ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used),...

24
ì Forward Secrecy Fall 2017 Secure Software Systems 1

Transcript of ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used),...

Page 1: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

ìForward Secrecy

Fall2017SecureSoftwareSystems

1

Page 2: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

The Threat

ì “Eve”(cough,NSA,cough) recordsmultipleyearsofencryptedmessagesbetweenAliceandBobfrom2015-2017ì Can’tbreakthem– algorithm&implementation

containsnoknownflaws

ì Then,inOctober2017,azero-dayexploitallowsEvetostealtheencryptionkeyfromAlice

ì Result:Allhistoricalmessagessavedcanbedecrypted

Fall2017SecureSoftwareSystems

2

Page 3: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Revisiting – Heartbleed

ì Notjustahypotheticalconcern!

ì OpenSSL(2014)- CVE-2014-0160 :ì Allowsremoteattackers toobtainsensitive

informationfromprocessmemoryviacraftedpacketsthattriggerabufferover-read,asdemonstratedbyreadingprivatekeys

ì Allowsattackertorecoveraprivatekeytoday,anddecryptany&alloldencryptedtraffictheymayhavestored

Fall2017SecureSoftwareSystems

3

Page 4: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Forward Secrecy

ì ForwardSecrecy– Pastsessionsareprotectedagainstfuturecompromiseofsecretkeys

ì PerfectForwardSecrecy– Eachencryption/decryptionkeyisvalidforonlyone“session”ì Lookforthis!

Fall2017SecureSoftwareSystems

4

Page 5: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Perfect Forward Secrecy Examples

ì TransportLayerSecurity(TLS)ì Ephemeral EllipticCurveDiffie-Hellman

ECDHE-RSA,ECDHE-ECDSA (EisforEphemeral)ì Ephemeral Diffie-Hellman

ì DHE-RSA,DHE-DSAì Easytoenableserver-side,butcangetlostinblizzardof

TLSoptionsandbackwardscompatibility

ì SignalProtocolì DoubleRatchetAlgorithm

https://signal.org/blog/advanced-ratcheting/ì Signalmessenger,WhatsApp,FacebookMessenger

Fall2017SecureSoftwareSystems

5

Page 6: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

ìTransport Layer Security (TLS)

Fall2017SecureSoftwareSystems

6

Page 7: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Transport Layer Security (TLS)

ì Encryptionprovidedattheapplicationlayerì Physicallayer– Ethernetì Networklayer– IPì Transportlayer– TCPì Applicationlayer– TLSfirst,then…

ì Commonuses:web(HTTPS),email,VOIP,messaging

Fall2017SecureSoftwareSystems

7

Page 8: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Transport Layer Security (TLS)

ì Twovariantsì SecureSocketLayer(SSL)– don’tuse!

ì SSL1.0(neverpubliclyused),SSL2.0,SSL3.0ì TransportLayerSecurity(TLS)–modernsuccessor

ì TLS1.0,TLS1.1,TLS1.2,TLS1.3 (draft)

Fall2017SecureSoftwareSystems

8

Page 9: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Transport Layer Security (TLS)

ì Hybridencryptionschemeì Publickeyencryptionfor handshakeì Symmetrickeyencryptionforbulkdatatransport

ì Keyisuniquepersessionandnegotiatedduringhandshake

ì MACs toprovideintegrityì Datadidn’tchangeintransit

ì Certificateauthorities(CAs)toprovideauthenticityì I’mcommunicatingwiththeintendedparty

ì Many(many!)choicesinspecificciphers&algorithms

Fall2017SecureSoftwareSystems

9

Page 10: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Transport Layer Security (TLS)

Fall2017SecureSoftwareSystems

10

ClientHelloVersion,cryptooptions,nonce

Serverhello+servercert(PKs)Version,cryptooptions,nonce,Signedcertificatew/server’spublickey

DataTransmission

(HTTPoverTLS)

HTTPSClient 🙋 🖥 HTTPSServer

Serverkeyexchange(whenusingDH)

