --> 01:27:01,000
加密了過後

2803
01:27:01,000 --> 01:27:03,000
我們把iOS file

2804
01:27:03,000 --> 01:27:04,000
經過加密之後

2805
01:27:04,000 --> 01:27:05,000
變成這個問號的狂狂

2806
01:27:05,000 --> 01:27:07,000
我們把這個sign過的

2807
01:27:07,000 --> 01:27:11,000
我們要做sign這段

2808
01:27:11,000 --> 01:27:13,000
我們把加密過的這個file

2809
01:27:13,000 --> 01:27:15,000
進Hash得到摘要

2810
01:27:15,000 --> 01:27:19,000
然後我們用Apple

2811
01:27:19,000 --> 01:27:20,000
用他自己的私藥

2812
01:27:20,000 --> 01:27:23,000
去對這個hash的digest

2813
01:27:23,000 --> 01:27:25,000
去做千張

2814
01:27:25,000 --> 01:27:28,000
把這個千張跟file

2815
01:27:28,000 --> 01:27:29,000
傳到Bob手上的時候

2816
01:27:29,000 --> 01:27:32,000
Bob也可以把這個加密過的

2817
01:27:32,000 --> 01:27:34,000
問號的狂狂進到Hash

2818
01:27:34,000 --> 01:27:37,000
然後再來用Apple的公要

2819
01:27:37,000 --> 01:27:38,000
因為他有正確的公要

2820
01:27:38,000 --> 01:27:40,000
然後去verify

2821
01:27:40,000 --> 01:27:41,000
verify這個signature

2822
01:27:41,000 --> 01:27:44,000
然後得到比對是不是一樣的

2823
01:27:44,000 --> 01:27:46,000
是的話就表示這個file

2824
01:27:46,000 --> 01:27:47,000
確實是正確的

2825
01:27:47,000 --> 01:27:48,000
沒有被修改

2826
01:27:48,000 --> 01:27:50,000
並且這個千張是由Apple的

2827
01:27:50,000 --> 01:27:55,000
Private key所簽的

2828
01:27:55,000 --> 01:27:58,000
到這邊這樣的流程有問題嗎

2829
01:27:58,000 --> 01:28:00,000
這樣基本上我們就跑完了

2830
01:28:00,000 --> 01:28:01,000
剛剛我們前面講到的

2831
01:28:01,000 --> 01:28:03,000
情境跟假設

2832
01:28:03,000 --> 01:28:08,000
很快的

2833
01:28:08,000 --> 01:28:10,000
最後再帶一下結論

2834
01:28:10,000 --> 01:28:13,000
整個要講這一堂課的目的

2835
01:28:13,000 --> 01:28:15,000
來講最主要還是

2836
01:28:15,000 --> 01:28:17,000
希望大家能夠瞭解

2837
01:28:17,000 --> 01:28:19,000
說到底security在做什麼

2838
01:28:19,000 --> 01:28:23,000
首先要再來回過頭來講的是

2839
01:28:23,000 --> 01:28:25,000
我們剛剛有一張表

2840
01:28:25,000 --> 01:28:26,000
看到的是

2841
01:28:26,000 --> 01:28:28,000
我們今天學過的

2842
01:28:28,000 --> 01:28:31,000
今天學過的四個安全的目標

2843
01:28:31,000 --> 01:28:33,000
再配上一個key scheme

2844
01:28:33,000 --> 01:28:35,000
那一張圖如果各位還有印象的話

2845
01:28:35,000 --> 01:28:37,000
那現在這張表是一個

2846
01:28:37,000 --> 01:28:38,000
更完整的補充

2847
01:28:38,000 --> 01:28:40,000
就是說到底總共來講

2848
01:28:40,000 --> 01:28:42,000
有哪一些密碼學相關的功能

2849
01:28:42,000 --> 01:28:44,000
所以前面有所謂的

2850
01:28:44,000 --> 01:28:46,000
Block Cipher跟Block CipherMode

