HTTPS ikomeye kandi ikora neza

Isaha irimo gufata Encryption yuyu munsi - Kandi ubucuruzi bwinshi nta gitekerezo gifite

Igihe cyose umukiriya atanze ubwishyu, asinya mukibaho, cyangwa yohereje ubutumwa binyuze kumurongo wawe, HTTPS irinda bucece ayo makuru ukoresheje algorithm ya cryptographic imaze imyaka mirongo. Ariko ihindagurika ry’ibiza rirakomeje. Mudasobwa ya Quantum - imashini zikoresha fiziki zidasanzwe zo kurengerwa no kwizirika - zirihuta cyane mubushobozi bwo gusenya imibare yimibare ya RSA, ECDSA, na Diffie-Hellman yo guhanahana amakuru. Iterabwoba ntirikiri inyigisho. Muri 2024, NIST yarangije ibipimo byayo bitatu bya mbere nyuma ya kwantumasi (PQC). Google, Cloudflare, na Apple batangiye gukoresha algorithms irwanya kwant mu musaruro. Kubucuruzi ubwo aribwo bwose bwohereza amakuru yoroheje kurubuga rwa interineti - ibyo bikaba aribyo byose mubucuruzi - gusobanukirwa na kwant-umutekano HTTPS ntibikiri ngombwa. Nibikorwa byingirakamaro.

Impamvu HTTPS Yubu izacika munsi yigitero cya Quantum

Uyu munsi HTTPS yishingikirije kuri TLS (Umutekano wo gutwara abantu), ikoresha kode ya asimmetrike mugihe cyo guhana intoki kugirango ushireho ibanga risangiwe hagati yumukiriya na seriveri. Umutekano wu guhana intoki biterwa nibibazo byimibare mudasobwa ya kera idashobora gukemura neza: gukora integer nini (RSA) cyangwa kubara logarithms ya discret logretithms kumurongo wa elliptike (ECDH). Mudasobwa ifite imbaraga zihagije zikoresha algorithm ya Shor irashobora gukemura haba mugihe cyoguhindura abagore benshi, bikagabanya icyatwara mudasobwa ya super super mudasobwa imyaka miriyoni kumasaha cyangwa iminota.

Igipimo giteye ubwoba cyane ni "gusarura ubungubu, gutobora nyuma" ingamba zimaze gukoreshwa nabakinnyi bigihugu. Abanzi bandika traffic ibanga uyumunsi bagamije kuyifungura iyo mudasobwa ya kwant imaze gukura. Inyandiko zerekeye imari, amakuru yubuzima, umutungo wubwenge, itumanaho rya leta - ikintu cyose cyafashwe muri transit noneho gihinduka intege nke. Ikigo cy'igihugu gishinzwe umutekano cyihanangirije ko iri terabwoba rigera ku makuru ayo ari yo yose agomba gukomeza kuba ibanga mu gihe kirenze imyaka 10, akubiyemo amakuru menshi akomeye mu bucuruzi.

Ibigereranyo biratandukana mugihe mudasobwa ifitanye isano na mudasobwa (CRQC) izagera. Igishushanyo mbonera cya IBM cyibasiye 100.000+ qubits muri 2033. Google yerekanye intambwe yo gukosora amakosa yo gukosora hamwe na chip yayo ya Willow mu mpera za 2024. Mugihe CRQC ishoboye kumena 2048-bit RSA ishobora kuba itangiye imyaka 10-15, kwimuka kwa protocole itekanye bigomba gutangira nonaha kuko inzibacyuho ya kriptografiya itwara imyaka icumi cyangwa irenga kugirango irangire mubikorwa remezo byisi yose.

Ibipimo bishya: ML-KEM, ML-DSA, na SLH-DSA

Nyuma yimyaka umunani yo gusuzuma isuzumabumenyi ryatanzwe nabashinzwe gufata amashusho ku isi yose, NIST yasohoye amahame atatu nyuma ya kwant ya cryptographic muri Kanama 2024.Iyi algorithm yashizweho kugirango irwanye ibitero bituruka kuri mudasobwa ya kwant na mudasobwa ya kera, itanga umutekano w'igihe kirekire utitaye ku buryo ibyuma bya kwant bigenda byihuta.

ML-KEM . Isimbuza ECDH ikoresheje imibare yimibare yibibazo byubatswe byubatswe, biguma bidashoboka ndetse no kuri mudasobwa ya kwant. ML-KEM ikora neza cyane - ingano yingenzi ni nini kuruta ECDH (hafi 1,568 bytes kuri ML-KEM-768 na 32 bytes kuri X25519), ariko kubara hejuru ni bike, akenshi byihuta kuruta ibikorwa bya elliptike gakondo.

ML-DSA (Module-Lattice-ishingiye kuri Digital Signature Algorithm, yahoze ari CRYSTALS-Dilithium) na SLH-DSA ML-DSA itanga imikono yoroheje ikwiranye na porogaramu nyinshi, mugihe SLH-DSA itanga ibitekerezo bidasubirwaho bishingiye gusa kumikorere ya hash, itanga kwirwanaho-byimbitse niba ibitekerezo bishingiye kuri lattike bigenda bigabanuka.

Uburyo bwa Hybrid: Inzira Pragmatic Kuri Umutekano wa Quantum

Nta injeniyeri wumutekano ushinzwe gutanga igitekerezo cyo guhindura ijoro ryose. Ahubwo, inganda zahujije kuri uburyo bwa Hybrid buhuza algorithm ya kera na algorithm ya post-kwant muri buri TLS ukuboko. Niba post-kwant algorithm ihindutse ifite intege nke zitavumbuwe, algorithm ya kera iracyarinda ihuriro. Niba mudasobwa ya kwant isenya algorithm ya kera, algorithm ya post-kwant ifata umurongo. Utakaza gusa umutekano niba byombi byangiritse icyarimwe - ibintu bidashoboka mu bumenyi bw'ikirere.