ClientkeyexchangePreMaster secretencryptedwithserver’sPKs

Handshakefinished.Switchtonegotiatedblockcipher

Page 11: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

11

https://www.ssllabs.com/ssltest/analyze.html?d=cyberlab.pacific.edu

Page 12: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

12

https://www.ssllabs.com/ssltest/analyze.html?d=cyberlab.pacific.edu

Page 13: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

13

https://www.ssllabs.com/ssltest/analyze.html?d=cyberlab.pacific.edu

Page 14: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

14

https://www.ssllabs.com/ssltest/analyze.html?d=cyberlab.pacific.edu

Listwasmuchlonger(andweaker!)untilcustomconfigurationwasappliedtoserver

Page 15: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

15

Page 16: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

16

Page 17: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

17

Page 18: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Fall2017SecureSoftwareSystems

18

Page 19: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Certificate Authorities

ì Trustedthirdpartyì Trustedbyownerofcertificate(e.g.website)ì Trustedbypartyrelyingoncertificate(e.g.visitor)

Fall2017SecureSoftwareSystems

19

Page 20: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Certificate Authorities

ì Comodo isusedby16.4%ofallwebsites

ì Comodo isaSSLcertificateauthoritywithamarketshareof39.2%

ì October132017data

Fall2017SecureSoftwareSystems

20

https://w3techs.com/technologies/overview/ssl_certificate/all

Page 21: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Certificate Weaknesses

ì Method1:Placedesiredcommonname(e.g.“fakebook.com”inaboguscertì Webbrowserswillvalidatecertanddetectforgeryì Othersoftwarelibrariesmayhavebrokenvalidation

codeandmisstheforgery!

ì Method2:Trick/hack/bribeaCAtoissue&sign.AnyCAcanissueanycertificateforanydomain!ì Apple“SystemRoots”keychain:168entriesì OtherplayersalsodecidewhatrootCAs totrust

ì Microsoft,Mozilla,Android

Fall2017SecureSoftwareSystems

21

Page 22: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Root CA Misuse

ì DigiNotar (DutchCA)ì Attackersignedwildcardcertfor*.google.comì UsedtoconductMITM attackagainstGoogle

(multipleISPsinIran)ì IssuedJuly272011,detectedAug272011ì RemovedastrustedrootCAAug292011ì Companybankrupt

Fall2017SecureSoftwareSystems

22

Page 23: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Root CA Misue

ì WoSign (ChineseCA)ì Issuedfakecertin2016forsubdomain.github.com due

toshoddy/missingownershipverificationprocessì https://www.schrauger.com/the-story-of-how-wosign-

gave-me-an-ssl-certificate-for-github-comì BackdatedSHA-1certifications

ì BrowserswereintentionallyblockingweakSHA-1certsafterJan12016

ì https://wiki.mozilla.org/CA:WoSign_Issuesì SubsidiaryStartCom/StartSSL (Isreal)ì SlowlyremovedastrustedrootCAin2016-2017by

Google,Mozilla,Appleì ButstillinmyKeychain?(?????)

Fall2017SecureSoftwareSystems

23

Page 24: ì Forward Secrecy · ì Secure Socket Layer (SSL) –don’t use! ìSSL 1.0 (never publicly used), SSL 2.0, SSL 3.0 ì Transport Layer Security (TLS) –modern successor ìTLS 1.0,

Root CA Misuse

ì Symantec(USCA)ì AccusedbyGoogleofissuing30,000suspectcertificates

ì Not30kattacks,but30kcertswithinsufficientvalidation,audit,assurance,etc…

ì ChromeRootCertificatePolicy-WhatyoumustdoifyouwantGoogletotrustyou!ì https://www.chromium.org/Home/chromium-security/root-ca-

policyì Googleissuedprogressivedeathpenalty(Chromewillstop

trustingcustomer certssignedbySymantecinlate2018)ì Aug22017:Symantecsellscertificatebusinessto

competitorDigiCert for$950million(cheap!)whowillauditandre-certifyfollowingbestpractices

Fall2017SecureSoftwareSystems

24

“IntenttoDeprecateandRemove:TrustinexistingSymantec-issuedCertificates”- March232017https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/eUAKwjihhBs/rpxMXjZHCQAJ


SSL (Secure Socket Layer) - Sollae Systems · 2016-04-07 · 1.1 SSL (Secure Socket Layer) The Secure Socket Layer (SSL), developed by Netscape Company, was originally designed for

SSL (Secure Socket Layer) - Sollae Systems · 2016-04-07 · 1.1 SSL (Secure Socket Layer) The Secure Socket Layer (SSL), developed by Netscape Company, was originally designed for