2851
01:28:46,000 --> 01:28:48,000
這個其實都講的是加密

2852
01:28:48,000 --> 01:28:49,000
虛壞的加密

2853
01:28:49,000 --> 01:28:50,000
就是說以固定的長度

2854
01:28:50,000 --> 01:28:52,000
為單位去做加密

2855
01:28:52,000 --> 01:28:54,000
以128倍為單位

2856
01:28:54,000 --> 01:28:56,000
或以256倍為單位去做加密

2857
01:28:56,000 --> 01:28:59,000
跟加密的不同的這個公眾模式

2858
01:28:59,000 --> 01:29:01,000
這個有需要的話再補充就好

2859
01:29:01,000 --> 01:29:03,000
並且也有做數位簽章

2860
01:29:03,000 --> 01:29:06,000
再來是跟key有關的有像是

2861
01:29:06,000 --> 01:29:09,000
KDF是說如何用一把key

2862
01:29:09,000 --> 01:29:11,000
衍伸出多個key

2863
01:29:11,000 --> 01:29:12,000
這個很重要

2864
01:29:12,000 --> 01:29:13,000
因為我們不希望一把key

2865
01:29:13,000 --> 01:29:14,000
太常被重複利用

2866
01:29:14,000 --> 01:29:16,000
它的安全性自然就會降低

2867
01:29:16,000 --> 01:29:18,000
所以如何用一把key

2868
01:29:18,000 --> 01:29:20,000
健康的去伸出很多把

2869
01:29:20,000 --> 01:29:21,000
也可以使用的key

2870
01:29:21,000 --> 01:29:23,000
這是KDF在做的事情

2871
01:29:23,000 --> 01:29:25,000
也會包含像key management的

2872
01:29:25,000 --> 01:29:27,000
這個以演算法來講

2873
01:29:27,000 --> 01:29:28,000
比較像是組合計

2874
01:29:28,000 --> 01:29:30,000
就是說它包含有像

2875
01:29:30,000 --> 01:29:32,000
深層交換儲存使用等等

2876
01:29:32,000 --> 01:29:34,000
這樣一整套

2877
01:29:34,000 --> 01:29:36,000
另外也有我們前面

2878
01:29:36,000 --> 01:29:38,000
提過的Message of Dedication

2879
01:29:38,000 --> 01:29:40,000
訊息認證這種的

2880
01:29:40,000 --> 01:29:42,000
或者是

2881
01:29:42,000 --> 01:29:45,000
我們也講過非常重要的

2882
01:29:45,000 --> 01:29:48,000
叫做亂數產生

2883
01:29:48,000 --> 01:29:50,000
注意這邊講的亂數產生

2884
01:29:50,000 --> 01:29:52,000
指的都是用

2885
01:29:52,000 --> 01:29:53,000
亂數產生的那一種

2886
01:29:53,000 --> 01:29:55,000
叫Sudo Random

2887
01:29:55,000 --> 01:29:56,000
或是在這邊

2888
01:29:56,000 --> 01:29:57,000
以這邊這個DRBG

2889
01:29:57,000 --> 01:29:59,000
這叫做Deterministic Random Bear Generator

2890
01:29:59,000 --> 01:30:01,000
就是說它是

2891
01:30:01,000 --> 01:30:02,000
基本上來講

2892
01:30:02,000 --> 01:30:03,000
它就是可以重現的

2893
01:30:03,000 --> 01:30:04,000
它並不是真隨機的

2894
01:30:04,000 --> 01:30:06,000
就像我們寫程式的時候

2895
01:30:06,000 --> 01:30:07,000
會用的那種

2896
01:30:07,000 --> 01:30:08,000
比方說我們要call一個

2897
01:30:08,000 --> 01:30:09,000
Random的function

2898
01:30:09,000 --> 01:30:11,000
然後我們去給它一個seed

2899
01:30:11,000 --> 01:30:13,000
