QualysGuard InfoDay 2012 - SSL LABS
-
Upload
risk-analysis-consultants-sro -
Category
Technology
-
view
700 -
download
2
description
Transcript of QualysGuard InfoDay 2012 - SSL LABS
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
SSL LABS
RAC QualysGuard InfoDay 2012 1
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
Qualys & SSL
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
SSL Labs
SSL Labs: A non-commercial
security research effort focused on SSL, TLS, and friends
Projects: Assessment tool SSL Rating Guide Passive SSL client
fingerprinting tool SSL Threat Model SSL Survey
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
SSL Implementation Ecosystem
The SSL ecosystem includes many players: Basic cryptographic algorithms SSL and TLS encryption protocols IETF TLS Working Group Public Key Infrastructure (PKI) standards SSL library developers SSL Client vendors (esp. major browser vendors) SSL Server vendors Certificate Authorities and their resellers CA/Browser Forum System administrators Consumers
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
Free SSL Lab Audit Service
Register here: http://www.ssllabs.com
RAC QualysGuard InfoDay 2012
Audit implementation of SSL protocol on you WebProjects: Certificate Validity and Trust
SSL Protocol version support
Encryption Cipher Strength
Encryption Key Exchange
SOLUTION description
Risk of Attack description
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
SSL Assessment Details
Highlights: Renegotiation vulnerability Cipher suite preference TLS version intolerance Session resumption Firefox 3.6 trust
baseEvery assessment
consists of about: 2000 packets 200 connections 250 KB data
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
SSL Assessment Details
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
Countries Overview
Countries with over 5,000 certificates:
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
How Many CertsFailed Validation and Why?
Trusted versus untrusted
certificatesValidation failures
Remember thatthe methodology
excludes hostname mismatch problems
32,642 (3.76%) haveincomplete chains
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
Protocol Support
Protocol Support Best protocol
SSL v2.0 625,484 -
SSL v3.0 1,156,033 13,471
TLS v1.0 1,143,673 1,141,458
TLS v1.1 2,191 2,007
TLS v1.2 211 211
Half of all trusted servers support the insecure SSL v2 protocol
Modern browsers won’t use it, but wide support for SSL v2 demonstrates how we neglect to give any attention to SSL configuration
Virtually all servers supportSSLv3 and TLS v1.0
Virtually no support for TLS v1.1 (released in 2006) or TLS v1.2 (released in 2008)
At least 18,111 servers will accept SSLv2 but only deliver a user-friendly error message over HTTP
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
Ciphers, Key Exchange and Hash Functions
Cipher Servers Percentage3DES_EDE_CBC 1,139,215 98.42%
RC4_128 1,129,315 97.56%
AES_128_CBC 713,188 61.61%
AES_256_CBC 703,320 60.76%
DES_CBC 666,185 57.55%
RC4_40 624,294 53.93%
RC2_CBC_40 600,048 51.84%
RC2_128_CBC 518,803 44.82%
RC4_56 414,396 35.80%
DES_CBC_40 297,783 25.72%
IDEA_CBC 80,405 6.94%
RC2_CBC_56 73,491 6.34%
CAMELLIA_256_CBC 33,287 2.87%
CAMELLIA_128_CBC 33,287 2.87%
SEED_CBC 13,406 1.15%
NULL 7,513 0.64%
AES_256_GCM 3 -
AES_128_GCM 1 -
FORTEZZA_CBC 1 -
Triple DES and RC4rule in the cipher space There is also good support
for AES, DES and RC2
Key exchange Servers PercentageRSA 1,157,434 99.99%
RSA_EXPORT 623,914 53.90%
DHE_RSA 478,694 41.35%
RSA_EXPORT_1024 418,707 36.17%
DHE_RSA_EXPORT 250,337 21.62%
Hash Servers PercentageSHA 1,154,171 99.71%
MD5 1,103,240 95.31%
SHA256 77 -
SHA384 423 -
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
Cipher Strength
Best cipher strength support Cipher strength support
All servers support strong and most support very strong ciphers But there is also wide support
for weak ciphers
RAC QualysGuard InfoDay 2012
www.ra
c.cz
Risk Analysis
Con
sulta
nts
V060420
SSL Labs Score Distribution
Key length ScoreA >= 80B >= 65C >= 50D >= 35E >= 20F < 20
Score distribution
Most servers not configured well Only 31.24% got an A 68.76% got a B or worse Most probably just use the
default settings of their web server
Grade distribution
RAC QualysGuard InfoDay 2012