January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
374
｜
第
11
章
|_ssl-known-key: Found in Little Black Box 0.1
(SHA-1: 0028 e7d4 9cfa 4aa5 984f e497 eb73 4856 0787 e496)
不安全的生成证书
如果密钥生成过程中使用的值缺乏熵（例如，
PRNG
实现中存在缺陷），多
个证书可能共享素数，这会受到攻击。
注
45
研究显示，
2.5%
的在线
TLS
端点
的
RSA
私钥可能会受到攻击。
TLS
端点压力测试
Kali Linux
中的
thc-ssl-dos
实用程序
注
46
通过并发握手和客户端发起的重新
协商请求（如果服务器支持）对
TLS
端点执行压力测试。另一个实用程序是
sslsqueeze
注
47
，它更有效，不依赖于重新协商来淹没
TLS
端点。
与客户端相比，在
TLS
握手期间执行加密操作会消耗服务器上大量的
CPU
周
期。根据配置的不同，工作系数可以高达
25
（如文森特
•
伯纳
注
48
所述）。
如果资源耗尽，服务器将无法处理
TLS
流量，其他进程也会受到影响。
Thc-ssl-dos
的用法如下所示：
______________ ___ _________
\__ ___/ | \ \_ ___ \
| | / ~ \/ \ \/
| | \ Y /\ \____
|____| \___|_ / \______ /
\/ \/
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.