這種Random的

2900
01:30:13,000 --> 01:30:14,000
亂數都會是

2901
01:30:14,000 --> 01:30:16,000
偽隨機的亂數

2902
01:30:16,000 --> 01:30:18,000
再來的話還有像Hashing

2903
01:30:18,000 --> 01:30:19,000
Secure Hashing

2904
01:30:19,000 --> 01:30:20,000
我們就前面提過的

2905
01:30:20,000 --> 01:30:22,000
如何確保資料完整性

2906
01:30:22,000 --> 01:30:24,000
我們會用Hash Function

2907
01:30:24,000 --> 01:30:26,000
這邊我們主要使用Shark

2908
01:30:26,000 --> 01:30:27,000
再來也是其他的組合

2909
01:30:27,000 --> 01:30:28,000
即包含說

2910
01:30:28,000 --> 01:30:29,000
因為你的

2911
01:30:29,000 --> 01:30:31,000
橢圓曲線的密碼學

2912
01:30:31,000 --> 01:30:32,000
它能夠負擔很多功能

2913
01:30:32,000 --> 01:30:34,000
所以通常在implement的時候

2914
01:30:34,000 --> 01:30:36,000
我們真正會做到的事情

2915
01:30:36,000 --> 01:30:38,000
是比較像是去做一個

2916
01:30:38,000 --> 01:30:40,000
專門來運算

2917
01:30:40,000 --> 01:30:41,000
橢圓曲線的數學的

2918
01:30:41,000 --> 01:30:42,000
一個加速器

2919
01:30:42,000 --> 01:30:44,000
至於說你有

2920
01:30:44,000 --> 01:30:46,000
橢圓曲線的算法

2921
01:30:46,000 --> 01:30:48,000
你有可以去算

2922
01:30:48,000 --> 01:30:49,000
橢圓曲線的點香層

2923
01:30:49,000 --> 01:30:50,000
點香加這種的

2924
01:30:50,000 --> 01:30:52,000
再來要怎麼樣做到

2925
01:30:52,000 --> 01:30:54,000
像是橢圓曲線千張

2926
01:30:54,000 --> 01:30:56,000
或是橢圓曲線的金曜交換

2927
01:30:56,000 --> 01:30:58,000
那就是再把它組合起來而已

2928
01:30:58,000 --> 01:30:59,000
所以也會有

2929
01:30:59,000 --> 01:31:01,000
特別的組件這樣子

2930
01:31:01,000 --> 01:31:03,000
所以這樣子的表格

2931
01:31:03,000 --> 01:31:05,000
大概就是實際上

2932
01:31:05,000 --> 01:31:07,000
在演算法認證的時候

2933
01:31:07,000 --> 01:31:09,000
會要去做的事情

2934
01:31:09,000 --> 01:31:15,000
所以要快要總結了

2935
01:31:15,000 --> 01:31:17,000
那

2936
01:31:17,000 --> 01:31:19,000
所以到底POP

2937
01:31:19,000 --> 01:31:20,000
或者是利忘跟商碼

2938
01:31:20,000 --> 01:31:22,000
到底跟這個有什麼樣的關係

2939
01:31:22,000 --> 01:31:24,000
所以這邊我們回顧一下

2940
01:31:24,000 --> 01:31:25,000
用一張很簡單的圖

2941
01:31:25,000 --> 01:31:27,000
回顧一下今天所提的內容

2942
01:31:27,000 --> 01:31:28,000
我們就有提到說

2943
01:31:28,000 --> 01:31:30,000
有不同的安全的目標

2944
01:31:30,000 --> 01:31:33,000
然後有各式各樣的做法

2945
01:31:33,000 --> 01:31:35,000
那可以從這張圖上面

2946
01:31:35,000 --> 01:31:36,000
看到的是說

2947
01:31:36,000 --> 01:31:37,000
大部分我們要

2948
01:31:37,000 --> 01:31:39,000
為了要達到安全的目標

2949
01:31:39,000 --> 01:31:41,000
我們都會需要用到

2950
