January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
354
｜
第
11
章
SHA-1
有已知的脆弱性，在大约
2
61
个操作中可以发现冲突，使用
HashClash
注
21
和云基础设施来破坏
SHA-1
哈希算法，估计需要花费
70
万
美元
注
22
。
会话恢复
通过进行完全握手来恢复
TLS
会话在计算上代价是昂贵的。因此，服务器支
持取消完整往返的恢复模式：
TLS
恢复
如果对等方之前已经协商了主秘密，可以使用简短的握手来恢复
TLS
会
话。客户端
Hello
包含一个会话
ID
，如果服务器使用相应的主密码识别该
ID
，则可以使用该
ID
。由于随机值是新的，因此生成了
A
修订的密钥块（见
图
11-5
）。
TLS
会话凭证扩展
维护服务器端状态在大型环境中存在挑战，因此客户端存储会话标识符（使
用服务器私钥加密）的机制被批准为
TLS
扩展
注
23
。恢复机制以与以前相
同的方式工作，但是由客户端维护状态。实际上，跨负载平衡的
TLS
端
点部署扩展需要认真思考：所有服务器都必须用共享私钥初始化，并且可
能需要额外的机制来定期轮换。
会话重新协商
一个
TLS
会话可以通过现有的安全通道重新协商，以重新密钥或执行进一步
的身份验证。在该机制
注
24
中发现了
A
漏洞，通过该漏洞，具有网络访问权
限的对手可以拦截并保存来自合法客户端的握手记录，与服务器建立
TLS
会
话本身，发送应用程序数据，启动重新协商，并释放合法的握手记录。当通
注 21： Bruce Schneier, “When Will We See Collisions for SHA-1?”, Schneier on Security,
October 5, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.