Chrome na Firefox bimaze gushyigikira X25519Kyber768 ya Hybrid urufunguzo rwibanze bitarenze guhera mu ntangiriro za 2025, bivuze ko amamiriyoni ya HTTPS ihuza buri munsi asanzwe afite kwant-umutekano kuruhande rwingenzi. Cloudflare yatangaje ko hejuru ya 35% yumuhanda wa TLS 1.3 ukoresha amasezerano yingenzi nyuma ya kwant. AWS, Microsoft Azure, na Google Cloud byose byatangije amahitamo ya TLS yumutekano kubikorwa byabo bicungwa. Inzibacyuho ibaho byihuse kuruta ubucuruzi bwinshi bubimenya.

Igiciro cyo kwimuka kuri kwant-umutekano HTTPS gipimwa mumasaha yubuhanga no kugerageza. Igiciro cyo kutimuka gipimirwa mubwumvikane buhoraho bwibanga ryose ubucuruzi bwawe bwigeze bwohereza. Gukoresha Hybrid bivanaho gukenera guhitamo hagati yumutekano no kwitonda - urabona byombi.

Ibikorwa Byukuri: Ubukererwe, Umuyoboro mugari, hamwe no gufatana urunana hejuru

Kimwe mubibazo byambere byerekeranye na post-kwant cryptography ni imikorere itesha agaciro. Ingano nini nini nisinywa bisobanura bytes nyinshi kumurongo kandi birashoboka ko guterana intoki. Ibikorwa-byukuri byoherejwe byerekanye izi mpungenge zishobora gucungwa, ariko ntabwo ari zeru.

Kugirango habeho guhanahana amakuru, ML-KEM-768 yongeraho hafi 1.1 KB mukuboko kwa TLS ugereranije na X25519 wenyine. Muburyo bwa Hybrid (X25519 + ML-KEM-768), hejuru yinyongera yose hamwe ni 1.2 KB. Ku miyoboro igezweho, ibi bisobanura kwiyongera gukabije - mubisanzwe munsi ya milisegonda 1 kumurongo mugari. Umusaruro wa Cloudflare werekanye ko nta ngaruka zifatika zagaragaye kurupapuro rwumutwaro kubantu benshi bakoresha. Nyamara, kumiyoboro yabujijwe (guhuza satelite, ibikoresho bya IoT, uturere dufite umurongo mugari), hejuru irashobora kwiyongera, cyane cyane iyo urunigi rwimpamyabumenyi narwo rutwara umukono wa nyuma ya kwant.

Umukono wo kwemeza utanga ikibazo kinini. Imikono ya ML-DSA-65 igera kuri 3.3 KB ugereranije na 64 bytes kuri ECDSA-P256. Iyo buri cyemezo kiri mumurongo gitwaye umukono wa nyuma ya kwant, urunigi rusanzwe rwimpamyabumenyi eshatu rushobora kongeramo 10 KB cyangwa byinshi mukuboko. Niyo mpanvu inganda zirimo gushakisha tekiniki nko guhagarika ibyemezo, Merkle Tree Certificates, hamwe na TLS-urwego rwohanagura kugirango ubunini bw'intoki bugire akamaro. Ubucuruzi bukoresha urubuga hamwe n’abakoresha ku isi - cyane cyane abakoresha telefone zigendanwa ku masoko agaragara - bagomba gusuzuma izo ngaruka bitonze.

Icyo Abashoramari Bagomba Gukora Noneho: Urutonde Rwimuka Ryimuka

Kwimuka kwa Quantum-umutekano ntabwo ari ikintu kimwe ahubwo ni icyiciro. Amashyirahamwe atangira kubara ibintu bifatika byifashishwa muri iki gihe bizaba bihagaze neza kuruta ibyo gutegereza manda. Hano hari uburyo bufatika bwo gutangira inzibacyuho:

1. Kora ibarura ryibanga. Menya buri sisitemu, protocole, nibitabo bikoresha RSA, ECDSA, ECDH, cyangwa Diffie-Hellman. Ibi birimo ibishushanyo bya TLS, amarembo ya API, VPNs, gusinya kode, kubika amakuru, hamwe n’abandi bantu.
2. Shyira imbere ukoresheje sensibilité de data no kuramba. "Gusarura nonaha, kubanga nyuma" bituma amabanga maremare arimbere cyane.
Gushoboza neza kandi ugenzure hamwe nibikoresho nka Qualys SSL Labs cyangwa Gufungura Quantum Yizewe yumushinga wibizamini.
3. Kuvugurura amasomero yibanga. Menya neza ko tekinoroji yawe ikoresha amasomero ashyigikira ML-KEM na ML-DSA - OpenSSL 3.5+, BoringSSL, liboqs, cyangwa AWS-LC. Ihindure kuri verisiyo zirimo NIST-yanyuma ishyirwa mubikorwa, ntabwo ari verisiyo yimikorere.
4. Ikizamini cyo guhuza no gusubira inyuma. Google yahuye nibi mugihe cyambere cya Kyber yatangiriye kandi yagombaga gushyira mubikorwa.
Ibi bivuze gukuramo ibikorwa bya crypto inyuma yimiterere igaragara kandi ukirinda amahitamo akomeye ya algorithm.