01:31:41,000 --> 01:31:43,000
我們都會需要用到的是

2951
01:31:43,000 --> 01:31:45,000
有這個算法

2952
01:31:45,000 --> 01:31:47,000
就是密碼學的運算

2953
01:31:47,000 --> 01:31:49,000
跟金曜

2954
01:31:49,000 --> 01:31:51,000
那前面我們也很多次提到

2955
01:31:51,000 --> 01:31:52,000
就是說

2956
01:31:52,000 --> 01:31:53,000
整個系統的安全

2957
01:31:53,000 --> 01:31:55,000
會建立在金曜上面

2958
01:31:55,000 --> 01:31:56,000
金曜是我們假設

2959
01:31:56,000 --> 01:31:58,000
絕對不能外洩的

2960
01:31:58,000 --> 01:32:00,000
那再來呢

2961
01:32:00,000 --> 01:32:01,000
再來

2962
01:32:01,000 --> 01:32:03,000
所以因為這些運算

2963
01:32:03,000 --> 01:32:04,000
或運作裡面

2964
01:32:04,000 --> 01:32:05,000
安全的運作裡面

2965
01:32:05,000 --> 01:32:07,000
大部分都會牽涉到

2966
01:32:07,000 --> 01:32:09,000
演算法或是金曜

2967
01:32:09,000 --> 01:32:10,000
那並且

2968
01:32:10,000 --> 01:32:12,000
並且安全性是建立在

2969
01:32:12,000 --> 01:32:15,000
金曜上面而並非演算法

2970
01:32:15,000 --> 01:32:16,000
我這邊指的

2971
01:32:16,000 --> 01:32:17,000
並非演算法的意思是說

2972
01:32:17,000 --> 01:32:18,000
因為我們要能夠

2973
01:32:18,000 --> 01:32:19,000
互相做溝通的時候

2974
01:32:19,000 --> 01:32:20,000
我們用的演算法

2975
01:32:20,000 --> 01:32:22,000
會是同一的規格

2976
01:32:22,000 --> 01:32:23,000
或是會是某一種

2977
01:32:23,000 --> 01:32:25,000
大家都可以接受的標準

2978
01:32:25,000 --> 01:32:26,000
才能夠互相溝通

2979
01:32:26,000 --> 01:32:27,000
這應該可以理解

2980
01:32:27,000 --> 01:32:30,000
也因此我們必須要能夠

2981
01:32:30,000 --> 01:32:31,000
我們必須要假設

2982
01:32:31,000 --> 01:32:33,000
攻擊你的這些駭客

2983
01:32:33,000 --> 01:32:34,000
他也相當的熟悉你的系統

2984
01:32:34,000 --> 01:32:35,000
熟悉你的演算法

2985
01:32:35,000 --> 01:32:37,000
唯一不知道的只有金曜

2986
01:32:37,000 --> 01:32:39,000
這個大家可以接受嗎

2987
01:32:39,000 --> 01:32:40,000
可以

2988
01:32:40,000 --> 01:32:43,000
那所以接下來呢

2989
01:32:43,000 --> 01:32:44,000
就是說

2990
01:32:44,000 --> 01:32:46,000
既然整個安全性

2991
01:32:46,000 --> 01:32:47,000
都建立在金曜上面

2992
01:32:47,000 --> 01:32:49,000
那保護這一把金曜

2993
01:32:49,000 --> 01:32:50,000
當然相當的重要

2994
01:32:50,000 --> 01:32:52,000
所以我們把剛剛的流程

2995
01:32:52,000 --> 01:32:54,000
再經過簡化

2996
01:32:54,000 --> 01:32:56,000
剛剛的我們大概都只看到

2997
01:32:56,000 --> 01:32:57,000
有data

2998
01:32:57,000 --> 01:32:58,000
然後有crypto engine

2999
01:32:58,000 --> 01:32:59,000
就是像AES

3000
01:32:59,000 --> 01:33:01,000
或是ECC這種block

3001
01:33:01,000 --> 01:33:02,000
這種operation