SSL/TLS and MITM attacks - Uppsala University · 2009. 12. 14. · SSL/TLS – Background SSL/TLS – Secure Socket Layer/Transport Layer Security (rfc 2246) Originally developed

SSL/TLS and MITM attacks - Uppsala University · 2009. 12. 14. · SSL/TLS – Background SSL/TLS – Secure Socket Layer/Transport Layer Security (rfc 2246) Originally developed

Secure Sockets Layer (SSL).0

Secure Sockets Layer (SSL).0

SSL(Secure Socket Layer)

SSL(Secure Socket Layer)

Inro to Secure Sockets Layer: SSL

Inro to Secure Sockets Layer: SSL

Secure Socket Layer - Erlangerlang.org/doc/apps/ssl/ssl.pdf · Secure Socket Layer 1 SSL User's Guide The Secure Socket Layer (SSL) application provides secure communication over

Secure Socket Layer - Erlangerlang.org/doc/apps/ssl/ssl.pdf · Secure Socket Layer 1 SSL User's Guide The Secure Socket Layer (SSL) application provides secure communication over

Secure Socket Layer (SSL)

Secure Socket Layer (SSL)

Secure Sockets Layer (SSL) Protocol

Secure Sockets Layer (SSL) Protocol

BubbleCloud · 2019. 7. 1. · LTE Layer X.509 TLS/SSL MQPTT X.509 TLS/SSL MQTT. IT EPC LTE. X.509 TLS/SSL MQTT. SIM CARD SIM CARD. IT layer runs over LTE layer and duplicates functionality

BubbleCloud · 2019. 7. 1. · LTE Layer X.509 TLS/SSL MQPTT X.509 TLS/SSL MQTT. IT EPC LTE. X.509 TLS/SSL MQTT. SIM CARD SIM CARD. IT layer runs over LTE layer and duplicates functionality

Secure Socket Layer (SSL) Certificate€¦ · Secure Socket Layer (SSL) Certificate SSL certificates are an essential component of the data encryption process that makes Internet

Secure Socket Layer (SSL) Certificate€¦ · Secure Socket Layer (SSL) Certificate SSL certificates are an essential component of the data encryption process that makes Internet

Configuring Secure Sockets Layer (SSL) communication ...

Configuring Secure Sockets Layer (SSL) communication ...

Lecture 13 Transport Layer Security/ Secure Socket Layer (TLS/SSL)keldefra/teaching/fall2016/uci_compsci... · 2016-11-09 · SSL: Secure Sockets Layer vwidely deployed security protocol

Lecture 13 Transport Layer Security/ Secure Socket Layer (TLS/SSL)keldefra/teaching/fall2016/uci_compsci... · 2016-11-09 · SSL: Secure Sockets Layer vwidely deployed security protocol

Secure Sockets Layer (SSL)

Secure Sockets Layer (SSL)

Fundamental of Secure Socket Layer (SSL) | Part - 2

Fundamental of Secure Socket Layer (SSL) | Part - 2

Secure Sockets Layer (SSL) Protocol - Digi Internationalftp1.digi.com/support/documentation/0200054_d.pdf · Secure Sockets Layer (SSL) Protocol 1.0 Introduction What is SSL? SSL

Secure Sockets Layer (SSL) Protocol - Digi Internationalftp1.digi.com/support/documentation/0200054_d.pdf · Secure Sockets Layer (SSL) Protocol 1.0 Introduction What is SSL? SSL

Secure Sockets Layer (SSL) Protocol by Steven Giovenco.

Secure Sockets Layer (SSL) Protocol by Steven Giovenco.

SSL: Secure Sockets Layer

SSL: Secure Sockets Layer

Module 5: TLS and SSL 1. Overview Transport Layer Security Overview Secure Socket Layer Overview SSL Termination SSL in the Hosted Environment Load Balanced.

Module 5: TLS and SSL 1. Overview Transport Layer Security Overview Secure Socket Layer Overview SSL Termination SSL in the Hosted Environment Load Balanced.

1 Secure Socket Layer 2 Overall What is Secure Socket Layer? SSL Protocol Stack SSL Protocol and its Components.

1 Secure Socket Layer 2 Overall What is Secure Socket Layer? SSL Protocol Stack SSL Protocol and its Components.

Technology Primer: Secure Sockets Layer (SSL) - Blue Coat

Technology Primer: Secure Sockets Layer (SSL) - Blue Coat