3002
01:33:02,000 --> 01:33:04,000
然後得到了Cypher

3003
01:33:04,000 --> 01:33:05,000
或是Dlamin文

3004
01:33:05,000 --> 01:33:06,000
或是它的output

3005
01:33:06,000 --> 01:33:07,000
剛剛我們大概都只在看這一段

3006
01:33:07,000 --> 01:33:09,000
那現在因為有key

3007
01:33:09,000 --> 01:33:10,000
加入了

3008
01:33:10,000 --> 01:33:13,000
那我們前面也會包含有key的產生

3009
01:33:13,000 --> 01:33:15,000
跟key的儲存

3010
01:33:15,000 --> 01:33:16,000
這個很自然

3011
01:33:16,000 --> 01:33:17,000
我們先產生了一把key

3012
01:33:17,000 --> 01:33:18,000
然後存

3013
01:33:18,000 --> 01:33:20,000
把它妥善的存好

3014
01:33:20,000 --> 01:33:22,000
需要的時候

3015
01:33:22,000 --> 01:33:23,000
需要的時候把它叫來使用

3016
01:33:23,000 --> 01:33:25,000
在crypto engine裡面

3017
01:33:25,000 --> 01:33:26,000
然後就可以把這個data

3018
01:33:26,000 --> 01:33:27,000
進到crypto engine

3019
01:33:27,000 --> 01:33:29,000
得到Cypher

3020
01:33:29,000 --> 01:33:30,000
那所以當然跟key

3021
01:33:30,000 --> 01:33:34,000
最重要的就是這三步了

3022
01:33:34,000 --> 01:33:35,000
那我們這三步等於說是

3023
01:33:35,000 --> 01:33:36,000
基本上是

3024
01:33:36,000 --> 01:33:37,000
矛盯整個裝置

3025
01:33:37,000 --> 01:33:39,000
或是整個晶片安全

3026
01:33:39,000 --> 01:33:41,000
所以我們一般把這樣子的

3027
01:33:41,000 --> 01:33:44,000
負責這樣的功能的

3028
01:33:44,000 --> 01:33:45,000
unit

3029
01:33:45,000 --> 01:33:46,000
叫做route of trust

3030
01:33:46,000 --> 01:33:49,000
叫做信任根

3031
01:33:49,000 --> 01:33:51,000
到這邊可以接受的話

3032
01:33:51,000 --> 01:33:52,000
那接下來

3033
01:33:52,000 --> 01:33:55,000
剩下的問題就很簡單了

3034
01:33:55,000 --> 01:33:57,000
就像前面看到的第123

3035
01:33:57,000 --> 01:33:59,000
我們現在就是問這三個問題

3036
01:33:59,000 --> 01:34:02,000
說怎麼樣能夠產生secret key

3037
01:34:02,000 --> 01:34:04,000
第二個是怎麼樣能夠儲存secret key

3038
01:34:04,000 --> 01:34:06,000
第三個是怎麼樣

3039
01:34:06,000 --> 01:34:08,000
怎麼樣安全的使用這些key

3040
01:34:08,000 --> 01:34:10,000
用來做密碼學的運算

3041
01:34:10,000 --> 01:34:12,000
那這三個問題

3042
01:34:12,000 --> 01:34:13,000
分別都有它的簡答

3043
01:34:13,000 --> 01:34:14,000
就是說怎麼樣產生key

3044
01:34:14,000 --> 01:34:16,000
我們用製程變異

3045
01:34:16,000 --> 01:34:18,000
我們常常講的晶片指紋

3046
01:34:18,000 --> 01:34:20,000
到這邊大家應該可以開始感受到

3047
01:34:20,000 --> 01:34:21,000
接下來要說什麼

3048
01:34:21,000 --> 01:34:22,000
那我們要怎麼樣能夠

3049
01:34:22,000 --> 01:34:23,000
安全的儲存key

3050
01:34:23,000 --> 01:34:25,000
我們把這個route of trust

3051
01:34:25,000 --> 01:34:26,000
讓它配備有

3052
01:34:26,000 --> 01:34:29,000
配備有靜態跟動態的entropy

3053
01:34:29,000 --> 01:34:32,000
就是配備有靜態跟動態的商員

3054
01:34:32,000 --> 01:34:34,000
那再來最後一個是

3055
01:34:34,000 --> 01:34:36,000
我們要怎麼樣

3056
01:34:36,000 --> 01:34:38,000
能夠安全的讓key

3057
01:34:38,000 --> 01:34:40,000
用在密碼學的運作裡面

3058
01:34:40,000 --> 01:34:43,000
那就是我們把這個route of trust

3059
01:34:43,000 --> 01:34:44,000
這個單元

3060
01:34:44,000 --> 01:34:47,000
我們再給它配備密碼學演算法

3061
01:34:47,000 --> 01:34:49,000
目的在於說

3062
01:34:49,000 --> 01:34:51,000
如果今天所有安全功能

3063
01:34:51,000 --> 01:34:53,000
都執行在一個固定的邊界裡面

3064
01:34:53,000 --> 01:34:57,000
它就不會有比方說key

3065
01:34:57,000 --> 01:34:59,000
或是為加密的重要資料

3066
01:34:59,000 --> 01:35:01,000
在buzz上面流傳

3067
01:35:01,000 --> 01:35:02,000
這樣子的狀況

3068
01:35:02,000 --> 01:35:06,000
它可以安全的鎖在一個邊界裡面

3069
01:35:06,000 --> 01:35:08,000
那這三個問題的答案

3070
01:35:08,000 --> 01:35:09,000
對應過來就是

3071
01:35:09,000 --> 01:35:11,000
怎麼樣產生key new puff

3072
01:35:11,000 --> 01:35:12,000
怎麼樣安全的儲存key

3073
01:35:12,000 --> 01:35:13,000
用puff rt

3074
01:35:13,000 --> 01:35:14,000
我們前面講過puff rt

3075
01:35:14,000 --> 01:35:17,000
有dynamic跟static entropy

3076
01:35:17,000 --> 01:35:18,000
就是說你這邊有

3077
01:35:18,000 --> 01:35:20,000
有secure o t p 跟

3078
01:35:20,000 --> 01:35:21,000
你另外有trng

3079
01:35:21,000 --> 01:35:22,000
可以產生

3080
01:35:22,000 --> 01:35:23,000
真隨即的亂數給你使用

3081
01:35:23,000 --> 01:35:25,000
怎麼樣安全的用key

3082
01:35:25,000 --> 01:35:27,000
在這個密碼學的運作裡面

3083
01:35:27,000 --> 01:35:29,000
我們把這個puff rt的這個單元

3084
01:35:29,000 --> 01:35:32,000
外面再掛上其他的演算法

3085
01:35:32,000 --> 01:35:34,000
所有安全功能都會執行

3086
01:35:34,000 --> 01:35:35,000
在這個邊界裡面

3087
01:35:35,000 --> 01:35:36,000
然後你這個邊界

3088
01:35:36,000 --> 01:35:38,000
它另外才接到buzz上面去

3089
01:35:38,000 --> 01:35:40,000
所以不會有

3090
01:35:40,000 --> 01:35:42,000
任何這個禁藥什麼資料

3091
01:35:42,000 --> 01:35:44,000
在外面流通的這樣的問題

3092
01:35:44,000 --> 01:35:46,000
所以三個問題對應

3093
01:35:46,000 --> 01:35:47,000
三個答案

3094
01:35:47,000 --> 01:35:48,000
我想就是今天如果答案

3095
01:35:48,000 --> 01:35:49,000
能夠帶走這個

3096
01:35:49,000 --> 01:35:50,000
多少會有點幫助

3097
01:35:50,000 --> 01:35:52,000
那今天的內容大概就到這邊

3098
01:35:52,000 --> 01:35:54,000
那謝謝大家

3099
01:35:54,000 --> 01:35:55,000
謝謝